Legal

Privacy Policy

Last updated: May 2026

1. Introduction

ImmiIQ ("we", "us", or "our") is a product of FastFlowUp (ABN 14 677 767 458), registered in Australia. We respect your privacy and are committed to protecting the personal information you share with us.

This Privacy Policy explains how we collect, use, disclose and safeguard your information when you visit ImmiIQ and use our platform at app.immiiq.com (collectively, the "Service"). This policy is governed by the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

By using the Service, you agree to the collection and use of information in accordance with this policy. If you do not agree, please do not use the Service.

2. Information We Collect

Account Information

When you create an account, we collect your name and email address. If you sign in via a third-party provider (e.g. Google), we receive the profile information you authorise.

Usage Data

We automatically collect information about how you interact with the Service, including search queries, pages viewed, features used, session duration, browser type, device information, and IP address.

Payment Information

Payments are processed securely by Stripe. We do not store your credit card number, CVV or full card details on our servers. Stripe provides us with a tokenised reference and basic billing details (last four digits, card brand, expiry) for your records.

AI Prompts & Attached Context

When you choose to use Harper, our AI assistant, the prompt you type plus any client or case context you explicitly attach to that prompt is processed inside ImmiIQ's own AWS infrastructure in Sydney. See “AI Features & In-VPC Processing” below for the full breakdown. We store your Harper conversation history on infrastructure in Australia so you can revisit prior threads. AI features are opt-in by your explicit action — if you never open Harper, no prompt data is collected or processed.

Cookies

We use cookies for authentication, analytics and preferences. See our Cookie Policy for full details.

3. How We Use Your Information

We use the information we collect to:

Provide, operate and maintain the Service
Personalise your experience and deliver relevant search results
Process payments and manage your subscription
Send transactional emails (receipts, account notifications, security alerts)
Provide AI-powered features (Harper) when you choose to use them — details of what data leaves our systems and to whom are in “AI Features & Subprocessing” below
Improve the platform based on aggregated usage patterns
Run anonymised product analytics to inform feature development
Detect, prevent and address technical issues or fraud
Comply with legal obligations under Australian law

We do not use your information for advertising or sell it to third-party advertisers.

5. Data Storage & Security

Your data is stored in Australia on secure, managed PostgreSQL infrastructure hosted on AWS in the ap-southeast-2 (Sydney) region. All data is encrypted at rest (AES-256) and in transit (TLS 1.3).

We conduct regular security audits and follow industry best practices for access control, authentication and infrastructure hardening. However, no method of electronic transmission or storage is 100% secure and we cannot guarantee absolute security.

Shared Responsibility

Security is a partnership. ImmiIQ secures the platform itself: per-organisation AES-256-GCM encryption at rest, TLS 1.3 in transit, Sydney-pinned hosting and document storage, least-privilege engineer access and Notifiable Data Breaches scheme compliance. Your firm secures how the platform is used: account credentials for every team member, who you grant access to which client records, prompt revocation when a colleague leaves and the handling of any data once it has been exported, forwarded or shared outside ImmiIQ. The encryption and infrastructure protections described in this section apply to data at rest and in transit within ImmiIQ; once data leaves the platform under your direction, your firm's own controls and obligations govern. For the full matrix and liability statement, see our shared responsibility model.

6. Your Rights

Under the Australian Privacy Act 1988 and the APPs, you have the right to:

Access the personal information we hold about you
Correct any inaccurate or out-of-date information
Delete your account and associated data
Data portability - request an export of your data in a machine-readable format
Withdraw consent for optional data processing (e.g. analytics)
Lodge a complaint with the Office of the Australian Information Commissioner (OAIC)

To exercise any of these rights, email us at [email protected]. We will respond within 30 days.

7. Cookies

We use essential, analytics and preference cookies to operate and improve the Service. For comprehensive information about the cookies we use and how to manage them, please see our Cookie Policy.

8. Third-Party Services

The Service integrates with the following third-party providers. Each has their own privacy policy governing data they process:

Stripe - payment processing (privacy policy)
Google Analytics 4 - product analytics, set only with consent (privacy policy)
Vercel - hosting (privacy policy)
AWS SES & SNS - transactional email and SMS delivery (privacy policy)
Cloudflare - object storage (R2) for encrypted client documents and the marketing pipeline edge cache (privacy policy)
Reacher - email-address syntax and deliverability verification on marketing forms (privacy policy)
Upstash - rate-limiting and ephemeral session caching, hosted in AWS Sydney (privacy policy)

Harper's AI inference is not a third-party service. The model runs inside ImmiIQ's own AWS account in Sydney (region ap-southeast-2) on infrastructure operated entirely by ImmiIQ. No third-party AI provider receives your prompts or attached context. See “AI Features & In-VPC Processing” below.

