Privacy Policy

P1. One policy across BMSG

BringMeSunshineGroup.com (BMSG) is a trading name used by a New Zealand sole trader. It is not an incorporated company or a registered charity. The individual operator is responsible for the personal information handled by BMSG. This policy covers BMSG's own sites and services, OneGoodDeed.com and its Ripple experience, Give.OneGoodDeed.com, Crew Comms, OurFamilyRocks.com, LearnToReadReadToLearn.com and its Adaptive Reading Coach, and BMSG-branded shops and other assets listed below. The schedules are part of this policy, not separate product policies.

Only the schedules for features you use apply to that use. A feature described as planned is not a claim that it is available. Third-party providers may also be responsible for their own processing; their notices supplement this policy for that processing.

P2. Information and purposes

Depending on the service, information can include contact details and enquiries; account identifiers and sign-in records; organisation, household and chat memberships; content you submit; consent and guardian records; transaction references; and technical information such as IP address, device type, errors and usage events. We use it to provide the requested service, answer enquiries, deliver communications, manage permissions, protect people and systems, investigate complaints and meet applicable obligations. We do not treat membership of BMSG as permission to reuse personal information for unrelated products.

When we obtain information from another person or service, such as an inviter, organiser, sign-in provider or guardian, we explain that source and the intended use in the relevant invitation or collection notice. Required and optional fields must be identified where information is collected.

P3. Choices, cookies and communications

Essential cookies or device storage may support sign-in, security, preferences and offline features. Optional analytics, marketing and device permissions are separate choices where consent is required. You can change browser permissions and unsubscribe from optional updates. Necessary account, security and service messages may still be sent. We do not sell personal information or use it for targeted advertising.

The precise cookies, storage keys and external requests depend on the surface. The applicable collection notice must explain them before optional processing starts. We do not assume that a cookieless tool removes every notice or consent obligation.

P4. Access, disclosure and overseas handling

Information is available to the people to whom you choose to send or share it, and to authorised personnel and providers when needed for hosting, identity, communications, support, safety, payments or fulfilment. BMSG services include independent CRM and Email services. Connecting these services does not grant every product access to all your information. Disclosures may also be required by law or necessary for a legally permitted safety purpose.

Infrastructure configurations include hosting in France, backups in the Netherlands, and global edge and external services. Actual locations and provider roles must be checked for each enabled feature. Before disclosing information overseas, BMSG must assess the applicable safeguards. This notice does not assert that all provider agreements or transfer assessments have been completed.

P5. Retention, security and requests

We keep personal information for the purpose for which it is needed and any applicable legal retention period. We use access controls and safeguards appropriate to the information; no service can promise absolute security. Deletion can involve removing personal content and preserving structural records, but an opaque identifier is not automatically anonymous. Any retained information that can still identify you remains protected. Legal holds and backups can affect the time needed to complete deletion; we explain applicable exceptions when responding.

You may request access to and correction of your personal information. Where applicable law provides them, you may also request erasure, restriction, portability or object to processing. You can withdraw consent for future consent-based processing. These rights have conditions and exceptions. Contact BMSG using the contact details below; an account dashboard is not the only route. We may need proportionate information to verify a request. You can complain to the New Zealand Privacy Commissioner or the competent authority where you live.

Contact: info@bringmesunshinegroup.com, BringMeSunshineGroup.com, PO Box 243, Cambridge 3450, New Zealand. The postal address was supplied by the owner. Monitored email delivery and the operator's remaining legally required particulars are being confirmed; this contact notice will be updated as needed.

P6. Changes and accepted versions

Each published version will have a document identifier and effective date. We keep earlier versions and distinguish the terms you accepted from the version currently displayed. Material changes requiring renewed agreement or consent are presented for that action; a page visit does not create a consent record. Privacy acknowledgement, contractual acceptance, marketing permission and guardian verification serve different purposes.

Schedule WEB — Sites, enquiries and beta services

Applies to BMSG and product landing pages, FAQs, waiting lists, public status pages and branded hosted surfaces. Enquiries may include your contact details and message. A static holding page does not itself mean the corresponding product or payment service is operating.

Beta services may collect feature-use events, timings, errors, device characteristics and feedback to diagnose problems. The existing BMSG source sets a maximum of 12 months for extra beta measurements; telemetry configurations also contain shorter periods. Actual categories and deletion jobs require verification before this draft is published. Feedback can include content you choose to attach; we do not assume all diagnostic data is anonymous.

