Privacy Policy

3. Artificial intelligence (AI) features

The platform includes optional features that use artificial intelligence to assist a registered migration agent. AI is used only to assist a human practitioner; it never makes a decision about a visa application, and its output is always reviewed by the responsible registered migration agent before it is relied upon, sent or lodged. The AI features are:

• Document data extraction — reading uploaded documents (for example a passport, payslip or form) to suggest field values for the matter, which staff verify.
• Grounded case assistant — answering a practitioner’s questions about a file, drawing on the firm’s legislation and policy library, with links back to the source.
• Pathway analysis (“Basanta”) — summarising a client’s visa status and possible pathways for the practitioner to review.
• Drafting assistance — helping prepare letters, summaries and an internal immigration-news digest.

Documents are never sent to AI. Reading and extracting data from uploaded documents (for example a passport, ID, payslip or receipt) is performed entirely on our own servers in Australia using local optical-character-recognition. We do not send document images or files — including identity documents such as passports — to any external AI provider.

What information is provided to the AI, and to whom. The text-based AI features are delivered through the application programming interfaces (APIs) of established AI providers — OpenAI and/or Anthropic (the provider is configured by the firm using the firm’s own API key). Before any text is sent, it is de-identified: direct identifiers such as email addresses, phone numbers, passport and other reference numbers, and dates of birth are automatically removed and replaced with neutral placeholders. Depending on the feature used, the de-identified information sent to the AI provider may include:

• the practitioner’s question and relevant matter facts, together with excerpts of the firm’s legislation/policy library, when the case assistant is used;
• the relevant facts of a matter (such as current visa, key dates and goal) when generating a pathway summary; and
• no client personal information for the automated immigration-news digest, which uses only public legislative and news sources.

Because de-identification is automated and pattern-based, we cannot guarantee that every incidental identifier (for example a name written in a free-text note) is removed in every case. It is designed to remove direct contact details, identity/reference numbers and dates before transmission.

How that information is handled by the AI provider. Information is transmitted to the AI provider over encrypted connections and is processed to produce the requested result. Under the API terms of OpenAI and Anthropic, data submitted through their APIs is not used to train their models, and is subject to limited retention for abuse-monitoring before deletion. We do not use AI providers that train on our data. AI providers may process data on servers outside Australia (including the United States); we take reasonable steps to ensure appropriate protection when this occurs (see section 8).

Your choices. A firm can turn AI features off entirely. Where offered, you may also decline the use of AI on your own matter at the time you sign your service agreement, and your choice is recorded and respected. Declining AI does not affect the standard of service you receive. Because AI can make mistakes, all AI output is treated as a draft for the practitioner to check — it is not advice in itself.

How our AI use complies with Australian law and professional obligations. Our use of AI is designed to meet the requirements that apply to registered migration agents and to the handling of personal information in Australia:

• Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Information is used only for the purpose for which it was collected — providing your immigration assistance (APP 6). We take reasonable steps to keep it accurate (APP 10) and secure (APP 11). Sensitive information (such as health or character information) is only sent to an AI tool where it is reasonably necessary and with your consent (APP 3).
• Cross-border disclosure (APP 8). Where an AI provider processes data overseas, we take reasonable steps to ensure it is handled consistently with the APPs, including through contractual protections, and we obtain your consent to that overseas processing.
• Notifiable Data Breaches (NDB) scheme. If an eligible data breach involving your personal information occurred, we would respond in accordance with Part IIIC of the Privacy Act, including notifying you and the OAIC where required.
• Migration Agents Code of Conduct and Migration Agents Regulations. Your registered migration agent remains bound by the Code of Conduct made under the Migration Act 1958 (Cth) and the Migration Agents Regulations. This means client confidentiality is maintained, the agent acts in your best interests with competence and diligence, and the agent — not an AI tool — remains professionally responsible for the advice given and the application lodged. AI is used only as an aid and never as a substitute for the agent’s professional judgement.
• Department of Home Affairs systems. AI is not used to autonomously access, complete or submit anything in Department of Home Affairs systems (such as ImmiAccount) or to run a VEVO check on its own. Any interaction with departmental systems is carried out under human supervision, with the responsible agent reviewing and approving every value, and any VEVO check is performed only with your consent.
• Government AI guidance. We seek to align our AI practices with applicable Australian Government guidance on the safe and responsible use of AI, including keeping a human accountable for decisions and being transparent with you about when and how AI is used.

4. Google API data and connected Google accounts

With your explicit authorisation, 4A Migration Cloud can connect to your Google account so that a firm can send its own client correspondence, capture inbound and sent client correspondence and file it to the correct matter, store matter documents in the firm’s own Google Drive, and create consultation and deadline events in the firm’s calendar. Only the account owner connects their own account, connection uses Google’s secure OAuth flow, and we never receive or store your Google password.

Scopes we request and what each is used for.

• Sign-in and identity (openid, email, profile) — to identify you and the connected account (Google account identifier, name and email address).
• Gmail — send (gmail.send) — to send the firm’s own outbound client emails from the connected mailbox. This scope does not permit reading your mailbox.
• Gmail — read (gmail.readonly), where the firm enables email capture — to read inbound and sent messages so the platform can identify the sender and subject, match the message to the correct client matter, and file the message and its attachments to that matter in the firm’s own connected cloud storage. The platform reads message metadata (sender, recipients, subject, dates), message bodies and attachments only to perform this filing; 4A does not retain the message body or attachments on its own servers (see “Where Google information is stored” below).
• Google Drive (drive.file) — a per-file scope that lets the application create and manage only the matter folders and files it creates or that you open with it. It does not give the application access to any other files in your Drive.
• Google Calendar (calendar.events, calendar.freebusy) — to create and update consultation and deadline events on the connected calendar, and to read free/busy times so the public booking page can offer available slots. We do not read the content of your other calendar events.

Where Google information is stored, and for how long. Processing occurs on our servers hosted in Sydney, Australia. When email capture is enabled, 4A reads a message to file it but does not retain the message content on its own servers. The message body and its attachments are written only to the relevant matter folder in the firm’s own connected cloud storage (for example the firm’s OneDrive or Google Drive); if no cloud storage is connected, the message is not copied and nothing is stored. In its own Australian database 4A keeps only the linking metadata needed to file correspondence and avoid duplicates — message identifiers, sender and recipient addresses, subject, dates, the folder it came from, and the matter it was filed to — together with a short file note recording that the message was filed. Documents created or opened via drive.file live in the firm’s own Google Drive. Calendar events live in the connected Google calendar. The linking metadata is retained as part of the client’s matter record for the period required by law and professional obligations, and is then securely deleted or de-identified; the filed message itself is held in, and controlled through, the firm’s own cloud storage.

OAuth tokens. To keep a connection working we store the OAuth access and refresh tokens Google issues. These are stored encrypted at rest and are used only to call the Google APIs for the features you authorised.

Disconnection, revocation and deletion. You can disconnect a Google account at any time from within the application, or revoke our access directly at myaccount.google.com/permissions. Disconnecting or revoking deletes the stored OAuth tokens and stops any further access to your Google account. Please note the distinction between credentials and matter data: revoking access removes our ability to connect, but information already filed into a client matter (for example an email or attachment saved to the matter before revocation) remains part of that matter record until it is deleted. To have Google-derived information already copied into a matter deleted, contact us at the address in section 14 or ask the responsible firm; we will delete or de-identify it unless we are required by law or professional obligation to retain it.

Human access. Access to a firm’s data, including Google-derived information, is role-based and limited to that firm’s own authorised users. 4A’s own personnel do not access customer, matter or captured email content in the ordinary course. Consistent with Google’s Limited Use requirements, a human will only access Google user data with your affirmative consent for specific messages, where necessary for security or to comply with applicable law, or where the data has been aggregated and anonymised for internal operations.

AI features and Google data. Google-derived information (emails, attachments and Drive files) is not sent to our AI providers. The AI features in section 3 operate on matter documents and facts that a practitioner works with in the platform; they do not ingest your connected mailbox, Drive or calendar.

Limited Use disclosure. 4A Migration Cloud’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is not sold, is not used or transferred for advertising, is not transferred to data brokers, is not used to determine creditworthiness or for lending, and is not used for any purpose other than providing or improving the user-facing features you authorised. It is not transferred to others except as necessary to provide those features, to comply with applicable law, or as part of a merger or acquisition with appropriate notice. Humans do not read your Google data except in the limited circumstances described above.

Microsoft and other connected accounts. Where a firm connects Microsoft (Outlook mail via Mail.Read/Mail.Send, and OneDrive/SharePoint files via Files.ReadWrite/Sites.ReadWrite.All) or another storage provider, that information is handled on the same basis: used solely to deliver the feature the firm authorised, stored and protected as described in this policy, never sold and never used for advertising.