Privacy Policy

This Privacy Policy applies to personal information processed in connection with Million Wishes, including information relating to:

1. prospective members who receive a Gift;
2. people who create an account;
3. active members;
4. former members;
5. selected members participating in The Stage;
6. members providing financial Support;
7. people receiving financial Support;
8. people communicating with Million Wishes; and
9. visitors to Million Wishes websites and digital services.

Million Wishes is intended only for people aged 18 years or older.

When you create an account or claim a place in Million Wishes, we may collect:

1. your first name;
2. your last name;
3. your email address;
4. your mobile telephone number;
5. your password or securely processed authentication credentials;
6. your confirmation that you are at least 18 years old;
7. information about the Gift through which you accessed Million Wishes;
8. the identity of the member who gave you that Gift;
9. the date and time you created your account;
10. the date and time your membership was activated;
11. your membership and account status; and
12. other technical or administrative information required to establish and maintain your membership.

We do not currently require ordinary members to create a public profile, upload a profile photograph, provide a biography, provide social media accounts or participate in a searchable member directory.

Million Wishes is strictly for people aged 18 years or older.

As part of joining, you are required to confirm that you are at least 18.

We may require additional age or identity verification where reasonably necessary, including if you are selected for The Stage, receive financial Support, are involved in a payment or compliance review, or where we reasonably suspect that an account may belong to a person under 18.

Million Wishes is built around members giving Gifts to other people.

When a member gives a Gift, we may collect and maintain information about:

1. the member who gave the Gift;
2. the Gift link or other mechanism used;
3. the person who received or claimed the Gift;
4. when the Gift was created, accessed or claimed;
5. whether the recipient created an account;
6. whether the recipient successfully became an active member; and
7. the historical relationship between members created through Gifts.

We may maintain the historical Gift chain showing which member gave a place to another member and subsequent Gift relationships.

This information may be retained as part of the historical, security and audit record of Million Wishes.

When you give a Gift, your first name may be shown to the recipient.

For example:

“CODY GIFTED YOU A PLACE.”

By giving a Gift, you acknowledge that your first name may be disclosed to the person receiving that Gift for the purpose of explaining who gave them access to Million Wishes.

Your Gift does not create a public member profile.

Million Wishes currently uses Stripe to process Membership Fee payments.

When you make a payment, your payment details are provided directly to Stripe or through Stripe's payment technology.

Million Wishes does not store your complete payment card number or card security code.

We may receive and retain transaction-related information from Stripe, including:

1. payment status;
2. transaction amount;
3. currency;
4. transaction identifiers;
5. payment method type;
6. payment date and time;
7. billing-related information made available to us;
8. refund information;
9. dispute and chargeback information;
10. fraud or risk information; and
11. other information necessary to administer the transaction.

Million Wishes may use Stripe or other payment providers for future financial Support transactions.

Payment providers may change over time.

If financial Support is enabled for a Wish, Million Wishes may collect and maintain information concerning Support transactions.

This may include:

1. which member provided Support;
2. which Wish was Supported;
3. the amount selected by the member;
4. fees and processing charges;
5. the amount allocated to the selected member;
6. the amount retained by Million Wishes;
7. transaction identifiers;
8. payment status;
9. refunds;
10. reversals;
11. disputes;
12. chargebacks;
13. fraud or risk indicators; and
14. other information necessary to process and administer Support.

Million Wishes will know the identity of members who provide financial Support.

The identity of an individual supporter and the amount that individual supporter provides are not intended to be disclosed to the selected Wish recipient merely because they provided Support.

A selected member may instead be shown aggregate information, such as:

1. Total Support received
2. Total number of supporters

Million Wishes may retain individual supporter identities and transaction amounts internally for payment processing, accounting, security, fraud prevention, compliance, dispute resolution, recordkeeping and platform administration.

We may disclose transaction information where required by law or reasonably necessary to payment providers, banks, financial institutions, regulators, professional advisers or other authorised service providers.

