1. Who is responsible for what
- The child care centre decides why and how the information about its children, parents and staff is used. For that information the child care centre is the controller (in Canada, the organization responsible) and Daybase is its processor (service provider): we handle it only on the child care centre's instructions, to provide the Service.
- Daybase is the controller of the information we keep about the people who sign up and sign in for a child care centre (account, billing and security records), about visitors to our own pages, and about people who contact us.
Parents and carers who want to see, correct or delete their child's information should ask the child care centre first. We help the child care centre answer.
2. What we handle
- Account details: name, email address, a hashed password, passkeys, two-step sign-in settings, sign-in times and network addresses.
- Billing details: plan, invoices and payments between Daybase and the child care centre. Card numbers are handled by our payment provider and never stored by us.
- Child care centre records, on the child care centre's behalf: children, parents and carers, emergency contacts, health and dietary notes, attendance, daily reports, photos and videos, messages, invoices and payments, staff, and the compliance records a child care centre keeps (for example CWELCC fees, wages and closures in Canada).
- Sign-up requests: the details given when a child care centre asks to join, including country, province and Region, and which version of our terms was accepted and when.
- Website and contact: messages you send us and, on our public website, basic usage figures.
- Technical records: security and audit logs that show who changed what and when.
3. Why we use it
To provide and secure the Service, to bill for it, to give support, to meet legal duties and to improve the Service. Where the law requires a legal basis, it is the contract with the child care centre, our legitimate interest in running a secure service, consent where we ask for it, or a legal duty. Child care centre records are used only as the child care centre instructs. We do not sell personal information, we do not show advertising inside the Service, and we do not use child care centre records to train artificial intelligence models.
4. Where and how it is kept
Each child care centre's records are kept in a separate database. Production data is hosted with our hosting provider (the country is available on request). Secrets such as API keys are stored encrypted. Connections use encryption in transit. Access is limited to people who need it and is recorded. Sign-in can be protected with two-step verification and passkeys, and a child care centre can limit access to chosen network addresses. Backups are encrypted and kept for a limited time.
5. Who we share it with
We use service providers to run the Service and share only what they need. The list below is kept current in the Data Processing Addendum, with a notice period for changes.
- payment providers, to take card payments;
- email delivery providers, to send messages such as invitations and receipts;
- push notification services, to deliver phone notifications, if the child care centre uses the apps;
- accounting software, only if the child care centre connects it, and only the invoices and payments the child care centre chooses to send;
- hosting, network and infrastructure providers.
We may also disclose information when the law requires it, and we tell the child care centre when we are allowed to.
6. How long we keep it
Child care centre records are kept while the child care centre uses the Service. When a child care centre is deleted, its data is removed after a grace period of 14 days, and from backups as they expire. Account, billing and security records are kept as long as needed for the purposes above and for legal and accounting duties, then deleted or made anonymous.
7. Children's information
Information about children is entered by the child care centre, which is responsible for having the parents' consent where it is needed (for example for photos). We use it only to provide the Service to that child care centre. The Service is not directed to children, and children do not hold accounts.
8. Security incidents
If we confirm an incident that affects personal information, we tell the child care centre without undue delay and within 72 hours, with what happened, what information is involved and what we are doing. The child care centre decides whether and how to notify families and regulators, and we help with that.
9. Your rights
You can ask for access to, correction of, deletion of or a copy of your personal information, and you can object to or limit some uses, as the law where you live allows. Write to [email protected], and we answer within 30 days. If you are not satisfied, you can complain to your data protection authority.
10. Cookies
We use only the cookies the Service needs to work: to keep you signed in, to protect forms against forgery, to remember your language and, if you ask, to remember you on this device. We do not use advertising cookies in the Service.
11. International transfers
Some of our providers may handle information outside your country. When that happens we use contracts and safeguards that give it the protection the law requires, and the section for your country below says more.
12. Changes
We update this policy when our practices change and show the version and date at the top. We tell child care centres about important changes by email.
13. Contact
The person responsible for privacy at Daybase can be reached at [email protected].