Privacy Policy

1. Who We Are

Immi Flow is operated by Mazaal AI Pty Ltd (ABN 12 663 158 629). In this policy, “we”, “us” and “our” mean that company. We provide case management software for Australian migration agencies, legal practitioners and their clients.

We handle information supplied by agency staff, applicants, sponsors and other case participants. Your agency remains responsible for the information it collects and the advice it gives. This policy explains our role and your rights under Australian privacy law, including the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

2. Information We Collect & Where It Comes From

Information comes from you, your agency and the services your agency connects. Depending on the features used and the information supplied for a case, it can include:

• Identity and civil documents: Full legal names, dates of birth, nationalities, passport scans, birth certificates, marriage certificates, and government-issued photo IDs.
• Case evidence: Employment contracts, payslips, academic transcripts, English test results, police clearances, medical information and relationship evidence, where supplied for a matter.
• Contact details: Email addresses, telephone numbers (including WhatsApp identifiers), and residential addresses.
• Case correspondence: Messages, forms and notes supplied through the portal or connected communication channels.
• Account and service information: Sign-in details, agency settings, subscription and billing records, support requests and technical logs used to operate and protect the service.

Some case documents contain sensitive information, such as health details or a criminal record. Your agency should request only what it needs and must have your consent to collect sensitive information unless a legal exception applies. Consent to collect these documents is separate from permission to use AI.

Tax file numbers need special care. Cover or remove them from payslips and other documents before uploading, unless your agency confirms a lawful reason to collect them. This is a step for you and your agency; Immi Flow does not automatically remove tax file numbers from uploads.

3. Why We Use Information

We use information to provide and operate Immi Flow, including:

• Organising case records, collecting documents and preparing draft information for professional review.
• Delivering communications, managing agreements and supporting agency workflows.
• Administering accounts and subscriptions, responding to support requests and maintaining the service.
• Checking supported uploads, investigating errors and protecting against misuse.
• Supporting record keeping and responding to lawful requests and obligations.

4. Where Information Is Stored

Account and case information is held in hosted databases. Uploaded documents and generated files use separate cloud file storage. Extracted information and AI-generated drafts may also be saved with case records for review.

Primary records, file storage, any backups and connected services can have different data locations. Immi Flow does not provide a blanket guarantee that all storage and processing takes place exclusively in Australia. If your agency requires Australian-only hosting or another specific location, contact our Privacy Officer before supplying information to confirm whether the service meets that requirement.

5. Access, Sharing & Connected Services

Your agency's team and invited clients see information through their account or portal permissions. Authorised staff may also need access to relevant information to provide support or maintain the service.

We use service providers for hosting, file storage, document processing, communications, payments and connected integrations. Relevant information is shared to perform those functions. Connected services may handle information outside Australia; their handling of information is separate from storage of your primary case records. We may also disclose information where required or authorised by law.

We do not sell or rent customer case information. Contact our Privacy Officer for information about the service arrangements relevant to your agency.

6. AI Assistance, Consent & Review

AI-assisted features read relevant documents and case information to help your agency organise a file. They can extract details, suggest document categories, flag missing or conflicting information and prepare readiness checks. This can involve identity details, family relationships, employment, education and other information in your case documents.

These suggestions can help your agency decide what to check next. Drafts and extracted details may be saved before review, and they can contain mistakes. Your migration agent or legal practitioner decides what advice to give and what to include in an application. The relevant government authority decides whether to grant a visa.

• Your agency must explain its AI use and obtain written consent before entering your personal details into AI tools.
• For applicants uploading case documents through the portal, Immi Flow checks recorded AI permission before accepting the upload and checks it again before AI processing. Your agency must still make sure consent is valid and covers the intended use.
• You can decline AI processing or withdraw your permission by contacting your agency. Without AI permission, applicants cannot upload case documents through the portal. Ask your agency for another way to send documents and receive assistance without AI.
• Withdrawal does not undo processing already completed or automatically delete case records that must be retained.
• Limited retention by processing services may apply for security, abuse prevention or service operation. AI processing is not a promise that all copies are immediately deleted.

OMARA's AI guidance explains migration agents' professional responsibility, confidentiality obligations and the need for written client consent.

Ask your agency how it uses these tools in your case, or ask for a person to explain or review a result. A human review step does not remove the need to explain how AI contributes to decisions about you.

7. Retention, Export & Deletion

We keep information needed to provide the service and meet legal obligations. Different rules apply to client files, billing records, security logs and backup copies. When personal information is no longer needed for a lawful purpose and does not have to be kept by law, we must take reasonable steps to securely delete it or remove identifying details.

Under the Migration Agents Code of Conduct, migration agents must take reasonable steps to keep client files for seven years after the last action on the file. Your agency remains responsible for that duty after leaving Immi Flow. Keep the copies your practice needs; do not treat your subscription as a seven-year archive service.

Before cancelling, download the documents and exports your practice needs. Paid access ends at the end of the billing period. Cancellation alone does not delete your records. Our Terms of Service explain the available exports and how to raise questions before access ends.

To request deletion, contact our Privacy Officer. We will assess what can be deleted, what must be kept and whether backup copies are affected. We will explain the outcome and any limits. If you need a fixed deletion date or access after cancellation, agree those arrangements with us before cancelling.

8. Protecting Information

Immi Flow uses access controls, encrypted website connections, expiring document links and checks on supported upload paths to reduce the risk of unauthorised access, loss and misuse. Our Security & Data Residency page explains these safeguards and how to report a concern. No online service can guarantee complete security.

9. Access, Correction & Privacy Complaints

You can request access to or correction of your personal information under APPs 12 and 13, subject to applicable exceptions. Applicants can contact their agency or our Privacy Officer directly. We may need to verify your identity and clarify the information requested to protect other people's privacy.

To raise a privacy complaint, contact our Privacy Officer with a description of your concern and the information affected. We will review the complaint, seek further details where needed and respond with the outcome or next steps. If your concern remains unresolved, you can contact the Office of the Australian Information Commissioner (OAIC) about its complaint process.