Privacy Policy

Privacy Policy

Last updated: 1 June 2025

MigrateYou Pty Ltd (ABN to be confirmed) (“MigrateYou”, “we”, “us”, or “our”) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website, application, and services (collectively, the “Service”).

By using the Service, you consent to the practices described in this Privacy Policy.

1. Information We Collect

1.1 Information You Provide

When you use the Service, you may provide us with:

  • Account information - Name, email address, password, country of residence
  • Visa application data - Personal details, employment history, education records, travel history, address history, skills assessment information, English language test results, points calculation data, and any other information you enter into the application workspace
  • Identity documents - Copies of passports, birth certificates, qualifications, reference letters, police clearances, and other supporting documents you upload
  • Payment information - Billing details processed through Stripe (we do not store full credit card numbers)
  • Communications - Messages you send to us via contact forms, email, or support channels
  • Waitlist information - Email address and country of residence

1.2 Information Collected Automatically

When you access the Service, we may automatically collect:

  • Device information - Browser type, operating system, device type
  • Usage data - Pages visited, features used, time spent on the Service, referral source
  • Log data - IP address, access times, error logs
  • Cookies and similar technologies - See Section 7 below

1.3 Information from Third Parties

We may receive information from:

  • Authentication providers - If you sign in via Google, we receive your name, email, and profile picture
  • Payment processors - Stripe provides us with transaction confirmation and billing details (not full card numbers)
  • Migration agents - If you use the Agent Review service, the reviewing agent may provide feedback and notes about your application

2. How We Use Your Information

We use your information for the following purposes:

  • Providing the Service - Processing your visa assessment, building your application workspace, generating documents, calculating points, and delivering your application pack
  • Agent Review - Sharing your application data with the MARA-registered agent you have engaged for review (only with your explicit consent at the point of purchase)
  • Account management - Creating and managing your account, authenticating your identity, processing payments
  • Communication - Responding to your enquiries, sending service-related notifications, and providing customer support
  • Improvement - Analysing how the Service is used to improve features, fix issues, and develop new functionality
  • Security - Detecting, preventing, and responding to fraud, abuse, or security incidents
  • Legal compliance - Complying with applicable laws, regulations, and legal processes

We will not use your visa application data for marketing purposes or sell it to third parties.

If you are located in the European Economic Area (EEA), United Kingdom, or another jurisdiction that requires a legal basis for processing personal data, we rely on the following:

  • Contractual necessity - Processing necessary to provide the Service you have requested (Article 6(1)(b) GDPR)
  • Legitimate interests - Processing necessary for our legitimate interests, such as improving the Service and ensuring security, where those interests are not overridden by your rights (Article 6(1)(f) GDPR)
  • Consent - Where you have given explicit consent, such as for analytics cookies or sharing data with a migration agent (Article 6(1)(a) GDPR)
  • Legal obligation - Processing necessary to comply with applicable laws (Article 6(1)(c) GDPR)

4. How We Share Your Information

We do not sell your personal information. We may share your information in the following limited circumstances:

4.1 Service Providers

We use trusted third-party service providers to help operate the Service:

  • Google Cloud / Firebase - Data storage, authentication, and application hosting
  • Stripe - Payment processing
  • PostHog - Analytics (consent-gated, see Section 7)
  • Cloudflare - Security and performance (Turnstile bot protection)

These providers process your data only on our behalf and are contractually obligated to protect it.

4.2 Migration Agents

If you purchase an Agent Review, we share your application data with the independent MARA-registered migration agent assigned to your review. This sharing occurs only after you purchase the Agent Review service and constitutes your explicit consent. The agent is bound by their own professional obligations under the Migration Agents Registration Authority Code of Conduct.

We may disclose your information if required to do so by law, regulation, legal process, or governmental request, or if we believe disclosure is necessary to protect our rights, your safety, or the safety of others.

4.4 Business Transfers

If MigrateYou is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change and any choices you may have regarding your information.

5. Data Storage and Security

5.1 Storage Location

Your data is stored on Google Cloud infrastructure. Primary data storage is in Australia, but some data may be processed in other jurisdictions where Google operates data centres. By using the Service, you consent to this transfer.