8a. Cross-Border Disclosure of Personal Information (APP 8)

Australian Privacy Principle 8 (Cross-border disclosure of personal information) in Schedule 1 of the Privacy Act 1988 (Cth) requires us to tell you which countries your personal information may be disclosed to before we make that disclosure. This section lists every overseas jurisdiction in our processor chain and what is disclosed to each one.

Data we hold inside Australia. Your client records, case notes, uploaded documents, Harper conversation history, and authentication artefacts are stored in Sydney, Australia (AWS region ap-southeast-2) and do not leave the country in the ordinary course of operating the Service.

Data we disclose overseas. A limited subset of personal information is necessarily disclosed to overseas processors for the Service to function:

United States - Stripe, Inc. receives your billing name, email, country, and card / bank tokens to process subscription payments. Stripe is certified under multiple international frameworks and processes payment data under its own privacy policy.
United States - Vercel Inc. serves the marketing website and parts of the app from its global edge network, which may route a TLS-encrypted request through US-based or EU-based points of presence before reaching our Sydney origin. No client documents or Harper conversations transit Vercel; only page HTML, static assets, and authentication round-trips do.
United States - Cloudflare, Inc. serves the data pipeline (pipeline.immiiq.com) and the analytics endpoint (cdp.immiiq.com) through its global anycast network; encrypted document blobs in R2 are pinned to the EU (Eastern) replication region under our account settings.
France - Reacher.email receives email addresses entered on our marketing forms (lead capture, demo requests) to verify syntax and deliverability before we accept them into our CRM. The address itself is the only personal information disclosed.
Singapore - Amazon Web Services SES and SNS endpoints in the ap-southeast-1 region handle outbound transactional email and SMS delivery on our behalf. Recipient email / phone and the message body transit this region briefly during delivery.

Your consent. By using the Service after reading this notice, you consent under APP 8.2(b) to the overseas disclosures listed above. If you do not consent, you should not create an ImmiIQ account; we cannot run the Service without the payment processor and the email/SMS deliverability layer.

Withdrawing consent. You can stop the overseas disclosure of future personal information at any time by closing your account (Settings → Account → Delete account). Closing your account stops all further outbound calls to overseas processors for your data and triggers the erasure workflow described in section 13.

8b. Google API Services

ImmiIQ integrates with Google Workspace APIs so migration agents who choose to connect their Google account can sync calendar bookings, attach Drive files to client cases, and send branded email from their verified domain. This section describes how we use data received from Google APIs.

Limited Use compliance. ImmiIQ's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically:

We use Google APIs only to provide user-facing features the connected agent has explicitly enabled inside ImmiIQ (calendar sync, Drive attachments, branded email).
We do not transfer Google user data to third parties except as necessary to provide or improve user-facing features that are prominent in the requesting application's user interface, for security purposes, or to comply with applicable law.
We do not use Google user data to serve advertisements.
We do not allow humans to read Google user data unless we have the user's affirmative agreement for specific messages, doing so is necessary for security purposes such as investigating abuse, to comply with applicable law, or for ImmiIQ's internal operations and only when the data have been aggregated and anonymised.
We do not use Google user data to develop, improve, or train generalised AI or machine learning models. Harper, our in-app AI assistant, operates only on data the agent submits through the Harper interface and never on data received from Google APIs.

Scopes we request. ImmiIQ requests only the minimum Google OAuth scopes needed for each feature you enable — for example, calendar.events when you connect Google Calendar for client bookings. We do not request broad, read-everything scopes. You can review or revoke ImmiIQ's access at any time from your Google Account permissions page.

Questions about ImmiIQ's use of Google APIs: [email protected].

9. AI Features & In-VPC Processing

This section explains exactly what happens when you choose to use Harper, our in-app AI assistant. AI features are opt-in by your explicit action — you must open the Harper panel and submit a prompt for any data to be processed. If you never use Harper, none of the processing described here applies to you.

Where AI inference runs

Harper's natural-language inference runs inside ImmiIQ's own AWS account in the Sydney region (ap-southeast-2) on infrastructure we operate end-to-end. The inference model is hosted within our Virtual Private Cloud (VPC); model weights are read-only and cannot be modified by user inputs.

