Privacy Policy

Last updated: 24 July 2026 · Caimy Pty Ltd (ABN 98 700 616 164)

This Privacy Policy explains how Caimy Pty Ltd ("CAIMY", "we", "us") collects, uses, stores and discloses personal information through the CAIMY platform at app.caimy.com.au and the CAIMY — ImmiAccount Autofill browser extension (together, the "Service"). We handle personal information in accordance with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

1. Who we are and our role

CAIMY provides software for licensed Australian education and migration agencies to prepare student visa (subclass 500) applications. Agencies are our customers. The personal information of visa applicants ("clients") that an agency uploads or enters is provided by that agency: the agency is the controller of that information and CAIMY processes it on the agency's behalf to deliver the Service. We sell to agencies only; we do not have a direct relationship with the visa applicants.

2. Information we collect

Agency account information

Name, email address, phone number, role and a securely hashed password of each agency user.
Agency details (business name, ABN, address, contact) used to prepare applications.
Usage and billing data (AI operations performed, credit balance, payment records).

Client (visa applicant) information uploaded by agencies

Identity and contact details (name, date of birth, sex, nationality, passport details, address, email, phone).
Documents uploaded by the agency (e.g. passport, national ID, Confirmation of Enrolment, OSHC, English test results, qualifications, financial evidence) and the data our AI extracts from them.
Information the applicant or agency enters into the visa form and the Genuine Student questionnaire.

Some of this is sensitive information (e.g. government identifiers). We collect it only to prepare the visa application the agency is engaged to lodge.

3. How we use information

To read uploaded documents with AI and pre-fill the Department of Home Affairs (DHA) visa form.
To run consistency checks and prepare a Genuine Student statement for the agent to review.
To let the agent, via our browser extension, fill their own ImmiAccount form fields (see section 5).
To operate accounts, meter usage, process payments and provide support.

We do not sell personal information, and we do not use client personal information for advertising.

4. AI processing

Document reading and statement drafting are performed using the Anthropic Claude API. Document contents and application context are sent to Anthropic solely to return the extracted or generated result. We use a central API key; Anthropic processes this data as our sub-processor and does not use it to train its models under the applicable API terms.

5. The browser extension

The CAIMY — ImmiAccount Autofill extension is a productivity tool for the agent. When the agent chooses to run it:

It reads the data of a confirmed application from the CAIMY backend (over an authenticated connection) and fills the corresponding fields on the agent's own ImmiAccount session at online.immi.gov.au.
It never submits or lodges an application — lodging is always a manual human action.
It never accesses, reads or stores the agent's government (ImmiAccount) credentials.
It fills empty fields only, with a dry-run preview available, and operates only on the pages the agent opens.
It stores a session token locally in the browser (chrome.storage) to stay signed in to CAIMY; it does not transmit browsing data to us.

The extension requests access only to app.caimy.com.au (our backend) and online.immi.gov.au (to fill the form) — no other sites.

6. Disclosure and sub-processors

We share information only with service providers that help us run the Service, under contract:

Anthropic — AI document reading and statement drafting.
Stripe — payment processing for credit purchases (card data is handled by Stripe, not stored by us).
Railway — application hosting and database.

We may also disclose information where required by law.

7. Overseas storage and processing

Some of our providers store or process data outside Australia (including in the United States). By using the Service you acknowledge that your and your clients' information may be handled overseas. We take reasonable steps to ensure providers protect it to a standard consistent with the APPs.

8. Security

We protect information with encryption in transit (HTTPS/TLS), hashed passwords, access controls scoped per agency, and authenticated access to documents. No method of transmission or storage is completely secure, but we take reasonable steps to protect personal information from misuse, loss and unauthorised access.

9. Retention and deletion

We retain personal information for as long as the agency's account is active or as needed to provide the Service, and as required to meet legal or record-keeping obligations. An agency may request deletion of a client's data; usage and billing records may be retained where the law requires.

10. Your rights

Under the Australian Privacy Principles you may request access to, and correction of, the personal information we hold about you, and make a privacy complaint. As client information is provided and controlled by agencies, applicants should contact their agency in the first instance; we will support agencies in responding to such requests.

11. Children

A visa application may include dependent minors. We process such information only as part of the application the agency is preparing, on the same basis as other client information.

12. Changes

We may update this policy from time to time. Material changes will be reflected by the "Last updated" date above.

13. Contact

For privacy questions or requests, contact us at privacy@caimy.com.au, Caimy Pty Ltd, 29 Wistari Circle, Two Rocks WA 6037, Australia.