Million Wishes may maintain a record of the Wishes a member has financially Supported.

Million Wishes may display aggregate participation information within the platform, including information such as:

Wishes Supported: 41 / 47

This may show how many Wishes a member has financially Supported compared with the number of applicable Wishes the member has had the opportunity to Support.

Million Wishes does not intend to publicly display the amount of money an individual member has provided to particular Wishes as part of this participation history.

Members may be required under the Million Wishes participation rules to either financially Support a Wish or provide a reason for choosing not to provide financial Support.

If you submit a reason for not providing financial Support, that reason will be treated as private information within Million Wishes.

It is not intended to be disclosed to:

1. the selected member;
2. other members; or
3. the public.

Million Wishes may access and use this information internally where reasonably necessary to administer participation requirements, resolve disputes, maintain platform integrity, enforce the Terms of Membership and Participation, improve the service, or comply with legal obligations.

If you are selected for The Stage, Million Wishes may collect additional information.

Depending on the nature of your Wish and any financial Support you may receive, this may include:

1. your full legal name;
2. date of birth;
3. identity documents;
4. residential address;
5. country of residence;
6. banking or payout information;
7. tax information;
8. payment-account information;
9. information required for identity or age verification;
10. sanctions-screening information;
11. information required for fraud prevention;
12. information required by banks, payment providers or financial institutions;
13. information relating to your Wish;
14. photographs;
15. video;
16. audio;
17. your voice;
18. your image and likeness;
19. your interview;
20. social media accounts or websites you choose to provide;
21. information about businesses, organisations, people, products, services, projects or causes forming part of your Wish; and
22. other information you voluntarily provide in connection with The Stage.

Additional verification may be required before financial Support can be paid to a selected member.

The Stage is designed to communicate a selected member's Wish to the Million Wishes community and potentially to a broader public audience.

Information you provide for publication as part of The Stage may therefore become public.

This may include your:

1. name;
2. image;
3. likeness;
4. voice;
5. interview;
6. Wish;
7. photographs;
8. videos;
9. social media information you choose to provide;
10. websites you choose to provide;
11. business or project information; and
12. other information you choose or agree to communicate through The Stage.

You should not disclose information through your Wish or interview that you do not want communicated to the Million Wishes community or, where applicable, the public.

The use of Stage content is also governed by the Million Wishes Terms of Membership and Participation.

If you participate in The Stage and later cancel or lose your membership, content already published in connection with your Stage may remain part of the historical Million Wishes record.

This may include your interview, Wish and associated published content.

Million Wishes may retain and continue using Stage content in accordance with the rights granted under the Terms of Membership and Participation and applicable law.

Closing your membership does not automatically require Million Wishes to remove historical Stage content that has lawfully been published or that Million Wishes has a lawful basis to retain.

When you access Million Wishes, we may automatically collect technical and usage information.

This may include:

1. IP address;
2. browser type;
3. device type;
4. operating system;
5. device identifiers where available;
6. approximate geographic location derived from IP or similar technical information;
7. language settings;
8. referring pages or URLs;
9. pages or features accessed;
10. Gift-link activity;
11. login activity;
12. session information;
13. timestamps;
14. cookie and similar technology identifiers;
15. security events;
16. error and diagnostic information;
17. fraud and risk signals; and
18. information about how you interact with Million Wishes.

We may use this information for operation, security, analytics, fraud prevention, sanctions compliance, product improvement, marketing and other purposes described in this Privacy Policy.

Million Wishes may determine or receive approximate location information based on your IP address, device, payment information or other technical information.

This may be used to:

1. determine jurisdictional requirements;
2. identify restricted countries or territories;
3. comply with sanctions;
4. prevent fraud;
5. improve security;
6. determine applicable taxes or payment requirements;
7. provide appropriate platform functionality; and
8. understand the geographic distribution of the Million Wishes community.

