Privacy Policy

1. Who we are

Baldomero Castilla operates 50 Million Messages. Privacy contact: founder@50millionmessages.com. Business address: 2 14 Zenith Avenue, Chermside.

2. Information collected during ordinary use

We may collect your private email address, public nickname, public message, selected country, optional public city or region, permanent message number, payment and order identifiers, transaction status, versions of the Terms, Competition Rules and Privacy Policy accepted, voting activity, support communications, abuse reports, fraud and security signals, device or network information and technical logs. Payment credentials are handled by the payment provider; we do not intentionally store full card numbers or card security codes.

3. Public information

Your public nickname, message, selected country, optional public city or region, permanent message number and public vote count are intended to be public. Do not place private, confidential or sensitive personal information in fields intended for public display.

4. Potential-winner verification information

If your message becomes a potential prize winner, we may request additional private information reasonably necessary to verify and lawfully pay the prize. This may include your legal name, date of birth, proof of identity, proof of residence, eligibility information, tax information, sanctions or compliance information, payment details required to transfer the prize, and signed eligibility or conflict-of-interest declarations. This information is not collected from every participant merely because they purchase a message.

5. Why we collect and use information

We use information to provide the purchased publication service, process and reconcile payments, allocate permanent message numbers, display public location metadata, issue and validate voting entitlements, operate the competition, prevent fraud and abuse, moderate content, answer support requests, send transactional communications, comply with legal and regulatory duties, protect system integrity, conduct final result audits and verify and pay a lawful winner.

6. Competition integrity and separation of identity

The ranking mechanism uses the authoritative competition records and the published ranking rules. A participant's private legal identity is not an input into the ranking algorithm. Private identity information may later be used to verify the person associated with an audited candidate message.

7. Current service providers

Core production providers currently include: Cloudflare (hosting, CDN, security and Turnstile); Supabase (database and admin authentication); PayPal (payment processing); Resend (transactional email). These providers process information only to the extent relevant to the services they provide, subject to their applicable terms, privacy notices and data protection arrangements.

8. Independent auditor and professional advisers

Information reasonably necessary to verify the final result or potential winner may be disclosed to an independent auditor, scrutineer, lawyer, accountant, tax adviser, bank or payment institution and, if used, a specialist identity or compliance verification provider. We intend to minimise the information shared to what is reasonably necessary for the relevant verification purpose.

9. Overseas processing and disclosures

Personal information may be processed or disclosed outside Australia by our service providers and their subprocessors. This may include the United States and other jurisdictions in which those providers or subprocessors operate. Where applicable, we take steps required by Australian privacy law and other applicable privacy laws in connection with overseas disclosures.

10. Winner declarations and cryptographic evidence

Private winner-verification documents and declarations are not intended for public publication. We may retain a cryptographic SHA-256 hash, document reference, verification timestamp or audit reference so that the existence and integrity of an evidence document can later be established without publishing the private document itself.

11. Public result and prize proof

If a prize is lawfully paid, we may publish the winning public message, permanent message number, final valid vote count, audit status, audit manifest hash, auditor or audit-organisation details, verification status, prize-payment date and appropriately redacted evidence that payment occurred. We do not intend to publish passport numbers, complete bank account numbers, identity documents, private home addresses or other sensitive verification records.

12. Retention

Permanent message numbers and records necessary to preserve archive and competition integrity may be retained for a long period. Payment, tax, fraud, dispute, moderation, audit, winner-verification, support and legal records are retained for periods reasonably required for operational, evidentiary and legal purposes. Information no longer required is deleted, de-identified or securely archived where appropriate and legally permitted.

13. Security

We use HTTPS, restricted server-side secrets, database permissions and row-level security, application-layer encryption for selected private values, provider webhook verification, bot protection, access controls, logging and backup or recovery controls where enabled. No internet service can guarantee absolute security.

14. Access and correction

You may request access to or correction of personal information we hold about you by contacting founder@50millionmessages.com. We may verify your identity before acting on a request. Public archive integrity may affect how a public historical record can be altered where law permits, but it does not remove privacy rights that apply to you.

15. Privacy complaints

Send privacy complaints to founder@50millionmessages.com. We will investigate and respond within a reasonable period. Where applicable, you may also have the right to complain to the Office of the Australian Information Commissioner or another competent privacy regulator.

16. Automated security and eligibility controls

Automated rules may be used to detect payment anomalies, abusive behaviour, bots, duplicate activity or other security and eligibility issues. A material final prize disqualification is intended to be subject to human review before a final prize decision, where reasonably practicable and as required by applicable law.

17. Children

Paid participation and competition participation are restricted to adults aged 18 or older.

18. Marketing and cookies

Non-essential advertising or analytics cookies are not required for the current core service. If non-essential analytics, advertising or marketing technologies are introduced, we will update the relevant disclosures and deploy consent controls where required.

19. Changes

We keep this Policy under review as providers, data practices and legal obligations change. Material changes affecting existing participant rights will be handled in accordance with applicable law.