PRIVACY POLICY

OZPATH PTY LTD

Last Updated: 3 September 2026

1. We respect your privacy

(a) OZPATH PTY LTD respects your right to privacy and is committed to safeguarding the privacy of our customers and software application users. We adhere to the Australian Privacy Principles (APPs) established by the Privacy Act 1988 (Cth). This policy sets out how we collect, use, disclose, and manage your personal information in connection with the OzPath platform, including our planning tools, PR points calculator, Ruby AI migration guide, NAATI-certified document translation services, video consultations with registered migration agents, and case-management workflows.

(b) Personal information means information we hold which is identifiable as being about you.

(c) Sensitive information within the meaning of the Privacy Act 1988 (Cth) may be collected in the course of providing our services. This includes immigration-related information, identity documents, and information about your visa status, migration history, and qualifications. We will only collect sensitive information where it is reasonably necessary for one or more of our functions or activities, and either with your consent or as otherwise permitted by law.

2. Collection of personal information

(a) OZPATH PTY LTD will, from time to time, receive and store personal information you enter onto our software application OzPath, provide to us directly, through Google Sign-in or Sign in with Apple authentication, when you use Ruby AI (our AI migration guide), when you order document translation services, when you book or attend a video consultation with a registered migration agent, when you access case-management features in connection with an active agent matter, or when you give information to us in other forms. This includes information stored securely in our Firebase database and processed through our AI service provider for Ruby AI functionality.

(b) During account creation and onboarding, we collect:

(c) We may collect additional information at other times, including but not limited to, when you:

(d) Additionally, we may also collect any other information you provide while interacting with our services, including Ruby AI interactions, communications with migration agents through case management, document processing preferences, subscription and payment information, and authentication data. This information is used to operate, personalise, secure, support, and improve the OzPath platform and to provide assistance for your migration planning journey in Australia.

(e) Our application uses the following third-party services:

(f) Case management and active agent matters: Case management becomes available when a user decides to proceed with a registered migration agent following a video consultation, or when a user accesses OzPath through a referral code provided by a registered migration agent. Case management is not a standard Free feature or an OzPath Pro subscription feature. When you access case management, you are communicating directly with a registered migration agent who is an independent professional responsible for their own advice, professional services, service agreements, and migration work. All communications, service records, files, and associated data are stored securely in our Firebase database and are subject to professional confidentiality obligations. Migration agents are bound by the Migration Agents Registration Authority (MARA) Code of Conduct and must maintain strict confidentiality of client information. Where video calls are conducted, recordings will only be made with your express prior consent.

3. How we collect your personal information

OZPATH PTY LTD collects personal information from you in a variety of ways, including when you interact with us electronically or in person, when you access our software application and when we provide our services to you. We may receive personal information from third parties. If we do, we will protect it as set out in this Privacy Policy.

4. Use of your personal information

OZPATH PTY LTD may use personal information collected from you for the following purposes:

(a) To create, verify, and secure user accounts

(b) To personalise occupation insights, course discovery, pathway exploration, and EOI analytics

(c) To calculate and save PR points

(d) To provide Ruby AI responses and retain the user's chat history and context

(e) To provide document translation services

(f) To book, administer, and communicate about video consultations with registered migration agents

(g) To administer active agent matters and case-management workflows

(h) To share relevant information with the user's selected, assigned, or referring registered migration agent when required to provide the requested service

(i) To process subscriptions, consultation payments, quotes, invoices, refunds, and receipts

(j) To send account, service, consultation, payment, task, and agent-message notifications

(k) To provide customer support, maintain security, prevent misuse, comply with legal obligations, and improve OzPath

(l) To make you aware of new and additional products, services, and opportunities available to you

(m) The Application may make third party social media features available to its users. We cannot ensure the security of any information you choose to make public in a social media feature. Also, we cannot ensure that parties who have access to such publicly available information will respect your privacy.

(n) OZPATH PTY LTD may contact you by a variety of measures including, but not limited to telephone, email, sms or mail.