Million Wishes does not require ordinary members to publicly display their location.

Million Wishes may use cookies, pixels, local storage, tags, software development tools and similar technologies.

These technologies may be used to:

1. keep members signed in;
2. maintain sessions;
3. remember settings;
4. secure accounts;
5. detect fraud;
6. measure website and platform performance;
7. understand how people use Million Wishes;
8. analyse Gift activity and membership growth;
9. measure advertising effectiveness;
10. provide or measure marketing campaigns;
11. perform attribution; and
12. improve Million Wishes.

Where required by applicable law, Million Wishes will provide appropriate choices or obtain consent before using non-essential cookies or similar technologies.

Million Wishes may use analytics, advertising and measurement providers, which may include services such as Google Analytics, Meta technologies, TikTok technologies or similar providers.

These providers may process information such as:

1. IP addresses;
2. device information;
3. browser information;
4. cookie or advertising identifiers;
5. website activity;
6. referral information;
7. conversion events; and
8. interactions with Million Wishes advertising.

Million Wishes may use this information to understand performance, measure campaigns, reach relevant audiences and improve its marketing.

The specific providers used may change over time.

Where applicable law requires consent or provides a right to opt out of particular advertising-related processing, Million Wishes will provide the required mechanism.

Million Wishes does not sell members' personal information to third parties for monetary payment.

Certain privacy laws may define terms such as “sale,” “sharing” or “targeted advertising” more broadly than an ordinary sale of personal information.

For example, the use of advertising or analytics technologies may constitute “sharing” or another regulated activity in certain jurisdictions.

Where applicable law gives you rights concerning these activities, Million Wishes will provide those rights as required by law.

Million Wishes may use personal information to:

1. create and administer accounts;
2. verify age and eligibility;
3. process and verify Membership Fee payments;
4. activate membership places;
5. administer Gifts;
6. maintain Gift relationships;
7. determine membership availability;
8. administer participation requirements;
9. maintain Support history;
10. conduct Stage selection;
11. notify selected members;
12. verify selected members;
13. produce and publish The Stage;
14. administer Wishes;
15. process financial Support;
16. make payouts;
17. process refunds, reversals and chargebacks;
18. prevent fraud and abuse;
19. comply with sanctions and financial restrictions;
20. secure accounts and systems;
21. investigate suspicious activity;
22. enforce the Terms of Membership and Participation;
23. provide member support;
24. communicate with members;
25. improve Million Wishes;
26. conduct analytics and research;
27. measure marketing;
28. promote Million Wishes;
29. comply with legal, tax, accounting and regulatory requirements;
30. resolve disputes;
31. protect Million Wishes, its members and third parties; and
32. establish, exercise or defend legal rights.

Privacy laws in some jurisdictions require Million Wishes to identify a legal basis for processing personal information.

Depending on the circumstances and applicable law, Million Wishes may process personal information because:

1. processing is necessary to provide your membership and perform our agreement with you;
2. you have provided consent;
3. processing is necessary to comply with a legal obligation;
4. processing is necessary for legitimate interests pursued by Million Wishes or another person, where those interests are not overridden by applicable privacy rights;
5. processing is necessary to protect against fraud, security threats or misuse;
6. processing is necessary to establish, exercise or defend legal rights; or
7. another lawful basis applies.

Where processing depends on consent and applicable law gives you the right to withdraw that consent, you may do so subject to the consequences of withdrawing consent from functionality that requires the relevant information.

Million Wishes may communicate with members using email, SMS, in-platform messages, push notifications where available, or other contact methods provided by the member.

Communications may include:

1. membership information;
2. payment confirmations;
3. security alerts;
4. account notices;
5. Gift activity;
6. Million Wishes milestones;
7. Stage announcements;
8. participation reminders;
9. notification that you have been selected for The Stage;
10. Wish and Support information;
11. changes to Million Wishes;
12. changes to legal terms or policies;
13. support communications; and
14. other operational messages.

Certain communications are essential to providing and administering your membership and may continue while your account remains active.

Million Wishes may send promotional communications concerning:

1. Million Wishes;
2. new features;
3. events;
4. partnerships;
5. merchandise;
6. campaigns;
7. member initiatives;
8. Stage content; and
9. other Million Wishes offerings.

Where required by law, promotional electronic communications will include an appropriate unsubscribe or opt-out mechanism.

Opting out of promotional marketing does not prevent Million Wishes from sending essential membership, security, legal, transactional or service communications.

Million Wishes provides member support through the support chatbot within authenticated member accounts.

The support service is human-operated.

When you communicate with member support, Million Wishes may collect and retain:

1. your messages;
2. account information relevant to your request;
3. transaction information;
4. technical information;
5. attachments or information you voluntarily provide;
6. internal support notes;
7. actions taken in response to your request; and
8. the history of the support interaction.

Support communications may be retained for customer service, account administration, security, fraud prevention, dispute resolution, legal compliance, training and improvement of member support.

Million Wishes uses third-party technology and infrastructure providers to operate the platform.

At the date of this Privacy Policy, these include:

1. Vercel, which provides hosting and computing infrastructure for the Million Wishes application, including frontend functionality, server actions and API routes.
2. Supabase, which provides database, authentication and related infrastructure used to store and process information including member records, authentication information, Gifts and support information.
3. Supabase infrastructure may rely on cloud infrastructure providers including Amazon Web Services (AWS).
4. Stripe, which currently processes Membership Fee payments and associated payment information.

These providers may process information in the United States and other countries.

Million Wishes may change, replace or add technology, infrastructure, payment, verification, analytics, communications or other service providers as the platform develops.

Million Wishes may disclose personal information to service providers where reasonably necessary to operate the service.

These may include:

1. cloud hosting providers;
2. database providers;
3. authentication providers;
4. payment processors;
5. banks and financial institutions;
6. identity-verification providers;
7. fraud-prevention providers;
8. sanctions and compliance providers;
9. communications providers;
10. analytics providers;
11. advertising and marketing providers;
12. security providers;
13. professional advisers;
14. contractors; and
15. other providers necessary to operate Million Wishes.

Service providers may process personal information only for purposes associated with the services they provide or as otherwise permitted by applicable law and their applicable terms.

Million Wishes is intended to operate globally.

Personal information may therefore be collected, transferred, stored or processed outside the country in which you live.

This may include processing in Australia, the United States and other countries in which Million Wishes or its service providers operate.

Privacy and data-protection laws may differ between countries.

Where applicable law requires particular safeguards for international transfers of personal information, Million Wishes will take steps reasonably necessary to implement those safeguards.

Million Wishes may disclose personal information where reasonably necessary or legally required in connection with:

1. laws or regulations;
2. court orders;
3. subpoenas or other lawful compulsory processes;
4. regulatory investigations;
5. law-enforcement requests;
6. tax requirements;
7. sanctions obligations;
8. fraud investigations;
9. payment disputes;
10. the prevention or investigation of criminal activity;
11. protection of the safety or rights of members or other people; or
12. establishment, exercise or defence of legal claims.

Million Wishes may challenge or limit a request where appropriate and legally permitted.

If Million Wishes, its business, assets or operator is involved in a proposed or completed:

1. sale;
2. acquisition;
3. merger;
4. investment;
5. financing;
6. restructuring;
7. reorganisation;
8. insolvency process; or
9. transfer of business or assets,

personal information may be disclosed to or transferred to relevant prospective or actual purchasers, investors, advisers, financiers, counterparties or successor entities where lawful and reasonably necessary.

Any successor may continue processing information in accordance with applicable law and the privacy commitments that apply following the transaction.

Million Wishes is operated by Oakley Equity Holdings Pty Ltd (ABN 39 691 699 117), an Australian company.

References in this Privacy Policy to “Million Wishes”, “we”, “us” or “our” refer to Oakley Equity Holdings Pty Ltd where the context requires.

Oakley Equity Holdings Pty Ltd is responsible for the operation of Million Wishes and the handling of personal information under this Privacy Policy, subject to the roles and responsibilities of third-party service providers and applicable law.

Million Wishes takes reasonable technical, organisational and administrative measures designed to protect personal information against:

1. unauthorised access;
2. misuse;
3. interference;
4. loss;
5. alteration;
6. unauthorised disclosure; and
7. destruction.

These measures may include authentication controls, access restrictions, secure infrastructure, encrypted communications, monitoring, logging, payment-provider security controls and other appropriate safeguards.

No online system or method of electronic storage is completely secure. Million Wishes therefore cannot guarantee absolute security.

Members are responsible for protecting their account credentials and should not share their password with another person.

If Million Wishes becomes aware of a data breach involving personal information, it may investigate the incident, take steps to contain or remediate it, and notify affected individuals, regulators or other parties where required by applicable law.

Million Wishes may also work with service providers, security specialists, law enforcement or other appropriate parties when responding to a security incident.

Million Wishes retains personal information for as long as reasonably necessary for the purposes for which it was collected and for legitimate operational, legal and compliance purposes.

Different categories of information may be retained for different periods.

Relevant considerations may include:

1. whether your membership remains active;
2. the historical integrity of the Million Wishes membership structure;
3. Gift relationships;
4. Stage records;
5. payment records;
6. tax and accounting obligations;
7. fraud prevention;
8. chargeback and dispute periods;
9. security requirements;
10. legal limitation periods;
11. regulatory obligations;
12. sanctions requirements;
13. legal claims; and
14. the need to establish, exercise or defend legal rights.

Information that is no longer reasonably required may be deleted, de-identified or anonymised where appropriate and subject to applicable law.

If you close your membership, Million Wishes may delete or de-identify personal information that is no longer reasonably required.

Certain information may continue to be retained where reasonably necessary for:

1. legal compliance;
2. tax or accounting records;
3. payment records;
4. fraud prevention;
5. security;
6. disputes and chargebacks;
7. enforcement of the Terms;
8. sanctions compliance;
9. historical Gift relationships;
10. Stage history;
11. protection of Million Wishes or its members; or
12. other lawful purposes.

Account closure therefore does not necessarily result in the immediate deletion of every record associated with you.

Million Wishes may retain sufficient information after a membership ends to preserve the historical integrity and auditability of the Gift chain.

This may include information necessary to establish that one member gave another person the Gift through which that person joined.

Where appropriate, other information may be deleted, de-identified or restricted while the historical relationship is retained.

Because The Stage forms part of the public and historical record of Million Wishes, Stage content may be retained after a participant’s membership ends.

Where permitted by applicable law and the Terms of Membership and Participation, this may include the selected member’s:

1. name;
2. image;
3. likeness;
4. voice;
5. interview;
6. Wish; and
7. associated published materials.

This does not prevent a person from exercising privacy rights that cannot lawfully be excluded.

Million Wishes is not intended for anyone under 18.

Million Wishes does not knowingly permit people under 18 to become members.

If Million Wishes discovers that an account belongs to a person under 18, it may close the account and delete or otherwise appropriately handle the person's information, subject to information that must reasonably be retained for security, fraud prevention, payment, legal or compliance purposes.

Depending on where you live and the privacy laws that apply to you, you may have rights concerning your personal information.

These may include rights to:

1. request access to personal information;
2. request correction of inaccurate information;
3. request deletion in certain circumstances;
4. request restriction of processing;
5. object to certain processing;
6. withdraw consent where processing is based on consent;
7. receive certain information in a portable format;
8. opt out of certain marketing;
9. opt out of certain advertising-related processing;
10. complain about the handling of personal information; and
11. exercise other rights provided by applicable law.

