Privacy policy

Enrolmate is operated by StudentNZ (Auckland, New Zealand). We handle personal information under the New Zealand Privacy Act 2020. This page explains what we collect, why, and the control you keep.

What we collect

• Account details: name, email, password (stored as a salted hash — we cannot read it).
• Assessment answers: qualifications, English test scores, budget range, career goals, and optional disclosures you choose to make.
• Application material: documents you upload (passport, transcripts, evidence of funds), applications and their statuses, and messages on your file.
• Technical basics: IP address for rate limiting and security logs.

How we use it

• To generate course guidance and application checklists (AI processing gives education guidance only, never immigration advice).
• To prepare and submit applications to the institutions you choose.
• To operate the representative system you control.

Who can see it

• You decide. Agents and advisers see your file only while a representation you granted is active. New accounts start with a StudentNZ agent linked by default — shown on your dashboard, removable with one click.
• Institutions see the applications you submit to them, nothing else.
• Enrolmate back office staff access files to operate the service, under audit logging.
• We never sell personal information.

Where it lives

• Database: managed Postgres in Sydney, Australia (ap-southeast-2).
• Documents: encrypted at rest (SSE-KMS) in an access-controlled vault in the same region.
• Cross-border note: storage in Australia is a disclosure under IPP 12 of the Privacy Act 2020; providers hold comparable safeguards.

Your rights

You may request access to or correction of your information at any time, and account deletion subject to records we must retain by law (e.g. advice records under the Immigration Advisers Licensing Act 2007). Contact hello@enrolmate.io. You can also complain to the Office of the Privacy Commissioner (privacy.org.nz).

Last updated: July 2026.