Schedule ACCOUNT — Identity, support and shared services

Applies to sign-in, account settings, guardian records, platform administration, CRM, Email and notifications. Records may include your account identifier, email, authentication events, roles, preferences, invitations, enquiries and delivery or suppression status. Only authorised recipients should receive these records for their service purpose. Staff access and safety investigations require appropriate authorisation. Identity-provider and delivery-provider processing must be explained for the methods actually enabled.

Schedule MSG — Crew Comms

Applies to standalone and embedded Crew Comms. Data can include memberships, messages, attachments, reactions, read positions, invitations, push subscriptions, event and poll responses, reports and moderation records. Content is shared according to chat membership and permissions. Safety checks can process content automatically, including with AI; authorised people may review reported or held content. Messages are not end-to-end encrypted against BMSG. Checks cannot guarantee that every harmful item is detected.

Voice notes and uploaded recordings differ from live calls. The call implementation describes no call recording; connection metadata can still be processed by relay infrastructure. Link previews can cause a BMSG server to request the linked site. Retention requirements include active chats plus 90 days after archival, separate moderation and legal-hold rules, and account-erasure procedures. The retention register records which deletion behaviours remain unverified; this draft does not promise that every scheduled deletion is already operating.

Schedule RIPPLE — Deeds, maps and location

Applies to OneGoodDeed.com and Ripple. Deed submissions, selected categories, optional content and approximate location can be used to show activity on a public map. Anonymous participation does not necessarily mean that no technical identifier is processed. Precise location requires an explicit feature-specific choice; child-linked public activity must not reveal identity or precise location. Personalised suggestions, moderation and voice capture are covered only when enabled and disclosed. Proposed integrations are not evidence that data is already exchanged.

Schedule GIVE — Events, gifts and financial records

Applies to Give.OneGoodDeed.com, event participation and any BMSG-operated gifting or payment feature. Records may include organisers, attendees, contributions, order and payment references, refund status and necessary accounting information. A payment provider handles payment credentials in its own flow. Real-money features require separate operational approval and verified provider disclosures. Sandbox activity is testing, not a real gift or donation. This policy does not assert that Give has an active Stripe sandbox or live account.

Schedule FAMILY — Children, guardians and OurFamilyRocks.com

Applies to child-facing features across the estate and family organisation features. BMSG's required design uses guardian-managed child profiles and suitable verification before identity-bearing child participation. A privacy notice is not itself parental consent. Household permissions must explain who can see calendars, captures, messages and other family information. Proposed voice, image, email and calendar connectors require their own collection explanations and permission checks before use.

Children's data must not train models, and child transcripts must not be sent to hosted models under BMSG's governing rules. Child-facing features must minimise collection, explain guardian visibility and support withdrawal. These requirements do not establish that the child lane has passed its implementation checks.

Schedule LEARN — LearnToReadReadToLearn.com and Adaptive Reading Coach

Applies to reading practice, Mr Swindell, learner profiles, assessments and planned research features. Learning records can include practice text, progress and assessment results. A microphone feature must explain whether audio remains on the device and when it is deleted. The constitution requires transient reading audio to be discarded after processing. Planning documents describing optional cloud assistance do not override the prohibition on hosted child transcripts. Research exports require a separately explained purpose and applicable permission; they are not enabled by accepting general terms.

Schedule SHOP — Merchandise and third-party hosted surfaces

Applies to Shop.OneGoodDeed.com and the Fourthwall storefront, including its support surface, plus future registered shops. BMSG's branding, referrals and information BMSG receives are covered here. The host may separately collect orders, delivery details, payment information and support requests under its own notice. The governing register identifies Fourthwall as merchant for the existing shop; current contracts, data access and actual checkout behaviour remain to be verified. New shops must be registered before launch.

For children: the short explanation

Ask your parent or guardian before sharing something private. People in your chat or family group may see what you send. BMSG's safety tools and authorised helpers may check it. Your guardian may be able to see your activity. You can ask your guardian or BMSG for help, to see your information or to ask for it to be removed. Do not share passwords, your home address or someone else's private information. This explanation is part of the same Privacy Policy.

Asset and schedule applicability

The common clauses apply throughout. Listed schedules apply when the corresponding feature is used; inclusion does not mean a planned service is operating.