Privacy Policy

At CentreCareOS, we understand that you are entrusting us with sensitive information about children, families, and your childcare business. This Privacy Policy explains how we collect, use, protect, and share your information when you use our childcare management platform.

1. Information We Collect

1.1 Account Information

When you create an account, we collect:

• Childcare center name and address
• Contact information (name, email, phone number)
• Billing information (processed securely through Stripe)
• Business identification numbers (EIN, business registration)
• Country of operation

1.2 Child and Family Information

To provide our services, childcare centers may enter:

• Children's names, dates of birth, and photos
• Parent/guardian names and contact information
• Emergency contact information
• Medical information, allergies, and special needs
• Authorized pickup persons
• Attendance records and daily activity logs

1.3 Staff Information

Childcare centers may enter staff information including:

• Employee names, contact information, and photos
• Work schedules and time records
• Qualifications and training records
• Room/classroom assignments

1.4 Usage Information

We automatically collect:

• Device information (browser type, operating system)
• IP address and general location
• Pages visited and features used
• Date and time of access

2. How We Use Your Information

We use the information we collect to:

• Provide the Service: Enable attendance tracking, billing, communication, and all platform features
• Process Payments: Facilitate subscription billing and parent payment processing
• Communicate: Send service updates, support responses, and important notifications
• Improve the Service: Analyze usage patterns to enhance features and user experience
• Ensure Security: Detect and prevent fraud, abuse, and unauthorized access
• Comply with Laws: Meet legal obligations and respond to lawful requests

3. Information Sharing

3.1 We Do NOT Sell Your Data

We do not sell, rent, or trade your personal information or the information of children in your care to third parties for marketing or advertising purposes. Period.

3.2 Service Providers

We share information with trusted service providers who help us operate the Service:

• Stripe: Payment processing (PCI-DSS compliant)
• Vercel: Cloud hosting and infrastructure
• Neon: Database hosting (encrypted at rest)
• Resend: Email delivery

These providers are contractually bound to protect your information and use it only to provide services to us.

3.3 Legal Requirements

We may disclose information if required by law, court order, or government request, or to protect the rights, safety, or property of CentreCareOS, our users, or others.

3.4 With Your Consent

We may share information with your explicit consent, such as when childcare centers share daily reports or photos with parents through the platform.

4. Data Security

We implement comprehensive security measures to protect your information:

• Encryption: All data is encrypted in transit (TLS 1.3) and at rest (AES-256)
• Access Controls: Role-based permissions ensure users only access authorized data
• Secure Infrastructure: Hosted on SOC 2 compliant cloud infrastructure
• Password Security: Passwords are hashed using bcrypt with salt
• Session Management: Secure, HTTP-only cookies with automatic expiration
• Regular Audits: Periodic security assessments and vulnerability testing

5. Children's Privacy

CentreCareOS takes children's privacy extremely seriously. We comply with the Children's Online Privacy Protection Act (COPPA) and similar regulations in other jurisdictions.

• Children's information is collected and managed by childcare centers, not directly from children
• Parents can view, update, or request deletion of their child's information through their childcare center
• Children's photos and information are only shared with authorized parents/guardians and staff
• We do not use children's information for advertising or marketing purposes

6. Data Retention

We retain your information for as long as your account is active or as needed to provide services:

• Active Accounts: Data is retained while your subscription is active
• After Cancellation: You have 30 days to export your data after account closure
• Permanent Deletion: Data is permanently deleted 30 days after account closure
• Legal Requirements: Some data may be retained longer if required by law

7. Your Rights

Depending on your location, you may have the following rights:

• Access: Request a copy of your personal information
• Correction: Update or correct inaccurate information
• Deletion: Request deletion of your personal information
• Export: Export your data in a portable format
• Opt-out: Unsubscribe from marketing communications

To exercise these rights, contact us at privacy@centrecareos.com or use the data export features in your account settings.

8. International Data Transfers

CentreCareOS is based in the United States. If you access the Service from outside the United States, your information will be transferred to and processed in the United States, where data protection laws may differ from those in your country.

For users in the European Economic Area (EEA), United Kingdom, or other regions with data transfer restrictions, we implement appropriate safeguards for international data transfers, including Standard Contractual Clauses approved by the European Commission.

9. Cookies and Tracking

We use cookies and similar technologies to:

• Essential Cookies: Required for the Service to function (authentication, security)
• Analytics: Understand how users interact with the Service (Vercel Analytics)

We do not use advertising cookies or third-party tracking for marketing purposes.

10. Third-Party Links

The Service may contain links to third-party websites or services. We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies before providing any personal information.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or through a notice on the Service. Your continued use of the Service after such notice constitutes acceptance of the updated policy.

12. Contact Us

If you have questions or concerns about this Privacy Policy or our data practices, please contact us:

13. Specific Regional Provisions

California Residents (CCPA)

California residents have additional rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information is collected, the right to delete personal information, and the right to opt-out of the sale of personal information. As stated above, we do not sell personal information.

European Economic Area (GDPR)

If you are in the EEA, our legal basis for processing your information includes: performance of our contract with you, compliance with legal obligations, and our legitimate interests in operating and improving the Service. You have the right to lodge a complaint with your local supervisory authority.