Privacy Policy
Last updated: September 2026 · Effective for all Immi Flow agencies and portal participants
1. Overview & Scope
Immi Flow (“we”, “our”, “us”), a software product operated by Mazaal AI Pty Ltd, provides practice management and evidence preparation software to Australian Registered Migration Agents (RMAs), legal practitioners, and their clients (visa applicants and sponsors).
This Privacy Policy sets out how we collect, hold, use, disclose, and protect personal and sensitive information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).
2. Information We Collect
Due to the nature of Australian immigration casework, we process high-sensitivity personal information on behalf of subscribers, including:
- Identity and civil documents: Full legal names, dates of birth, nationalities, passport scans, birth certificates, marriage certificates, and government-issued photo IDs.
- Evidentiary material: Employment contracts, payslips, academic transcripts, English language test scores, police clearances, and statutory declarations.
- Contact details: Email addresses, telephone numbers (including WhatsApp identifiers), and residential addresses.
- Matter correspondence: Messages between migration agencies and visa applicants transmitted through our portal, SMS, or linked messaging channels.
3. Purpose of Collection & Use
We collect and process personal information solely for the following legitimate purposes:
- Enabling RMAs to organize case evidence, verify visa criteria, and prepare lodgement-ready matter files.
- Facilitating secure document collection and electronic cost agreement execution between agencies and clients.
- Assisting agencies in meeting statutory record-keeping obligations under the Migration Agents Code of Conduct (including the mandatory seven-year file retention period).
- Scanning uploaded documents for malicious software payloads before inclusion in matter records.
4. Cross-Border Disclosures (Australian Privacy Principle 8)
To provide high-availability infrastructure and specialized document processing, Immi Flow transfers certain personal information to overseas third-party service providers located in the United States:
- AWS (Amazon Web Services): Document and asset storage with server-side encryption (AES-256).
- Stripe, Inc.: Secure payment processing and billing tokenization.
- Loops, Inc.: Transactional email delivery (portal links and reminder notifications).
- Google Cloud Platform (Gemini AI): Transient document data extraction and text structuring.
Safeguards: Each provider is bound by formal Data Processing Addendums (DPAs) requiring data protection standards substantially equivalent to the Australian Privacy Principles. Document processing via AI is transient; inputs are not retained or utilized to train public foundation models.
5. AI Processing & Human Oversight
In alignment with the March 2026 Office of the Migration Agents Registration Authority (OMARA) AI Governance Guidance:
- All automated document extractions and criteria analyses are treated as advisory proposals.
- No automated finding is committed to a matter record without explicit human review and approval by the responsible Registered Migration Agent.
- Written client consent for AI-assisted processing is obtained prior to document intake.
6. Data Retention & Security
We maintain multi-layered technical controls including HTTPS/TLS 1.3 in transit, AES-256 encryption at rest, and automated malware scanning (ClamAV) on intake. Matter archives are retained for seven years in compliance with the Migration Act 1958 and the OMARA Code of Conduct, after which records may be securely purged or exported upon agency instruction.
7. Access, Correction & Contact
Under APPs 12 and 13, individuals have the right to request access to and correction of their personal information. If you are a visa applicant, you may contact your migration agency directly or reach our Privacy Officer: