Privacy Notice

1. Who we are

Kindnesss is operated by Global Solutions Management LLC, a Delaware limited liability company, United States ("Kindnesss", "we", "us"). The service is provided at https://joinkindnesss.com.

This notice explains how we handle personal information across the Kindnesss website and application. It describes the product as it is actually built today.

2. Who this notice covers

Kindnesss is used by adults who create and run Circles, by trusted adults invited into a Circle, by school, company, community and Pathways organisations, and by the participants those adults add.

Some information in Kindnesss relates to children and other minors. Additional detail specific to children, minors and the Kinder helper is set out in our Children & Family Privacy Notice, which forms part of this notice.

3. Information we process

We deliberately keep the information in Kindnesss to what the product needs to work. We process the following categories.

• Adult account information: email address, authentication credentials handled by our authentication provider, display name, and the Circles and roles you hold.
• Circle membership information: which Circle you belong to, your role (for example guardian, sponsor, member, organisation administrator), invitation records and the label you were invited under.
• Child and minor participant records: a first name or nickname entered by the responsible adult, an optional age band, an optional photo-sharing preference flag, and the participant's kindness activity, credits and badge progress. We do not ask for a surname, date of birth, home address, school address, telephone number or precise location.
• Missions and pledges: the title, description, category, credit value, deadline, encouragement message, and where an adult chooses to record one, a reward type, a free-text reward description and a descriptive reward amount and currency. A recorded reward is a description only — Kindnesss never collects, holds, transfers or settles that money.
• Completion and reflection content: the text a participant or adult submits to describe what they did, plus any reviewer note added by the approving adult. Completions are text only; Kindnesss has no photo upload and stores no participant photographs.
• Organisation information: organisation profile details, staff and member enrolment records, group, team or class assignment, mission assignments, and aggregate activity and impact figures.
• Billing information: subscription plan, subscription and customer identifiers, subscription status, renewal state and the customer email supplied at checkout, as reported to us by our payments provider. Kindnesss does not receive or store card numbers, bank details or other raw payment credentials.
• Enquiry and request information: what you send us through the organisation enquiry form, the privacy request form and the Pathways application form.
• Technical and security information: information necessarily processed by our hosting, database and authentication providers to deliver and secure the service, such as request and connection information, authentication session records and error diagnostics.

4. Why we process it

We process personal information for the following purposes only.

• To create and authenticate accounts and to keep sessions secure.
• To provide the Kindnesss product: Circles, participants, missions and pledges, completions, review and approval, Kindness Credits and badge progress.
• To run organisation programmes: administrator consoles, groups and teams, mission assignment and aggregate impact reporting.
• To provide customer and technical support and to respond to enquiries and privacy requests.
• To provision, maintain and administer paid subscriptions and to reconcile subscription status with our payments provider.
• To protect the service: abuse prevention, fraud prevention, security monitoring, debugging and service integrity.
• To meet legal, regulatory, accounting and record-keeping obligations, and to establish, exercise or defend legal claims.
• To produce aggregate, non-identifying measures of activity and impact.

5. What we do not do

• We do not use personal information for behavioural advertising, and we do not run advertising trackers in Kindnesss.
• We do not sell personal information, and we do not share it for cross-context behavioural advertising.
• We do not build advertising or marketing profiles of children or other participants.
• We do not publish public child profiles and we do not operate a public leaderboard ranking children, pupils, employees or members.
• We do not collect or display the precise location of a participant.
• We do not operate stranger-to-child messaging of any kind.

6. Children and minors

A Kindnesss family account is owned and controlled by an adult. Children do not create standard independent accounts. Where a child takes part directly, they do so through the Kinder helper: a limited, guardian-issued link secured by a token and an optional four-digit PIN, tied to a single participant in a single Circle. It is not a social profile and it does not allow contact with anyone outside the Circle.

Child and minor participant records are private to the Circle by default. There is no public profile, no public search, no followers or likes, no stranger messaging and no precise location.

Our Children & Family Privacy Notice sets out in detail what is collected through the Kinder helper, who can see it, and how a guardian or an authorised school contact can review, correct, delete or stop it.

7. Organisation Circles: schools, companies, communities and Pathways

When an organisation runs a Kindnesss programme, the organisation's administrators manage their own Circle, their own participant or member records and their own missions.

Company and community reporting is aggregate. An employer administrator sees participation and aggregate impact measures for the organisation programme; they do not receive an employee's private personal or family Kindness Passport content from a separate family Circle.

School Circles are scoped to the school's own programme: participant records the school itself adds, the school's missions, and the school's own activity and aggregate reporting. Further detail is in our School & Organisation Data Processing Terms.

8. Service providers

We use a small number of service providers to operate Kindnesss. They act on our instructions for the purposes described in this notice.

• Supabase — authentication, application database and backend infrastructure.
• Lovable — the application build and hosting platform for the Kindnesss website and application.
• Dodo Payments — Merchant of Record for paid subscriptions, providing hosted checkout, payment processing and subscription status.
• GTranslate — website translation. This service is loaded on public pages only, and only after a visitor actively asks for translation. It is never loaded on signed-in, family, Kinder, organisation or administrative pages.

9. Payments

Paid Kindnesss subscriptions are sold through Dodo Payments acting as Merchant of Record. Checkout takes place on Dodo's hosted pages under Dodo's own buyer terms and privacy notice.

Kindnesss receives the subscription, plan and customer status information needed to provision and maintain your access. Kindnesss does not receive or store card numbers, bank details or other raw payment credentials.

Our Subscription, Billing, Cancellation & Refund Policy explains renewals, cancellation and refund routes.

10. International processing

Kindnesss is operated from the United States and is available internationally. Our service providers may process information in the United States and in other countries.

Where personal information is transferred across borders, we rely on the transfer mechanisms and contractual protections available to us under applicable law and our agreements with those providers. We do not claim any specific certification or adequacy finding in this notice.

11. How long we keep information

We keep personal information only for as long as it is needed for the purpose it was collected for, or for as long as we are required to keep it.

Circle content — participants, missions, completions, credits and activity — is retained while the Circle exists. When a guardian removes a participant, or deletes a Circle, the associated records are removed from the live service. Where an organisation asks us to delete or return its programme data, we act on that request in accordance with the applicable organisation terms.

Billing, subscription, tax, accounting, security and legal records may need to be kept for longer where we have a legal or legitimate operational reason to do so.

12. Security

We apply reasonable technical and organisational measures appropriate to a service of this kind. These include database-level row access controls so that Circle data is only reachable by people entitled to it, least-privilege roles for administrative functions, server-side validation of privileged actions, secrets held only on the server, hashed storage of Kinder tokens and PINs, and signed verification of billing webhook messages.

No online service can be guaranteed to be completely secure. We do not promise absolute security, and we ask you to keep account credentials and Kinder links private.

13. Your rights

Depending on where you live, you may have rights to request access to the personal information we hold about you, to have it corrected, to have it deleted, to restrict or object to certain processing, to withdraw a consent you previously gave, and to receive a copy of certain information in a portable form.

You may also have the right to ask us not to sell or share personal information. Kindnesss does not sell personal information or share it for cross-context behavioural advertising.

To make a request, use our Privacy Request form. We may need to verify your identity, and your authority to act, before we release, change or delete information — particularly where a request concerns a child. We will respond in accordance with applicable law.

14. Parents, guardians, schools and complaints

A parent or guardian who is responsible for a participant may ask to review the information held about that participant, ask us to correct or delete it, and ask us to stop any further direct collection from that participant. An authorised school or organisation contact may make an equivalent request for the participants in their programme.

If you are not satisfied with how we have handled your request, you may be entitled to complain to the data protection or consumer protection authority in your country or region. The authority that applies depends on where you live; we do not claim that a single law applies everywhere.

15. Changes to this notice

We may update this notice as the product develops or as legal requirements change. The date at the top of this page shows when this version was published. Where a change is significant, we will take reasonable steps to bring it to your attention through the service.

16. Who operates Kindnesss, and how to contact us

Kindnesss is operated by the entity below. The address shown is the address of our registered agent in Delaware; it is not a customer-service office. The fastest and most reliable route for a privacy or data-rights request is our Privacy Request form, which logs and tracks the request.

• Global Solutions Management LLC
• Delaware State File No. 10420698
• Registered Agent: Harvard Business Services, Inc.
• Registered-agent address: 16192 Coastal Highway, Lewes, DE 19958, USA
• Email: contact@global-solutions-management.com
• Privacy requests: /privacy-request

17. Contacting us

Privacy, child-data and data-rights requests can be submitted securely through our Privacy Request form, which routes directly to the Kindnesss operations team. Organisations carrying out due diligence can use our organisation enquiry form.

We do not publish personal email addresses of individual staff for privacy requests. Please use the forms above so that requests are logged, tracked and handled consistently.