Privacy Policy

MigraTech Pty Ltd — ABN 45 596 350 923

Effective date: 22 August 2026 · Version 1.0

This Privacy Policy describes how MigraTech Pty Ltd collects, uses, stores, discloses, and protects personal information in connection with the MigraTech platform, public tools, client portal, and related services (collectively, the “Services”). This policy applies to all users of the Services, including registered migration agents (“Agents”), their clients (“Clients”), and individuals who use our public tools (“Users”).

MigraTech is committed to protecting personal information in accordance with the Privacy Act 1988 (Cth) (“Privacy Act”) and the Australian Privacy Principles (“APPs”).

1. Information We Collect

1.1 Information You Provide Directly

We collect personal information that you provide to us, including:

(a) Agent Account Information:

• Full name, email address, phone number, and business address
• MARA registration number and practice details
• Billing information (processed and stored by Stripe; we do not store full payment card details)
• Team member details (names and email addresses of Authorised Users)
• Practice preferences, settings, and configuration

(b) Client and Case Information (provided by Agents):

• Full name, date of birth, nationality, and contact details
• Passport details, visa history, and immigration status
• Employment history, qualifications, skills assessments, and English test results
• Health and character declaration information
• Family member details (for included applicants)
• Documents uploaded to the Platform, including identity documents, qualifications, employment references, and financial records
• Case notes, correspondence, and internal assessments created by Agents

(c) User Information (public tools and migrant accounts):

• Full name, email address, and phone number
• Nationality, date of birth, occupation, and qualifications
• English language test scores
• Work experience details
• Visa interests and migration preferences
• Profile information provided through onboarding questionnaires

(d) Inquiry Information:

Information submitted through the agent matching or inquiry functionality, including contact details, visa interests, and supporting details.

1.2 Information Collected Automatically

When you access the Services, we automatically collect:

• Device and Browser Information: IP address, browser type and version, operating system, device type, and screen resolution
• Usage Data: Pages visited, features used, time spent on pages, click patterns, search queries, and navigation paths
• Log Data: Server logs, error reports, and performance metrics
• Cookies and Similar Technologies: See section 8 below

1.3 Information from Third Parties

We may receive personal information from:

• Stripe: Payment confirmation, subscription status, and billing events (we do not receive or store full card numbers)
• Supabase Auth: Authentication tokens and session data

1.4 Sensitive Information

Some information collected through the Services may constitute sensitive information under the Privacy Act, including information about racial or ethnic origin (nationality, country of birth), health (medical examination results referenced in case data), and criminal record (character requirements referenced in case data).

Where Agents input sensitive Client information into the Platform, the Agent is responsible for obtaining consent from the Client for the collection and handling of that sensitive information in accordance with APP 3. Where Users voluntarily provide sensitive information through the public tools, consent is implied by the voluntary provision of that information.

2. How We Use Personal Information

2.1 Primary Purposes

We use personal information for the following purposes:

• providing, operating, and maintaining the Services;
• processing subscriptions, billing, and payments;
• enabling AI Features, including pathway analysis, RFI prediction, document intelligence, and lead scoring;
• facilitating agent-client matching and inquiry handling;
• providing the Client Portal and case status functionality;
• sending transactional communications, including account notifications, billing receipts, deadline alerts, and system notifications;
• providing customer support and responding to inquiries;
• authenticating users and maintaining account security;
• complying with legal obligations; and
• enforcing our Terms of Service.

2.2 Secondary Purposes

With appropriate safeguards, we also use personal information (in de-identified, aggregated form where possible) for:

• improving and developing the Services, including training and improving AI models;
• generating aggregated industry benchmarks and analytics;
• monitoring Platform performance, diagnosing technical issues, and preventing fraud;
• conducting product research and user experience analysis; and
• sending product updates and marketing communications (with your consent, and with the ability to opt out at any time).

2.3 AI Model Training

We may use de-identified, aggregated case outcome data to train and improve our AI models. This data is stripped of all personal identifiers before use. We do not use identifiable personal information to train AI models without explicit consent.

3. How We Disclose Personal Information

3.1 Service Providers

We disclose personal information to third-party service providers who assist us in operating the Services:

All service providers are contractually bound to use personal information only for the purposes of providing their services to us and to implement appropriate security measures.

We will provide at least 14 days’ notice before engaging a new subprocessor that processes personal information. The full register, including capabilities that are built but not yet switched on, is at Subprocessors.

3.2 Migration Agents

If you submit an inquiry through the agent matching functionality or use the public tools with a referral, your profile information and inquiry details will be shared with one or more registered Migration Agents for the purpose of facilitating a consultation. You will be informed before any such sharing occurs.

3.3 Legal Requirements

We may disclose personal information where required or authorised by: (a) Australian law, including the Privacy Act, the Migration Act, or any court order or subpoena; (b) a law enforcement agency or government authority exercising a lawful function; or (c) the need to prevent a serious threat to the life, health, or safety of any individual or the public.

3.4 Business Transfers

In the event of a merger, acquisition, reorganisation, or sale of all or substantially all of our assets, personal information may be transferred to the successor entity, subject to the commitments in this Privacy Policy.

3.5 No Sale of Personal Information

We do not sell personal information to third parties.

3.6 Connected Accounts

Where you choose to connect a third-party account, MigraTech accesses only the data needed for the specific feature you have enabled. Connecting an account is always optional, and the Services function without it.

