1. Purpose and scope
This document explains how Budgii PTY LTD (“budgii”, “we”, “us”) obtains and records the consent required to collect and process personal information about children within a household using the budgii app, and the ongoing responsibilities of the parent or guardian who provides that consent.
It applies in every jurisdiction where budgii operates, including Australia, New Zealand, the United Kingdom, and the United States. Where a jurisdiction imposes specific additional requirements, those requirements are set out in Section 3.
2. Definitions
| Term | Meaning |
|---|---|
| Child | A person under the age of 18, unless a lower age of majority applies in the relevant jurisdiction. |
| Parent | A biological, adoptive, or legal parent of a Child, or a person with parental responsibility or legal guardianship for that Child under the laws of the jurisdiction in which they reside. |
| Parental Consent | Verifiable agreement given by a Parent to the collection and processing of a Child's personal information by budgii in accordance with our Privacy Policy and this document. |
| Verifiable Consent | Consent obtained using a method reasonably calculated, in light of available technology, to ensure that the person giving the consent is the Child's Parent. The specific method used is described in Section 8. |
| COPPA | The United States Children's Online Privacy Protection Act of 1998 and its implementing regulations (16 CFR Part 312), applicable to Children under 13 in the US. |
| UK GDPR | The UK General Data Protection Regulation and the Data Protection Act 2018, including the Information Commissioner's Office's Age Appropriate Design Code. |
3. Legal basis by jurisdiction
3.1 United States (COPPA)
Under COPPA, budgii obtains verifiable Parental Consent before collecting personal information from Children under 13 in the United States. We rely on Parental Consent as the legal basis under 16 CFR § 312.5.
For Children aged 13 to 17 in the US, Parental Consent is not required by COPPA, but we continue to obtain it where the Child is added to a household by a Parent, because a household account structure requires Parental administration by design.
3.2 United Kingdom (UK GDPR)
Under UK GDPR Article 8, in relation to information society services offered directly to a Child, processing is lawful where the Child is at least 13 years old. For Children under 13, we rely on Parental Consent authorised by a person with parental responsibility.
budgii is designed in accordance with the Information Commissioner’s Office Age Appropriate Design Code, and the default position is that all Children are added to a household account by a Parent, regardless of age. Our Best Interests of the Child Assessment is published at budgii.io/legal/bica.
3.3 Australia (Privacy Act 1988)
Under Australian Privacy Principle 3, we collect personal information about Children only by lawful and fair means. Where the Child is under 15, we generally treat the Parent as the appropriate person to provide consent on the Child’s behalf. Where the Child is aged 15 to 17, consent may be given by either the Child or the Parent depending on the Child’s capacity to understand the nature and consequences of the consent, consistent with the Office of the Australian Information Commissioner’s guidance.
3.4 New Zealand (Privacy Act 2020)
Under Information Privacy Principle 4 of the New Zealand Privacy Act 2020, we collect personal information only by lawful and fair means. Where the Child is under 16, we treat the Parent as the appropriate person to provide consent. Where the Child is aged 16 or 17, consent may be provided by the Child where they have the capacity to understand the nature and consequences of the consent, as guided by the Office of the Privacy Commissioner.
3.5 Other jurisdictions
Where a user accesses budgii from a jurisdiction outside those listed above, we apply the higher of (i) the applicable local legal standard and (ii) the standards set out in this document.
4. Who can give consent
A Parent, for the purposes of this document, is any of:
- A biological or adoptive parent of the Child.
- A person with parental responsibility under the laws of the jurisdiction where the Child resides (including, in Australia, under the Family Law Act 1975).
- A legal guardian appointed by a court.
- A grandparent, kin carer, or other adult who has day-to-day care of the Child and has been authorised by a Parent or guardian to administer the household within budgii.
Only one Parent needs to provide initial Parental Consent to begin using budgii. Where two Parents are added to the same household as adult leaders, both Parents are treated as having provided consent by continuing to use the service, and either can exercise rights on the Child’s behalf.
5. What consent covers
Parental Consent, once given, covers:
- Creation of a profile for the Child, including first name or nickname, age or age bracket, and chosen avatar.
- Collection of activity data generated by the Child's use of the app: to-do completions, Coins earned and spent, Chain streaks, level progression, app open days, and reward claims.
- Generation of a monthly Nest Report for each Child based on the activity data above, delivered to the Parent and described further at our AI Transparency Notice.
- Display of the Child's in-app activity to the adult leaders of the household.
- Storage of this information on our servers, subject to our Privacy Policy, Data Retention & Deletion Policy, and security measures described in our Data Protection Impact Assessment summary.
Parental Consent does not cover, and we do not engage in:
- Sale of personal information about Children to any third party.
- Use of personal information about Children for targeted advertising.
- Sharing of personal information about Children with third parties for their own marketing purposes.
- Collection of precise geolocation information from a Child's device.