5. Disclosure of your personal information

(a) We may disclose your personal information to any of our employees, officers, insurers, professional advisers, agents, suppliers, or subcontractors insofar as reasonably necessary for the purposes set out in this Policy. This includes:

All third-party service providers, including translators and migration agents, are contractually bound by strict data protection agreements that mandate: implementation of industry-standard encryption for data transmission and storage; restricted access protocols limiting data visibility to essential personnel only; mandatory deletion of documents within 30 days of service completion; and regular compliance audits. These providers must maintain data protection standards equivalent to or exceeding the Australian Privacy Principles, with specific emphasis on secure document handling and confidentiality preservation.

(b) We may from time to time need to disclose personal information to comply with a legal requirement, such as a law, regulation, court order, subpoena, warrant, in the course of a legal proceeding or in response to a law enforcement agency request.

(c) We may also use your personal information to protect the copyright, trademarks, legal rights, property or safety of OZPATH PTY LTD, its application, website and customers or third parties.

(d) OzPath uses Firebase, a Google Cloud service, to store and manage user data. Information that we collect is stored and processed as follows:

All data is transmitted securely using encryption (HTTPS/TLS) and protected by Firebase's built-in access controls and authentication. By using OzPath, you acknowledge that some of your information may be transferred to and processed in data centres outside Australia. We ensure that any such transfers comply with the Australian Privacy Principles (APP 8 - Cross-border disclosure of personal information) and are subject to strict data protection safeguards.

(e) If there is a change of control in our business or a sale or transfer of business assets, we reserve the right to transfer to the extent permissible at law our user databases, together with any personal information and non-personal information contained in those databases. This information may be disclosed to a potential purchaser under an agreement to maintain confidentiality. We would seek to only disclose information in good faith and where required by any of the above circumstances.

(f) By providing us with personal information, you consent to the terms of this Privacy Policy and the types of disclosure covered by this Policy. Where we disclose your personal information to third parties, we will request that the third party follow this Policy regarding handling your personal information. By using our Application and providing your personal and sensitive information, you consent to:

You may withdraw your consent at any time by contacting us at privacy@ozpath.au, though this may affect our ability to provide certain services.

(g) All third-party service providers, including translators, are contractually bound by strict data protection agreements that mandate: (i) implementation of industry-standard encryption for data transmission and storage, (ii) restricted access protocols limiting data visibility to essential personnel only, (iii) mandatory deletion of documents within 30 days of service completion with written confirmation of deletion required from translators, and (iv) regular compliance audits. These providers must maintain data protection standards equivalent to or exceeding Australian Privacy Principles, with specific emphasis on secure document handling and confidentiality preservation.

(h) Your data is stored securely in Google Cloud Platform servers.

(i) We maintain the following retention periods:

(ii) After deletion is requested:

(iii) We may retain certain information for longer periods where required by law or for legitimate business purposes such as security, fraud prevention, financial record-keeping, dispute resolution, or compliance with professional obligations applicable to registered migration agents.

(iv) Account deletion does not automatically delete information that must be retained for legal, payment, dispute-resolution, fraud-prevention, or professional-record purposes. Where we are required to retain information following account deletion, we will retain only the minimum information necessary for the applicable purpose and will not use it for any other purpose.

(i) Payment-card handling: OzPath does not store full payment-card details on its servers. Where payment-card processing is handled by Stripe, Apple Pay, the Apple App Store, Google Play, or another payment provider, your full payment-card details are processed and stored by that provider in accordance with their own privacy policy and applicable payment-card industry security standards. OzPath retains only payment-related information necessary to administer your account, including payment processor customer IDs, payment-intent IDs, payment status, transaction amounts, currency, receipt links, and refund status.

6. Security of your personal information

(a) OZPATH PTY LTD is committed to ensuring that the information you provide to us is secure. In order to prevent unauthorised access or disclosure, we have put in place suitable physical, electronic and managerial procedures to safeguard and secure information and protect it from misuse, interference, loss and unauthorised access, modification and disclosure.

(b) In accordance with Australian Privacy Principle 11, we implement robust technical and organisational measures to protect your personal information from misuse, interference, loss, unauthorised access, modification, or disclosure. While the transmission of information over the internet inherently involves some risk, we employ multiple layers of security controls including:

These measures are regularly reviewed and updated to ensure the ongoing security of your personal information throughout its lifecycle, from collection to destruction or de-identification.

(c) We implement industry-standard security measures, including encryption, access controls, and regular security audits, to protect your personal information. In the event of a notifiable data breach, we will notify affected users and the Office of the Australian Information Commissioner (OAIC) as soon as practicable, in accordance with our obligations under the Privacy Act 1988 (Cth) and the Notifiable Data Breaches scheme.

(d) In the event of any data breach, we will notify affected users and provide detailed information including: the nature and extent of compromised data, potential risks to affected users, steps taken to contain the breach, recommended actions for users to protect themselves, and a dedicated support channel for inquiries. For breaches that are likely to result in serious harm, we will also notify the Office of the Australian Information Commissioner (OAIC) as required by law. We will maintain ongoing communication throughout the incident resolution process and implement additional security measures to prevent future occurrences.

(e) We maintain appropriate data processing agreements with Google, including the Cloud Data Processing Addendum (CDPA), which establishes our role as the Data Controller and Google's role as the Data Processor. These agreements ensure compliance with applicable data protection laws, including the Australian Privacy Principles.

7. Access to your personal information

(a) You may request details of personal information that we hold about you in accordance with the provisions of the Privacy Act 1988 (Cth). A small administrative fee may be payable for the provision of information. If you would like a copy of the information which we hold about you or believe that any information we hold on you is inaccurate, out of date, incomplete, irrelevant or misleading, please email us at privacy@ozpath.au.

(b) We reserve the right to refuse to provide you with information that we hold about you, in certain circumstances set out in the Privacy Act.

8. Complaints about privacy

If you have any complaints about our privacy practices, please feel free to send in details of your complaints to privacy@ozpath.au. We take complaints very seriously and will respond shortly after receiving written notice of your complaint. If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.

9. Opt-out right

You can stop all collection of information by the Application easily by uninstalling the Application. You may use the standard uninstall processes as may be available as part of your mobile device or via the mobile application marketplace or network. Additionally, you have the right to delete your account and associated personal information through the Application's account settings. Upon account deletion, we will remove your personal information from our active databases, subject to any legal obligations to retain certain data. Please note that account deletion does not automatically delete information that must be retained for legal, payment, dispute-resolution, fraud-prevention, or professional-record purposes, including financial records, service agreements, accepted quotes, invoices, and receipts that we are required to retain under applicable law. You may request deletion of documents shared with translators or registered migration agents at any time by contacting us at privacy@ozpath.au. You can also request to opt-out of our services via the same email address.

10. Additional Privacy Rights

You have the following rights in relation to the personal information we hold about you:

(a) Access: You may request access to the personal information we hold about you. We will respond to such requests within 30 days.

(b) Correction: You may request that we correct any personal information we hold about you that is inaccurate, out of date, incomplete, irrelevant, or misleading.

(c) Deletion: You may request deletion of your account and personal information, subject to our legal obligations to retain certain information as described in clause 5(h) of this Policy.

(d) Portability: You may request a copy of your personal information in a structured, commonly used format where technically practicable.

(e) Restriction: You may request restriction of processing or object to certain uses of your personal information, including automated decision-making, where applicable.

(f) Withdrawal of consent: You may withdraw your consent to the collection and use of your personal information at any time by contacting us at privacy@ozpath.au, though this may affect our ability to provide certain services.

(g) Notification preferences: You may update your notification preferences at any time through the Application's account settings.

To exercise any of these rights, contact our Privacy Officer at privacy@ozpath.au. We will respond to requests within 30 days. If you are unsatisfied with our response, you have the right to lodge a complaint with the Office of the Australian Information Commissioner at www.oaic.gov.au.

11. Changes to Privacy Policy

Please be aware that we may change this Privacy Policy in the future. We may modify this Policy at any time, in our sole discretion and all modifications will be effective immediately upon our posting of the modifications on our website or notice board. Please check back from time to time to review our Privacy Policy.

12. Software Application

12.1. When you use our Application

When you use our application, we collect certain information such as mobile unique device ID, the IP address of your mobile device, mobile operating system, the type of mobile internet browsers you use, and information about the way you use the Application. We also collect data related to your interactions with Ruby AI, your migration-planning activity, document uploads for translation, consultation bookings, case-management activity, subscription and payment status, and authentication through Google Sign-in or Sign in with Apple. This information is stored securely in our Firebase database and is used to operate, personalise, secure, support, and improve the OzPath platform and to provide assistance for your migration planning journey in Australia.

12.2. Cookies

We may from time to time use cookies on our software application. Cookies are very small files which a website uses to identify you when you come back to the application and to store details about your use of the application. Cookies are not malicious programs that access or damage your computer, tablet or smartphone. Most devices automatically accept cookies but you can choose to reject cookies by changing your devise settings. However, this may prevent you from taking full advantage of our application.

12.3. Automatic collection

The software Application may collect certain information automatically. This automatic collection does not include any personal documents, which are only collected when explicitly submitted by you for translation services or voluntarily uploaded to Ruby AI. Automatically collected information includes:

12.4. Third parties

Our software application integrates with trusted third-party services including Firebase and Google Cloud, Google Sign-in, Sign in with Apple, our AI service provider for Ruby AI, Stripe, Apple Pay, RevenueCat, and the Apple App Store or Google Play. While these services help us provide and improve our features, we maintain strict data protection standards. Links to other applications or websites not owned or controlled by us are provided for convenience only. Please be aware that OZPATH PTY LTD is not responsible for the privacy practices of other applications or websites. We encourage our users to read the privacy statements of each application or website that collects personal identifiable information.

12.5. Document Translation Process

(a) When you upload documents for translation through our Application, these documents are securely stored in our system and made available to assigned NAATI-certified translators. We implement comprehensive security measures to protect your documents throughout the translation process:

(b) Our translator selection and oversight process includes:

(c) In the event of a confidentiality breach by a translator:

While we take all reasonable steps to protect your documents and ensure translator compliance, you retain rights under the Australian Consumer Law and Privacy Act 1988 (Cth). For specific concerns about document handling, please contact us at privacy@ozpath.au.

12.6 Agent Chat - Case Management and Active Agent Matters

(a) Case management becomes available when a user decides to proceed with a registered migration agent following a video consultation, or when a user accesses OzPath through a referral code provided by a registered migration agent. Case management is not a standard Free feature or an OzPath Pro subscription feature. Through case management, registered migration agents may use the following features to assist you:

(b) All personal information collected through case management is used solely for the purpose of delivering migration services to you and is not used for marketing or AI model training purposes. Registered migration agents accessing your information through case management are bound by:

(c) In the event of a confidentiality breach by a migration agent in connection with case management, we will immediately investigate and take appropriate action, notify affected users as soon as practicable, assist users in taking steps to protect their information, and users may lodge complaints through our dispute resolution process at privacy@ozpath.au.

(d) While we take all reasonable steps to protect your information and ensure agent compliance, you retain rights under the Australian Consumer Law and Privacy Act 1988 (Cth). For specific concerns about case management data handling, please contact us at privacy@ozpath.au.

12.7 Ruby AI - Migration Guide

(a) Ruby AI is OzPath's in-app AI migration guide. Ruby AI provides general information about visa pathways, occupations, PR points, course options, EOI data, and general next steps. Ruby AI is available to Free and OzPath Pro users, subject to fair-use limits.

(b) Ruby AI does not provide personal migration advice, legal advice, or professional advice. Ruby AI is not a registered migration agent. Nothing generated by Ruby AI constitutes migration advice or legal advice.

(c) When you use Ruby AI, we collect your messages, questions, saved chat history, and conversation context. For signed-in users, chat history and conversation context are saved to personalise and improve your Ruby AI experience.

(d) Ruby AI interaction data, including messages, and conversation context, is not used for marketing purposes.


OZPATH PTY LTD

ACN 691355209

Sydney, New South Wales, Australia

Last Updated: 3 July 2026