Data obtained from a connected account is used solely to provide the feature you enabled. We do not use it for advertising, do not sell or transfer it, do not allow humans to read it except where you have explicitly asked us to, where it is necessary for security or to comply with the law, and do not use it to train AI models.

MigraTech’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Access tokens are stored encrypted and are used only to make requests on your behalf. You can disconnect an account at any time from Settings → Integrations, which deletes the stored tokens. You may also revoke access directly through your Google account permissions, your Microsoft account, or your Xero connected apps settings.

4. Overseas Disclosure

Personal information is stored and processed in countries outside Australia. Our primary database, which holds client records and uploaded documents, is hosted in Singapore. Other service providers listed in our subprocessor register operate in the United States, and one in New Zealand and Australia. Before disclosing personal information to an overseas recipient, we take reasonable steps to ensure that the recipient complies with the APPs or is subject to a law or binding scheme that provides comparable protections, in accordance with APP 8.

By using the Services, you acknowledge and consent to the transfer of your personal information to overseas locations for the purposes described in this policy.

5. Data Security

5.1 Security Measures

We implement reasonable technical and organisational measures to protect personal information from unauthorised access, modification, disclosure, or destruction, including:

• encryption of data in transit (TLS) and at rest;
• row-level security (RLS) policies in our database to enforce data isolation between Agents;
• JWT-based authentication and role-based access controls;
• signed, time-limited URLs for document access;
• regular security monitoring and error tracking;
• access controls limiting employee and contractor access to personal information on a need-to-know basis; and
• secure password hashing and session management.

5.2 Data Breach Response

In the event of a data breach that is likely to result in serious harm, we will: (a) take immediate steps to contain the breach and mitigate any harm; (b) assess the breach in accordance with the Notifiable Data Breaches scheme under Part IIIC of the Privacy Act; (c) notify affected individuals and the Office of the Australian Information Commissioner (“OAIC”) as required by law; and (d) maintain a record of the breach and our response.

5.3 No Guarantee

While we take reasonable steps to protect personal information, no method of electronic transmission or storage is completely secure. We cannot guarantee the absolute security of personal information.

6. Data Retention

6.1 Retention Periods

We retain personal information for as long as necessary to fulfil the purposes described in this policy, subject to the following:

• Agent account data: Retained for the duration of the Subscription and for 12 months after termination, unless a longer period is required by law.
• Case and Client data: Retained for the duration of the Agent’s Subscription plus 30 days for data export (after which it may be deleted), unless a longer period is required by law.
• User account data: Retained for as long as the account is active and for 12 months after account closure.
• Public tool usage data: De-identified usage data may be retained indefinitely for analytics and AI model improvement purposes.
• Billing records: Retained for 7 years in accordance with Australian taxation law.

6.2 Deletion

You may request deletion of your personal information at any time (see section 7). We will comply with deletion requests subject to our legal obligations to retain certain records.

7. Your Rights

7.1 Access

You have the right to request access to the personal information we hold about you (APP 12). We will respond to access requests within 30 days. We may charge a reasonable fee to cover the cost of providing access.

7.2 Correction

You have the right to request correction of personal information that is inaccurate, out of date, incomplete, irrelevant, or misleading (APP 13). You may update most personal information directly through your account settings.

7.3 Complaints

If you believe we have breached the APPs or this Privacy Policy, you may lodge a complaint by contacting us at admin@migratech.com.au. We will investigate all complaints and respond within 30 days. If you are not satisfied with our response, you may lodge a complaint with the OAIC at www.oaic.gov.au.

7.4 Opt-Out of Marketing

You may opt out of marketing communications at any time by clicking the “unsubscribe” link in any marketing email or by contacting us. Opting out of marketing communications does not affect transactional communications (such as billing receipts, deadline alerts, and account notifications).

7.5 Account Deletion

You may request deletion of your account and associated personal information by contacting us at admin@migratech.com.au. We will process deletion requests within 30 days, subject to our legal obligations.

8. Cookies and Tracking

8.1 Types of Cookies

(a) Essential Cookies:

Required for the Services to function, including authentication session cookies and CSRF protection tokens. These cannot be disabled.

(b) Analytics Cookies:

Used to understand how users interact with the Services, including PostHog analytics cookies. These collect anonymised usage data.

(c) Preference Cookies:

Used to remember your settings and preferences, such as cookie consent choices.

8.2 Cookie Consent

When you first visit our website, you will be presented with a cookie consent banner. You may choose to accept all cookies, accept only essential cookies, or manage your preferences. You can change your cookie preferences at any time through the cookie settings link in the website footer.

8.3 Third-Party Analytics

We use PostHog for product analytics. PostHog collects anonymised usage data, including pages visited, features used, and interaction patterns.

We use Sentry for error monitoring. Sentry collects error reports and diagnostic data, which may include contextual information about the user’s session at the time of an error.

9. Children

The Services are not directed to individuals under 18 years of age. We do not knowingly collect personal information from children under 18. If we become aware that we have collected personal information from a child under 18, we will take steps to delete that information.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on our website and, where practicable, by email. The “Effective Date” at the top of this policy indicates when it was last updated. Your continued use of the Services after any changes constitutes acceptance of the updated policy.

11. Contact Us

If you have any questions about this Privacy Policy, wish to exercise any of your rights, or wish to make a complaint, please contact us: