Privacy policy

1. We follow the Australian Privacy Principles

Small businesses under $3 million turnover are currently exempt from much of the Privacy Act 1988. We do not rely on that exemption. We handle your information as though the Australian Privacy Principles apply to us in full, because the material you give us warrants it.

2. What we collect

What you give us directly. Your email address and password (stored only as a cryptographic hash — we never see it). The names you enter for you and your partner, your visa subclass, and your answers to the questionnaires. Every file you upload and every note or caption you write about it.

What the software creates. The PDF packs it builds for you, coverage indicators, and a log of significant account actions — invitations, deletions, purchases — so that we can answer questions about what happened to a case.

Technical information. Ordinary server logs: request times, IP addresses, error traces. We use these to keep the service running and to investigate faults and abuse.

Page counts on the public pages. We count visits to our marketing and guide pages — which page, roughly where in the world, what kind of device. No cookies, nothing stored on your device, and nothing that identifies you or follows you to another website. It does not run at all once you are signed in: the pages inside your account are never counted, because their web addresses name your case and what is in it.

What we deliberately do not collect. Your card details never touch our systems — Stripe handles payment entirely. We do not sell data to anyone, and we do not build profiles of you for any purpose other than running your case. The advertising measurement we use is two conversion tags — Google’s and Meta’s (Facebook’s). Both run on the same public pages — the homepage, the guides, the checklist, the free evidence plan pages, the pricing and how-it-works pages, and the sign-up pages; inside the signed-in app they run only to record that an account was created and, for Google, that a payment was made. Meta also receives a server-side copy of the sign-up and purchase events — a hashed version of your email address, an internal identifier for your account, and the identifiers Meta’s own cookies set on your browser — so that record can be matched to whatever its pixel already sent, whether or not the pixel itself loaded for you. We separately keep our own record, first-party, of which advertisement brought you to the site — the campaign and ad names and the advertising platform’s click identifier — against your account, so we can tell which of our own ads are working; that record is ours and stays in our database. The one part of it that goes anywhere is Meta’s own click identifier, which is included in the server-side copy described above so a later purchase can be matched to the ad. None of this — the tags, Meta’s server-side copy, or our own record of the ad — is ever given your evidence, your answers, the names in your case, your visa subclass, or anything about your relationship. §5 names Google LLC and Meta Platforms, Inc. as the overseas disclosures they are.

3. Sensitive information

Partner visa evidence can reveal your sexuality, your health, your finances and your immigration status. Under the Privacy Act some of that is “sensitive information”, which carries a higher bar. We collect it only because you have chosen to use a product whose entire purpose is to organise it, we use it only to do that, and we do not disclose it for any other reason.

4. Why we hold it

To run the service you asked for: storing your evidence, showing you your case, sharing it with the partner you invited, generating your documents, taking payment, answering your support questions, sending you the occasional reminder about your own case, and keeping the whole thing secure. That is the entire list.

The reminder is worth naming on its own. A partner visa can sit with the Department for years, and evidence from those years is exactly what a follow-up submission is made of. So if nothing new has gone into your case for about three months, we send the main account one email suggesting they add something recent. It is quarterly at most, every one of them has an unsubscribe link, and you can turn them off in Settings without affecting anything else.

5. Where it is stored, and what is not in Australia

Your case data — your account, your uploads, your notes, your generated packs — is stored in Australia, in Sydney. That is a deliberate choice and we pay for it. But being honest about it means naming the exceptions rather than implying there are none:

• Your files and database records — Australia. Supabase, Sydney region (ap-southeast-2). This includes our own first-party record of which advertisement, if any, brought you to the site (campaign and ad names, and the advertising platform’s click identifier) — that record stays here, in Australia. Only Meta’s own click identifier from it is ever sent back to Meta, inside the server-side sign-up and purchase events described in section 2.
• Document generation — Australia. Our PDF rendering service runs in Sydney. Your files are processed there and the result is written straight back to Australian storage.
• The application itself — Australia for your requests. Server-side code runs in Vercel’s Sydney region. Vercel is a United States company, and its global network serves static parts of the site (images, stylesheets, page shells) from wherever you are; those carry no case content. Operational logs and metrics may be accessible to Vercel outside Australia.
• Page counts — same company as the application. The visit counting described in section 2 is Vercel’s own, so it introduces no new company and no new country: it is the provider already serving you this page. It is cookieless, and we configure it to discard every address inside your account before the count is sent.
• Advertising conversion measurement — overseas. Google’s conversion tag (Google Ads) and Meta’s (Facebook’s) pixel both run on the homepage, the guides, the checklist, the free evidence plan pages, the pricing and how-it-works pages, and the sign-up pages, so we can measure whether our own advertising works; inside the signed-in app they run only to record that an account was created and, for Google, that a payment was made. Meta additionally receives a server-side copy of the sign-up and purchase events — a hashed version of your email address, an internal identifier for your account, and the identifiers its own cookies set on your browser — so it can match that server record to whatever its pixel already sent, whether or not the pixel itself loaded for you. Google LLC and Meta Platforms, Inc. are both United States companies. Neither is ever sent your evidence, your answers, the names in your case, your visa subclass, or anything about your relationship.
• Payments — overseas. Stripe processes payments and holds your card details, name and billing information on its own infrastructure, which is largely in the United States. We pass Stripe your email address and an internal case reference. We never send Stripe your evidence.
• Email — overseas. Transactional email (sign-in links, partner invitations, the quarterly case reminder in section 4) is sent through a provider that may process the message outside Australia. These contain your email address and a link, not your case content.
• Error monitoring — may be overseas. Crash and error reports may be processed outside Australia. We configure these to strip request bodies and file contents.
• Bot protection on sign-up — overseas. The sign-up page uses Cloudflare’s Turnstile check to keep automated accounts out. Cloudflare is a United States company; the check processes connection and browser signals to decide whether you are a person. It never sees what you type into the form, and it runs nowhere else in the product.