These rights are not absolute and may be subject to legal exceptions.

For example, Million Wishes may be permitted or required to retain information despite a deletion request where the information is necessary for payment records, tax obligations, fraud prevention, legal claims, security, Stage records or other lawful purposes.

Current members may submit privacy-related requests through the member support chatbot available within their authenticated Million Wishes account.

Million Wishes may need to verify your identity before acting on a privacy request.

Million Wishes may request additional information where reasonably necessary to confirm identity, locate relevant information or understand the request.

Million Wishes will respond to valid privacy requests in accordance with applicable law.

Where applicable law requires Million Wishes to provide an additional method for a person to exercise a privacy right, make a privacy complaint or contact the operator, Million Wishes will provide such a method as required by that law.

Where Australian privacy law applies, Million Wishes will handle personal information in accordance with applicable Australian privacy requirements.

Individuals may have rights to request access to or correction of personal information and to make complaints concerning the handling of personal information.

Nothing in this Privacy Policy limits rights that cannot lawfully be excluded under applicable Australian law.

Because Million Wishes is intended to operate internationally, members in other jurisdictions may have additional privacy rights.

Where laws such as applicable European, United Kingdom, United States state, or other privacy legislation apply to Million Wishes and provide an individual with mandatory rights, Million Wishes will recognise those rights to the extent legally required.

The availability of a particular right depends on the jurisdiction, the nature of the information and the circumstances of the processing.

Where required by applicable law, Million Wishes may provide controls allowing users to manage certain advertising, analytics or cookie-related processing.

Browser settings, device settings and third-party advertising platforms may also provide privacy controls.

Disabling certain technologies may affect measurement, personalisation or aspects of the Million Wishes experience but will not ordinarily prevent an active member from accessing essential membership functionality.

Different browsers and jurisdictions use different mechanisms for communicating privacy preferences.

Where Million Wishes is legally required to recognise a particular browser-based opt-out or universal privacy signal, Million Wishes will take reasonable steps to honour that signal as required by applicable law.

Million Wishes may use automated systems for operational purposes such as fraud detection, security monitoring, sanctions screening, analytics, payment processing and technical administration.

Member customer support is currently human-operated.

Million Wishes may introduce or change technologies as the service develops. Where a future technology materially changes how personal information is processed, this Privacy Policy may be updated accordingly.

Million Wishes may update this Privacy Policy from time to time to reflect:

1. changes to Million Wishes;
2. new functionality;
3. changes to technology or service providers;
4. changes to payment systems;
5. changes to privacy laws;
6. regulatory requirements;
7. security requirements; or
8. changes to how personal information is handled.

The current version will be made available through Million Wishes.

Where required by law or reasonably appropriate because of the significance of a change, Million Wishes will notify affected members through the platform or another appropriate communication method.

The effective date at the top of this Privacy Policy identifies when the current version took effect.

This Privacy Policy should be read together with the Million Wishes Terms of Membership and Participation.

The Terms govern membership, Gifts, The Stage, Wishes, Support, payments, participation requirements and other aspects of the Million Wishes service.

This Privacy Policy governs how personal information is collected, used, disclosed, stored and otherwise handled.

If a privacy right or obligation imposed by applicable law cannot lawfully be excluded or limited, that law will prevail to the extent of any inconsistency.

Current members can contact Million Wishes through the support chatbot available within their authenticated member account.

This is the primary member support channel for privacy questions, requests concerning personal information and other account-related matters.

Million Wishes may require identity verification before discussing, disclosing, correcting or deleting personal information associated with an account.

Where applicable law requires another contact or complaint mechanism to be made available, Million Wishes will provide that mechanism as required.

By using Million Wishes, you acknowledge that you have had the opportunity to read this Privacy Policy and understand that personal information may be collected, used, stored, processed and disclosed as described in it.

Your use of Million Wishes remains subject to applicable privacy laws and the Million Wishes Terms of Membership and Participation.