StreamlineID ✕1. About this policy and who we are
StreamlineID verifies people's identity so they can prove who they are once and reuse that proof safely. We also provide a registry that lets businesses confirm the identity and authority behind AI agents that act for a person or organisation. This policy explains how we collect, use, disclose and protect personal information. We follow the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).
In this policy, "we", "us" and "our" mean StreamlineID and CheckGroup Pty Ltd (ACN 159 821 093), and their related bodies corporate. "You" means anyone whose personal information we handle.
When we act for another business
Most people come to us through a business that needs to verify them, such as a superannuation fund, investment platform, lender or adviser (our "Client"). In that case:
- we collect and check your information on the Client's behalf, under a contract with them
- the Client decides why your identity is checked and keeps the result for its own records
- the Client's privacy policy also applies, and you can contact either of us
When you create a reusable StreamlineID, or register an AI agent in our registry, we hold that information ourselves and this policy applies directly.
Dealing with us anonymously
You can contact us with general questions without giving your name, or by using a pseudonym. We cannot verify your identity or issue a reusable ID anonymously, because identification is the service and is often required by law, such as under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) (AML/CTF Act).
2. Personal information we collect
We collect only what we need to verify identity, provide our services and meet our legal obligations.
| Category | Examples |
|---|---|
| Contact and identity details | Full name, former names, date of birth, residential and postal address, email, phone number, signature |
| Identity documents | Images or scans of, and details from, your passport, driver licence, Medicare card, birth or citizenship certificate, or foreign ID |
| Government identifiers | ID document numbers, and Tax File Numbers where a Client asks us to collect them |
| Photo of you | A selfie, used so a staff member can check you match your ID photo. We do not use facial recognition or create biometric templates |
| Verification results | Document Verification Service (DVS) and data source match results, risk scores, and checks against politically exposed person (PEP), sanctions and adverse media lists |
| AI agent registry data | The person or business an agent acts for, the scope of its authority, credentials and keys issued, and a log of verification requests |
| Financial details | Bank account details, where a Client needs them confirmed |
| Technical data | IP address, device type, browser, approximate location from your IP, and session and fraud signals collected during verification |
| Communications | Emails, support chats, recordings of phone calls (we tell you at the start of the call), and complaint records |
| Business contacts | Names and contact details of Client staff, suppliers and job applicants |
Sensitive information
We do not collect biometric information. Your selfie is compared to your ID photo by a person, not by facial recognition software. A PEP or adverse media check may reveal information about political membership or a criminal record, which is sensitive information. We collect that only where a Client is required or authorised by law to carry out the check.
Tax File Numbers
We collect a Tax File Number only when a Client asks us to collect it for a purpose allowed by tax or superannuation law. We collect, use, store, disclose and destroy TFNs as required by the Privacy (Tax File Number) Rule 2015. We never use a TFN to identify you or match records, and you are not legally required to give it, although declining may affect how the Client taxes your account.
Government identifiers
We do not use your passport, driver licence, Medicare or other government-issued number as our own customer or record number. We use or disclose these numbers only to verify your identity, or where the law requires or allows it.
3. How we collect, use and disclose your information
How we collect it
We collect most information directly from you, through our app, web verification flow, website, email or phone. We also collect it from:
- the Client that asked us to verify you
- the government agencies that issued your ID, through the DVS, and credit reporting bodies and other data sources used to check your details
- PEP, sanctions and adverse media screening providers
- AI agents and platforms that present a credential to our registry for checking
- our website, through cookies and similar tools (see section 6)
If we receive information we did not ask for, we decide whether we could have collected it. If not, we destroy or de-identify it as soon as practicable, where lawful.
If you do not give us the information we ask for, we may not be able to verify your identity, and the Client may not be able to provide its product or service to you.
Why we use it
- To verify your identity and confirm you are a real, present person
- To perform customer due diligence and ongoing monitoring for Clients under the AML/CTF Act and other laws
- To issue, manage and let you reuse your StreamlineID
- To register AI agents, check their credentials, and confirm who they act for and what they may do
- To detect and prevent fraud, identity theft and misuse of our services
- To operate, secure, test and improve our systems, including training our fraud and risk models on de-identified data
- To respond to enquiries and complaints, and manage our relationship with Clients and suppliers
- To meet legal, regulatory and audit obligations, and respond to lawful requests
- To tell you about our services, where permitted (see below)
We use or disclose information for another purpose only if you consent, you would reasonably expect it and it is related to the original purpose, or the law requires or allows it.
Who we disclose it to
- The Client that asked us to verify you, and any party you authorise to rely on your StreamlineID
- Businesses and platforms that check an AI agent's credentials in our registry. They receive only the verification result and the scope you authorised, not your ID documents
- Government and data source providers used to check your details, including the DVS
- Our service providers: cloud hosting, identity and screening vendors, IT support, auditors, legal and professional advisers, and insurers
- Our related bodies corporate
- A buyer or investor, as part of a proposed sale or restructure of our business, under confidentiality terms
- Regulators, courts and law enforcement, including AUSTRAC, the OAIC and police, where required or authorised by law
- Your representatives, such as a lawyer, attorney or executor, with your authority
We do not sell, rent or trade your personal information.
Credit reporting body checks
With your consent, we give your name, residential address and date of birth to the credit reporting body illion. It tells us whether those details match its credit files. This is not a credit check and does not affect your credit score.
- We use the result only to verify your identity under the AML/CTF Act.
- If you do not consent, we offer another way to verify, using your ID documents.
- If your details do not match, we tell you in writing which credit reporting body we used and offer another way to verify.
- We keep a record of the check for 7 years after the Client stops providing its service to you, then delete it.
- You can ask us, or the credit reporting body, for the information used in the check.
Direct marketing
We market only to business contacts and to people who use our services directly, and never use identity documents, selfies or TFNs for marketing. Every marketing message includes an unsubscribe option. You can also ask us to stop, or ask where we got your details, by contacting our Privacy Officer. We comply with the Spam Act 2003 and the Do Not Call Register Act 2006.
4. Automated decisions and AI
Our verification is largely automated, and the result can affect whether a Client opens an account for you or accepts an AI agent acting for you. This section describes those decisions as required by the Privacy Act from 10 December 2026.
| Automated decision | Personal information used | Effect on you |
|---|---|---|
| Is the ID document genuine and unaltered? | Document images and details | A failed check is sent to a person for review |
| Do your document details match the government record? | Document numbers, name, date of birth (checked through the DVS) | A mismatch may require another document |
| Do your details match other data sources? | Name, date of birth, address | A mismatch may require more documents |
| Fraud and risk score | Device, IP, session signals, verification history | A high score sends the case to manual review |
| PEP and sanctions screening | Name, date of birth, nationality | A possible match is reviewed by a person, then referred to the Client |
| Is this AI agent authorised? | Agent credential, the person or business it acts for, the scope of authority | An invalid or expired credential is declined |
The comparison of your selfie with your ID photo is done by a person, not by software.
We do not make final decisions to refuse a product or service. We give the result to the Client, which makes that decision. A StreamlineID staff member reviews every failed or flagged check before we send a final result. You can ask for a human review, or for more information about a decision, by contacting our Privacy Officer.
We may use AI tools, including generative AI, to support our staff, such as summarising support requests or reviewing records for errors. We do not enter identity documents, selfies or TFNs into public AI tools, and staff check AI outputs before relying on them.
5. Overseas disclosure, security and retention
Overseas disclosure
We store all personal information we collect in Australian data centre regions operated by Amazon Web Services, Microsoft Azure and Google Cloud. We do not routinely disclose it to overseas recipients. The exceptions are our website font and help desk providers, Google and Atlassian, which may process data in the United States and other countries (see section 6), and overseas businesses that check an AI agent in our registry, which receive only the verification result and may be located in any country.