Where information goes overseas, we take reasonable steps to ensure the recipient handles it consistently with the Australian Privacy Principles, as APP 8 requires. If we change a provider in a way that changes this list, we will update this page and the date at the top of it.

6. Artificial intelligence

Where Mate Visa uses an AI model to help you — for example, to suggest what a caption might need to say — we will tell you in the flow before anything of yours is sent, and we use vendors contractually bound not to train on your content and not to retain it. We do not send your case content to any AI service without that being clear to you at the time. The software never fabricates facts about your relationship: everything in your documents came from you.

7. Who else can see your case

The partner you invite to your case can see everything in it. That is the point of inviting them, and it is worth being sure before you do.

Beyond that, we disclose your information only to the service providers listed in section 5, strictly so they can perform their function; and where we are required by Australian law, for example under a court order or a lawful demand from an agency. If we ever receive such a demand we will tell you unless we are legally prohibited from doing so.

If a law firm provisioned your account through our firm portal, that firm can see the case they are working on with you. In that arrangement the firm is your adviser and we are their software supplier.

8. How long we keep it

We keep your case material for as long as you keep your account. We do not delete it on a timer — a partner visa can take years, and you told us you want access to your own material throughout. You can download the files you uploaded as a ZIP at any time and each generated pack individually from Your packs; anything else we hold about you is available on request (section 10). You can delete your account at any time.

When you delete your account, we delete your uploads, your generated packs and your sign-in. Backups roll off on their own schedule, within 30 days. Records we must keep for tax and financial purposes — that a purchase occurred, and its amount — are retained as Australian law requires.

When you delete your account we ask, optionally, how your application turned out. That answer is stored with no link to you, your email or your case, which is what lets us keep it after everything else is gone. We use it to improve the product. We do not publish it, and we do not derive or advertise any success rate from it.

9. Security

Access to case data is enforced in the database itself, per row, not merely in the application — designed so that a bug in one page does not, on its own, expose someone else’s case. Files are stored privately and served only through short-lived signed links. Traffic is encrypted in transit and data is encrypted at rest. Access to production systems is limited and logged.

No system is perfectly secure. If a data breach occurs that is likely to cause you serious harm, we will assess it and notify you and the Office of the Australian Information Commissioner as the Notifiable Data Breaches scheme requires.

10. Your rights

You can see and correct most of your information directly in the app, download your uploaded files as a ZIP and each generated pack individually at any time. If you want a copy of anything else — your answers, your story, the account log — or you think something we hold is wrong, email support@matevisa.com.au and we will respond within 30 days.

You can be anonymous or use a pseudonym with us where that is practical — though a partner visa case is not much use to you under a false name, and payment goes through Stripe under whatever name your card carries.

11. Cookies

We set the cookies needed to keep you signed in and to remember whether you chose dark mode. We also set a first-party cookie recording which advertisement, if any, brought you here (mv_attr, kept for 90 days) — the campaign and ad names and the advertising platform’s click identifier — which we read once, at sign-up, to build the record described in sections 2 and 5; nothing else reads it, and apart from Meta’s own click identifier inside the server-side events described in section 2, it is never sent to Google or Meta. The conversion tags themselves each set one cookie of their own on our domain so that a sign-up can be matched to one of our own ads — Google’s (_gcl_au, kept for about 90 days) and Meta’s (_fbp, also about 90 days) — on the homepage, the guides, the checklist, the free evidence plan pages, the pricing and how-it-works pages and the sign-up page, and, to record only that an account was created, inside the signed-in app; when a tag loads, its platform may also set a short-lived cookie on its own domain. We do not use any of these to follow you to other websites or to build a profile of you. We use no other advertising or cross-site tracking cookies. Blocking the essential ones will stop you being able to sign in.

12. Complaints

If you think we have mishandled your information, email support@matevisa.com.au. We will acknowledge within 5 business days and respond substantively within 30 days. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

13. Changes

If we change how we handle your information in a way that matters, we will tell you before it takes effect and update the date at the top of this page. Our terms of service cover the rest of the relationship.