Privacy Policy

Last updated 28 June 2026

1. About this policy

VisaPacks is committed to protecting your personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). This policy explains what personal information we collect, how we use and store it, and your rights as a user.

VisaPacks is a document organisation tool accessible at visapacks.com.au. It helps you gather and manage the documents required for an Australian visa application.

2. What personal information we collect

2.1 Anonymous users

• A randomly generated session identifier stored in a browser cookie
• Your selected visa subclass and questionnaire answers (e.g. relationship status, country of birth, profession — no name or contact details are collected)
• Documents you upload to your checklist (passport copies, financial statements, and other visa-related files)

2.2 Registered accounts

• Email address
• Password (stored as a bcrypt hash — your plain-text password is never stored or transmitted)
• Google OAuth identifier (only if you choose to sign in with Google)
• Payment status and Stripe customer ID (card details are handled entirely by Stripe and are never stored by us)

2.3 Technical data

• IP address, used for rate limiting and abuse prevention
• Browser type and version, used for compatibility diagnostics

3. How we use your information

We use your information only to:

• Provide and operate the VisaPacks checklist and document management service
• Associate your uploaded files and checklist progress with your session or account
• Process payments and confirm your access status
• Send transactional emails — email verification, password reset, and payment receipts. We do not send marketing emails.
• Detect and prevent abuse, fraud, and unauthorised access
• Respond to support and privacy enquiries

We do not use your personal information for marketing, advertising, or automated profiling.

4. Storage and security

Your data is stored on secure cloud servers. Uploaded documents are held in access-controlled storage and are never publicly accessible by URL. All file access requires authentication.

We apply industry-standard protections including HTTPS encryption in transit, bcrypt password hashing, and server-side file access controls.

Retention periods

• Anonymous sessions: all session data and uploaded files are automatically deleted 24 hours after session creation
• Registered account files: retained until you delete your account
• Payment records: retained for 7 years as required under Australian tax law
• IP and rate-limit logs: retained for up to 30 days

5. Third-party service providers

We do not sell, rent, or share your personal information with third parties for marketing purposes. We use the following service providers who process data on our behalf:

These providers are bound to process your data only as directed by us and in accordance with applicable law. We may also disclose personal information if required by law or a court order, or to protect the rights or safety of our users.

6. Cookies

We use a small number of cookies to operate the service. See our Cookie Policy for full details.

7. Analytics

We do not currently use third-party analytics or tracking services. If we introduce analytics in the future, this policy will be updated and, where required, your consent will be obtained.

8. Your rights

Under the Privacy Act 1988 (Cth) and the Australian Privacy Principles, you have the right to:

• Access the personal information we hold about you
• Correct personal information that is inaccurate, incomplete, or out of date
• Request deletion of your personal information, subject to our legal retention obligations
• Make a complaint if you believe we have breached the APPs

To exercise any of these rights, email us at privacy@visapacks.com.au with the subject line "Privacy Request". We will respond within 30 days.

You may also delete your account at any time from My Account. This immediately deletes all your uploaded documents and anonymises your account data. Note that Stripe payment records cannot be deleted as they are subject to financial record-keeping requirements.

9. Complaints

If you are not satisfied with how we handle a privacy matter, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or by calling 1300 363 992.

10. Changes to this policy

We may update this policy from time to time. Material changes will be communicated by updating the "Last updated" date at the top of this page. Continued use of VisaPacks after a policy change constitutes acceptance of the updated terms.

11. Contact

For all privacy enquiries: privacy@visapacks.com.au