Data Processing & Institutional Information

1. Purpose of this page

This page is written for schools, districts, companies, community organisations and Pathways institutions carrying out due diligence on Kindnesss, operated by Global Solutions Management LLC, a Delaware limited liability company, United States. It describes, factually, how the service processes information today.

This page is informational. It is not itself a signed data processing agreement. If your organisation requires a written processing agreement, a security questionnaire response, or a specific set of contractual clauses, request it through our organisation enquiry form and we will handle it as a contracting matter rather than a click-through.

2. Roles

For a school, company, community or Pathways programme, the organisation decides who is enrolled, what programme runs and why, and generally acts as the controller of that programme's participant information. Kindnesss processes that information to provide the service to the organisation.

For a family Circle bought directly by a guardian, and for the account and billing information of any customer, Kindnesss acts as controller.

Where the organisation is the controller, Kindnesss processes participant information on the organisation's instructions as expressed through the product's own functionality, and does not use it for advertising or any unrelated commercial purpose.

3. Categories of data

• Account holders and staff: email address, authentication records, role in a Circle, and subscription status.
• Participants: a first name or nickname, an optional age band, and their own missions, completions, reflections, credits and badge progress.
• Organisation records: organisation name, type, tier, seat limit, teams or groups, and aggregate impact figures.
• Enquiries and requests: what a business or privacy contact voluntarily sends us.
• Operational and security data necessarily processed by our hosting, database and authentication infrastructure.

4. Data Kindnesss does not process

• No participant surnames, dates of birth, home addresses, telephone numbers or personal email addresses.
• No photographs — Kindnesss has no photo upload feature and stores no participant images.
• No location data, contacts, microphone or camera access.
• No special-category data by design: no health, biometric, immigration, justice, religious or political data fields exist for participants.
• No advertising identifiers, no behavioural profiling and no sale of personal information.

5. Subprocessors

Kindnesss uses a small number of infrastructure and service providers. They process data only to provide their service to us.

• Supabase — Authentication, application database and backend infrastructure.
• Lovable — Application build and hosting platform for the Kindnesss website and application.
• Dodo Payments — Merchant of Record for paid subscriptions: hosted checkout, payment processing, subscription and billing status.
• GTranslate — Website translation, loaded on public pages only and only after a visitor actively asks for translation.

6. Security measures

• Transport encryption in transit and encryption at rest provided by our managed database and hosting platform.
• Row-level security enforced in the database on every application table, so a Circle's records are only reachable by the roles entitled to them.
• Privileged database routines are restricted to authenticated callers and the service role; anonymous execution of privileged routines is revoked.
• Kinder access tokens and optional PINs are stored only as one-way hashes, and a guardian can revoke a link at any time.
• Administrative tooling used to operate the business deliberately excludes participant names, reflections and Passport content, so business operations do not require reading children's content.
• Payment card data never reaches Kindnesss systems; hosted checkout is operated by the Merchant of Record.
• Change control through reviewed deployments, with automated typechecking and build verification before release.

7. Access control inside Kindnesss

Access to production systems is limited to the people who need it to operate, support and secure the service. Roles inside the product are least-privilege by design: a sponsor cannot change child safety settings, an organisation staff member sees only their assigned programme scope, and operator staff roles are separated between owner, admin and support.

8. International transfers

Kindnesss is operated from the United States and its infrastructure providers operate internationally. If your organisation is outside the United States, information will be transferred to and processed in the United States and potentially other countries where our providers operate.

Where a specific transfer mechanism, data residency requirement or set of contractual clauses is required for your jurisdiction, raise it through our organisation enquiry form before enrolling participants. We will not assert that a particular mechanism is already in place for your organisation unless it has been agreed in writing with you.

9. Retention and deletion

Programme information is retained while the Circle exists and while it is needed to provide the service. An organisation administrator can remove participants, and can delete a Circle, which removes its participants, missions, completions, credits and activity from the live service.

Limited billing, security and legal records relating to the customer may be retained for longer where we are required or reasonably need to retain them. Deletion requests can be made through our Privacy Request form.

10. Assisting the organisation

Kindnesss will assist an organisation with a participant access, correction or deletion request, will tell the organisation without undue delay if we become aware of a security incident affecting its data, and will make available the information reasonably necessary to demonstrate how the service handles that data.

11. Children in institutional programmes

Where a programme includes children, the organisation is responsible for having the authority to enrol them and for giving the notice its own rules and local law require. Our Children & Family Privacy Notice sets out what is collected, who can see it and how it can be stopped, and can be shared with families directly.

12. Requesting documentation

Written processing agreements, security questionnaires, procurement documentation and jurisdiction-specific commitments are handled individually. Use our organisation enquiry form and tell us what your procurement process requires.

13. Contracting entity

The contracting entity is the operator set out below. The Delaware address is the address of our registered agent and is not an operating or customer-service office; the registered agent does not handle Kindnesss data requests.

• Global Solutions Management LLC
• Delaware State File No. 10420698
• Registered Agent: Harvard Business Services, Inc.
• Registered-agent address: 16192 Coastal Highway, Lewes, DE 19958, USA
• Email: contact@global-solutions-management.com
• Privacy requests: /privacy-request