Legal
Privacy Policy
Last updated: 27 August 2026 · New Zealand law applies to our NZ operations
1. The short version
WhānauGuard helps parents keep tamariki safe online. We collect the minimum information needed to do that. We never read private messages, record keystrokes, access cameras or microphones, or covertly monitor anyone. Location sharing is always opt-in and controlled by a parent. This page explains exactly what we collect, why, and how long we keep it.
2. Who we are
WhānauGuard is operated by the WhānauGuard team based in Aotearoa New Zealand. For the purposes of the EU General Data Protection Regulation (GDPR), our Data Protection Officer can be contacted at dpo@whanauguard.online. Questions about this policy can also be sent to help@whanauguard.online.
3. Information we collect
Parent accounts: email address, phone number (for verification), display name, authentication records (login times, device types), and MFA configuration. Tamariki profiles: a nickname and age band only — we never collect real names, photos, or identity documents for children. Device data: the telemetry needed to enforce your rules, such as installed apps, usage summaries, filtered destinations, location (only when a parent enables it), and protection-health events. We never collect keystrokes, private message content, camera or microphone recordings, browser history content, or social-media credentials.
4. How we use information
We use the information described above solely to: enforce the protection policies you set, show you honest reports and alerts, keep your account secure, process payments, and improve the Service. We do not sell personal information. We do not use child data for advertising, profiling, or any purpose other than the family-safety service you signed up for.
5. Legal bases for processing (GDPR)
For EU/EEA residents, we process personal data under the following legal bases: (a) performance of a contract — providing the Service you signed up for; (b) legitimate interests — account security, fraud prevention, and service improvement; (c) consent — for location sharing, which is always opt-in; (d) legal obligation — where required by applicable law. You may withdraw consent for location sharing at any time from the dashboard.
6. Location data
Location sharing is OFF by default and must be explicitly enabled by a parent. Every toggle is audited, every GPS fix reports its accuracy, and historical location is retained only for a defined retention window (configurable by the parent). Parent coordinates are never shown on the family map — Distance Guard computes distances server-side so precise parental location is never exposed.
7. On-device processing
Where the platform allows, sensitive detection happens on the device itself and nothing is uploaded to our servers. Where a platform makes on-device processing impossible, we detect patterns at the server level and alert — transparently, and only to the child's authorised parents.
8. Data sharing
We do not sell or share personal information with third parties for their own purposes. We use limited service providers (hosting, payment processing via Stripe, SMS verification via Vonage) who process data on our behalf under strict contractual obligations. If required by law (e.g., a valid court order), we may disclose data — we will notify you where legally permitted. We never share child data with any third party beyond what is necessary to operate the Service.
9. International data transfers
Our primary infrastructure is hosted in Aotearoa New Zealand. Some service providers may process data in other countries (e.g., the United States). Where personal data is transferred outside your jurisdiction, we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) for EU/EEA data transfers, and equivalent protections for UK residents.
10. Data retention
We keep information only as long as needed for the purposes described above: account data for the life of the account plus 90 days, device telemetry per configurable retention windows (default: 90 days), location data per parent-configured retention, and payment records as required by law (typically 7 years). We delete or anonymise data when your account is closed or retention windows expire. You can request deletion of your family's data at any time.
11. Security
Parent accounts require multi-factor authentication (MFA). Policies and device communications are cryptographically signed and integrity-verified. Access to safety data is audited. All data is encrypted in transit (TLS 1.2+) and at rest (AES-256). We conduct regular security assessments and follow industry best practices. No system is perfectly secure, but we design for the strongest protection each platform officially allows.
12. Your rights
Depending on your jurisdiction, you may have the right to: access your personal data, correct inaccurate data, delete your data, restrict or object to processing, data portability, and lodge a complaint with a supervisory authority. To exercise any of these rights, contact us at help@whanauguard.online. We will respond to verified requests within 30 days.
13. Your rights under specific laws
New Zealand (Privacy Act 2020): You have rights of access and correction, and may complain to the Office of the Privacy Commissioner. European Union/EEA (GDPR): You may have rights to access, correct, erase, restrict or object to processing, portability, and safeguards around automated decision-making. United Kingdom (UK GDPR / DPA 2018): Equivalent rights generally apply. California (CCPA/CPRA): You may have rights to know, access, correct, delete, limit sensitive-information use, and opt out of sale or sharing; we do not sell personal information. Australia (Privacy Act 1988 and Australian Privacy Principles): You may have rights to access and correct information and complain to the Office of the Australian Information Commissioner. Canada (PIPEDA and applicable provincial laws): You may have rights to access, correct, and challenge the handling of personal information. Brazil (LGPD): You may have rights including confirmation, access, correction, deletion, portability, information about sharing, and review of certain automated decisions. Japan (APPI): You may have rights concerning notice, disclosure, correction, suspension of use, and complaints. South Korea (PIPA): You may have rights to access, correct, delete, suspend processing, and complain. Singapore (PDPA): You may have rights to access and correct personal data and withdraw consent where applicable. India (Digital Personal Data Protection Act, where applicable): We will provide rights and notices required by that law. Switzerland (FADP): You may have rights to access, correct, and request deletion or restriction where applicable. South Africa (POPIA): You may have rights to access, correct, object, and complain to the Information Regulator. Other countries: local privacy law may provide additional rights. Contact us and we will assess your request under the law that applies to you.
14. Children's privacy
WhānauGuard is a parental-control service: it operates on devices enrolled by a parent or guardian for tamariki in their care. We collect only the minimum profile information described above (nickname and age band), and we never collect more data about tamariki than the Service needs. We comply with the Children's Online Privacy Protection Act (COPPA) in the United States, the Age Appropriate Design Code in the United Kingdom, and equivalent child-privacy protections in other jurisdictions.
15. Cookies and tracking
Our website uses only essential cookies required for authentication and functionality. We do not use advertising trackers, retargeting pixels, or analytics tools that profile individual visitors. If we add analytics in the future, they will be privacy-respecting (e.g., self-hosted) and disclosed here.
16. Changes to this policy
If we change this policy, we will update this page and, where material, notify parents directly at least 30 days before changes take effect. We will display the 'Last updated' date at the top. Continued use after changes take effect constitutes acceptance of the updated policy. If you do not agree, you may close your account and request data deletion.
17. New Zealand privacy protections
Because WhānauGuard is operated from Aotearoa New Zealand, the New Zealand Privacy Act 2020 and its Information Privacy Principles are central to how we handle personal information. We collect it for lawful, necessary purposes; tell you what we collect and why; take reasonable security safeguards; limit use and disclosure; and retain it only as long as needed. You may request access to or correction of your information by emailing help@whanauguard.online. We may need to verify your identity before responding. If you are not satisfied, you may complain to the Office of the Privacy Commissioner at privacy.org.nz. Privacy enquiries: help@whanauguard.online. Data Protection Officer (GDPR): dpo@whanauguard.online.
Questions? Email help@whanauguard.online.