5.2 Security Measures

We implement appropriate technical and organisational measures to protect your information, including:

  • Encryption of data in transit (TLS/SSL) and at rest
  • Secure authentication with session management
  • Role-based access controls
  • Regular security reviews
  • Secure payment processing via Stripe (PCI DSS compliant)

While we take reasonable steps to protect your information, no method of transmission over the internet or electronic storage is completely secure. We cannot guarantee absolute security.

5.3 Sensitive Immigration Data

We recognise that visa application data is highly sensitive. We treat all application workspace data, uploaded documents, and generated materials with the highest level of care. Access to this data within MigrateYou is restricted to personnel who require it to provide the Service.

6. Data Retention

We retain your information for as long as your account is active or as needed to provide the Service. Specifically:

  • Account data - Retained while your account is active and for 12 months after account closure
  • Application data - Retained while your account is active and for 24 months after account closure (to allow you to return and access your application)
  • Uploaded documents - Retained while your account is active and deleted within 30 days of account closure
  • Payment records - Retained for 7 years as required by Australian tax law
  • Analytics data - Aggregated and anonymised data may be retained indefinitely
  • Waitlist data - Retained until you unsubscribe or the waitlist is closed

You may request deletion of your data at any time (see Section 8).

7. Cookies and Analytics

7.1 Essential Cookies

We use essential cookies for authentication and session management. These are necessary for the Service to function and cannot be disabled.

7.2 Analytics (PostHog)

We use PostHog for analytics to understand how the Service is used and to improve it. PostHog cookies are only loaded after you provide consent via our cookie consent banner. You can withdraw consent at any time by clearing your cookies or using your browser settings.

7.3 Cloudflare Turnstile

We use Cloudflare Turnstile on forms to protect against bots and spam. This may set cookies as part of the verification process.

7.4 Managing Cookies

You can control cookies through your browser settings. Disabling essential cookies may affect the functionality of the Service.

8. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal information:

8.1 Access

You may request a copy of the personal information we hold about you.

8.2 Correction

You may request that we correct inaccurate or incomplete personal information.

8.3 Deletion

You may request that we delete your personal information. We will comply unless we are required to retain it by law (for example, payment records for tax purposes).

8.4 Data Portability

You may request a copy of your data in a structured, commonly used, machine-readable format.

8.5 Restriction of Processing

You may request that we restrict the processing of your personal information in certain circumstances.

8.6 Objection

You may object to our processing of your personal information where we rely on legitimate interests as the legal basis.

Where processing is based on your consent (such as analytics cookies or Agent Review data sharing), you may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

8.8 How to Exercise Your Rights

To exercise any of these rights, contact us at hello@migrateyou.com. We will respond within 30 days. We may need to verify your identity before processing your request.

9. Australian Privacy Act

We comply with the Australian Privacy Principles (APPs) contained in the Privacy Act 1988 (Cth). In addition to the rights described above, Australian residents may:

  • Make a complaint to us about a breach of the APPs
  • If unsatisfied with our response, lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au

10. International Data Transfers

If you are located outside Australia, your information will be transferred to and processed in Australia. Where we transfer data to countries that may not have equivalent data protection laws, we ensure appropriate safeguards are in place, such as standard contractual clauses or reliance on the service provider’s data protection framework.

11. Children’s Privacy

The Service is not intended for anyone under the age of 18. We do not knowingly collect personal information from children under 18. If we learn that we have collected personal information from a child under 18, we will take steps to delete it promptly.

The Service may contain links to third-party websites or services that are not operated by us. We are not responsible for the privacy practices of these third parties. We encourage you to review the privacy policy of every site you visit.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on the Service and updating the “Last updated” date. Your continued use of the Service after changes are posted constitutes acceptance of the revised Privacy Policy.

14. Contact

If you have any questions about this Privacy Policy or wish to exercise your rights, please contact us at:

MigrateYou Pty Ltd Email: hello@migrateyou.com Website: https://migrateyou.com

For complaints regarding our handling of your personal information, you may also contact the Office of the Australian Information Commissioner:

OAIC Website: www.oaic.gov.au Phone: 1300 363 992