- Collection of biometric information, voice recordings, or facial recognition data.
- Any processing of Children's data to train general-purpose artificial intelligence models.
6. How we collect consent
Parental Consent is collected at the point a Parent:
- Creates a budgii account using a valid email address.
- Accepts the Terms of Service, Privacy Policy, and this Parental Consent & Responsibility document during onboarding.
- Adds a Child to the household, at which point a specific Child-related consent prompt is presented and must be affirmatively acknowledged before the Child's profile is created.
The consent process is designed to meet or exceed the standards set out in 16 CFR § 312.5(b) for COPPA verifiability, UK GDPR Article 7, and APP 3.
7. Age thresholds
Age-related consent thresholds by jurisdiction:
| Term | Meaning |
|---|---|
| United States (COPPA) | Parental Consent required for Children under 13. For Children 13-17, budgii requires an adult account holder but COPPA does not mandate verifiable consent. |
| United Kingdom (UK GDPR) | Parental Consent required for Children under 13. For Children 13 and older, the Child may consent, but budgii is offered to households with an adult administrator in all cases. |
| Australia | No statutory age threshold. APP 3 applied with OAIC guidance: Parent typically consents for Children under 15; capacity-based for 15-17. |
| New Zealand | No statutory age threshold. Privacy Act 2020 and OPC guidance: Parent typically consents for Children under 16; capacity-based for 16-17. |
Regardless of the statutory threshold, budgii’s architecture requires an adult leader to administer the household. A Child cannot create a standalone account.
8. Verifying parental identity
For US users subject to COPPA, budgii uses the following COPPA- approved verifiable consent methods, selected based on the sensitivity of the information collected:
- Email Plus: the Parent provides email consent, followed by a confirmation step (either an email link, a callback, or a secondary confirmation after a short delay) to confirm the consent originated from the Parent. This method is used because budgii does not disclose Children's personal information to third parties beyond its sub-processors.
- Payment method verification: for Parents who upgrade to a paid subscription, the use of a credit or debit card in the Parent's name at account upgrade provides additional verification of adult identity.
For users in the UK, EU, Australia, and New Zealand, we rely on Email Plus verification combined with the affirmative acceptance described in Section 6.
We do not use knowledge-based authentication (e.g. questions about credit history) or government ID upload, because these methods create greater privacy risk than the consent they verify.
9. How consent is recorded
For each Parent who provides Parental Consent, we retain:
- A timestamp of the consent action.
- The version of this document, the Privacy Policy, and the Terms of Service that were in effect at the time.
- The Parent's email address at the time of consent.
- The IP address from which the consent was given, for a limited period for security purposes only.
- The specific Children covered by the consent.
Consent records are retained for the lifetime of the account plus the period set out in our Data Retention & Deletion Policy, and are made available to the Parent on request.
10. Withdrawing consent
A Parent can withdraw consent at any time, using any of the following methods:
- Removing a Child from the household from within Admin settings.
- Deleting the account, which removes all Children and their data.
- Emailing legal@budgii.io with a request to withdraw consent.
Withdrawal is effective immediately on receipt. Once consent is withdrawn, budgii will cease processing the Child’s personal information and will delete it in accordance with the Data Retention & Deletion Policy, subject only to retention required by law (for example, for accounting records or legal claims).
Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
11. Parental responsibility
When a Parent accepts this document and uses budgii, they agree to:
- Act at all times in the best interests of the Child.
- Supervise the Child's use of budgii in a manner appropriate to the Child's age and maturity.
- Keep their login credentials secure and not share them with anyone other than other adult leaders of the same household.
- Provide accurate information about the Child, including age, for the purpose of calibrating the Child-facing experience to an appropriate developmental level.
- Review Nest Reports, which are intended as supportive observations rather than clinical or diagnostic material, and seek qualified professional advice if any concern about the Child's wellbeing arises.
- Notify budgii promptly if they believe the account has been accessed without authorisation, or if they cease to be a person with parental responsibility for any Child on the account.
12. Disputes between parents
Where two adults are added to the same household as adult leaders, budgii treats both as having equal authority to administer the account and the Children within it. In the event of a dispute between them concerning the Child’s use of budgii, the withdrawal of consent, or the content of a Nest Report:
- Either Parent may withdraw consent in respect of a Child. budgii will act on the first such request received.
- budgii does not act as an arbiter between Parents and will not take sides in family law, custody, or parenting disputes.
- Where a court order regulates the care of a Child and is provided to budgii, we will use reasonable endeavours to comply with the order in relation to access to and processing of the Child's data.
- Where necessary, budgii may suspend an account pending clarification of consent in order to protect the Child's interests.
13. Contact
Questions about Parental Consent, requests to withdraw consent, and disputes should be directed to:
Budgii PTY LTD
ABN 50 696 945 169 | ACN 696 945 169
Sydney, New South Wales, Australia