Your prompts and attached context never leave the AWS Sydney region. They are not transmitted to any third-party AI service, are not used to train any model, and are not stored or used by AWS for any purpose beyond serving the response back to your session. There is no third-party AI subprocessor in this data path.

Our mobile applications (iOS / Android) do not contain, link to or call any third-party AI service directly. The mobile app communicates only with ImmiIQ's own servers at app.immiiq.com; any AI inference is handled by the in-VPC model described above.

What data is processed

When you submit a Harper prompt, the following is processed:

The text of your prompt
Any client / case context you explicitly attach to that prompt (for example: the client's name, case stage and visa subclass for a CRM-aware question; the text of a document you ask Harper to review)
Public reference data we have already curated (occupation descriptions, visa pathway summaries, legislation excerpts) used to ground Harper's answer

We do not process for AI: your password or session credentials, your organisation's billing details, any client record you have not explicitly attached to the prompt, any document file body that is not the specific document you asked Harper about, or your other clients' records.

Why we host the AI in our VPC

No third party sees your prompts. Inference happens entirely inside ImmiIQ's AWS account; no prompts are sent to OpenAI, Anthropic, Google or any other external AI provider.
No model training on your data. The hosted model weights are read-only; there is no training feedback loop. Your prompts cannot influence the model's behaviour for other customers, ever.
Australian data residency for AI processing. Prompts stay in AWS's Sydney region for the entire request lifecycle. They are not replicated to any other region.
Conversation history stays with us. Harper threads you save are stored in our Sydney database, sealed with your organisation's AES-256-GCM encryption key. They are not shared outside ImmiIQ.

Tenant isolation

Harper's tools verify, on every call, that a referenced client or case belongs to your organisation. Cross-organisation read attempts are rejected and recorded in the security audit log; the AI model has no mechanism to fetch data outside your tenant. Per-organisation AES-256-GCM encryption protects your at-rest data in our database and document storage independently of any AI processing.

Your choices

Using Harper is always optional. You can use every non-AI feature of ImmiIQ (CRM, documents, invoicing, sender domain, reporting) without ever invoking AI processing.
When you do use Harper, you control what client / case context you attach to the prompt. You can ask general questions with no client context, or scope the context to a single client or case.
Account administrators can switch the “Harper AI” module off entirely for individual team members under Settings → Team; that member can then no longer open the Harper panel.

10. Children's Privacy

The Service is not directed at individuals under the age of 16. We do not knowingly collect personal information from children under 16. If we become aware that we have collected personal information from a child under 16 without parental consent, we will take steps to delete that information promptly.

10. Harper AI Mobile App

Harper AI (iOS / Android) collects the same data as the web experience, plus:

Device label and app version — e.g. "iPhone 15 Pro · Harper AI 1.0.0" — used for support troubleshooting and showing you active sessions. Not linked to advertising.
Session tokens — an opaque bearer token issued on sign-in, stored in your device's secure keychain (iOS) or EncryptedSharedPreferences (Android). Destroyed on sign-out or app uninstall.

The mobile app does not collect your location, contacts, photos, advertising ID, health data, biometrics, microphone or camera.

Push notifications: Harper AI does not send push notifications. All product updates (weekly digest, policy-change alerts) are delivered by email.

Deleting your mobile-app data: Uninstalling the app removes the bearer token from your device. To fully delete your account, see "Deleting Your Account" below.

11. Deleting Your Account

You can request permanent deletion of your Harper AI / ImmiIQ account at any time.

How to request: Send an email to [email protected] from the address associated with your account with the subject "Delete my account". The request must come from the registered address so we can verify it's you — there is no extra verification step, no link to click.

What we delete: Your user record, all Harper chat history, saved searches, session tokens, push preferences and profile data. Deletion is permanent and cannot be undone.

What we keep, briefly: Invoices with your email redacted (retained for 7 years per Australian tax law); server audit logs showing that the deletion happened (retained 90 days); anonymised usage metrics that can no longer be linked back to you.

How long it takes: We complete deletion within 30 days of receiving the email. We send one confirmation email when it's done.

Organisation accounts: Deleting your personal account removes your access to any migration-agency workspace you belong to — it does not delete the workspace itself. If you are the workspace admin, email us; we will help transition ownership before deleting anything.

12. Changes to This Policy

We may update this Privacy Policy from time to time. For material changes, we will notify registered users via email at least 14 days before the changes take effect. We will also update the "Last updated" date at the top of this page.

Your continued use of the Service after changes take effect constitutes acceptance of the revised policy.

13. Contact

If you have questions about this Privacy Policy or wish to exercise your privacy rights, please contact us:

Email: [email protected]