Before disclosing information overseas, we take reasonable steps to make sure the recipient handles it consistently with the APPs, usually through contract terms. Where the law requires it, we ask for your consent first.
Security
We protect personal information from misuse, loss, and unauthorised access, change or disclosure. Our measures include:
- encryption of data in transit and at rest
- access limited by role, with multi-factor authentication and access logs
- extra access restrictions on ID document images, selfies and TFNs
- an independent SOC 2 Type II audit of our security controls
- security testing and monitoring of our systems
- staff confidentiality obligations and annual privacy and security training
- due diligence and contract terms for service providers
No system is completely secure. Please keep your login details and devices secure, and tell us immediately if you think your StreamlineID has been misused.
Data breaches
If a data breach is likely to cause serious harm, we will notify you and the Office of the Australian Information Commissioner (OAIC) as required by the Notifiable Data Breaches scheme, and tell you what steps to take. Where we act for a Client, we will also notify that Client promptly.
How long we keep it
| Information | How long we keep it |
|---|---|
| Verification records held for a Client under the AML/CTF Act | 7 years after the Client's relationship with you ends, or as the Client instructs |
| ID document images and selfies | As set in our contract with the Client that requested the verification, then securely deleted |
| Tax File Numbers | Only as long as the Client needs them, then securely destroyed |
| Reusable StreamlineID profile | 7 years after you close it |
| AI agent registry records and verification logs | 7 years after the credential is revoked or expires |
| Call recordings | 7 years |
| Website, marketing and enquiry data | Up to 2 years after last contact |
When we no longer need information, we securely delete, destroy or de-identify it.
6. Your rights, cookies, complaints and contact
Access and correction
You can ask for access to the personal information we hold about you, or ask us to correct it, by contacting our Privacy Officer. We will need to confirm your identity first. We respond within 30 days. Making a request and correcting information are free. We may charge a reasonable fee for providing large volumes of copies, and will tell you the fee first.
If we refuse access or correction, we will tell you why in writing and how to complain. If we will not correct information, you can ask us to attach a statement saying you believe it is wrong. Where we hold information for a Client, we may refer your request to that Client.
You can also close your StreamlineID or revoke an AI agent's credential at any time by contacting us.
Cookies and website analytics
Our website uses a small number of third-party services:
- Google Fonts, to display our typefaces. Your browser sends your IP address to Google when it loads them
- Atlassian Jira Service Management help widget, which lets you contact us from any page and sets an analytics cookie
- Our Atlassian service portal, which opens when you click "Book a discovery call". It collects the name, email and details you enter, and creates a request in our support system
We do not use Google Analytics, advertising pixels or remarketing tools on our website.
Google and Atlassian may process this data in the United States and other countries, under their own privacy policies. You can block or delete cookies in your browser. Some site features may not work if cookies are blocked.
Our website may link to other sites. We are not responsible for their privacy practices.
Complaints
- Contact our Privacy Officer with details of your complaint and any supporting documents.
- We will acknowledge it within 1 business day and aim to resolve it within 30 days. If we need longer, we will tell you why and give you a new date.
- If you are not satisfied with our response, you can contact the Australian Financial Complaints Authority (AFCA), a free, independent dispute resolution service: afca.org.au, 1800 931 678, info@afca.org.au, GPO Box 3, Melbourne VIC 3001. Our AFCA membership number is 31626.
- You can also complain to the Office of the Australian Information Commissioner (OAIC): oaic.gov.au, 1300 363 992, GPO Box 5288, Sydney NSW 2001.
Changes to this policy
We review this policy at least once a year. We will publish changes on our website with a new effective date, and tell registered users of material changes by email.
Contact us
Privacy Officer, StreamlineID
- Email: privacy@streamlineid.com.au
- Phone: 1800 115 135
- Post: Level 1, 6–10 O'Connell Street, Sydney NSW 2000