Privacy Policy

1. Who is responsible for your data

For the data kindergartens enter into the platform — child and parent profiles, attendance, meals, photos, daily reports — the kindergarten is the data controller and Kinderbase acts as a data processor, processing the data solely on the kindergarten’s instructions and under the data processing agreement concluded with it.

For account data, service billing data and technical data generated by using the platform, Kinderbase acts as the data controller.

If you have questions about how your kindergarten uses your child’s data (for example, which photos it publishes or who can see them), we recommend contacting the kindergarten first.

2. What data we process

• Account data: name, e-mail address, phone number, platform role (parent, teacher, administrator), profile picture.
• Child profile: name, date of birth, group, schedule, allergies or medical notes entered by the kindergarten.
• Daily activity: attendance, meals, sleep, daily reports and other information filled in by kindergarten staff.
• Media content: photos and videos published in posts, stories or conversations, together with their captions.
• Messages: conversations held through the platform’s chat feature.
• Billing: invoices issued by the kindergarten to parents and payment status. Card details are processed exclusively by our payment processor, Stripe — Kinderbase never stores card numbers.
• Pick-up: the people authorised to pick up a child and the pick-up history.
• Technical data: device type, push notification tokens, IP address, access and error logs.

3. Purposes and legal bases

• Providing the service (accounts, the feed, attendance, menus, invoicing, chat) — performance of the contract.
• Safety features, such as managing the people authorised to pick up a child — performance of the contract and the kindergarten’s legitimate interest in keeping children safe.
• Issuing and keeping invoices — legal obligation and performance of the contract.
• Sending notifications about platform activity (new posts, messages, invoices, pick-ups) — performance of the contract; notifications can be turned off in your device settings.
• Platform security, abuse prevention and troubleshooting — legitimate interest.
• Complying with legal obligations and requests from authorities — legal obligation.

4. Children’s data

Kinderbase processes children’s data exclusively on the instructions of the kindergarten, which is responsible for obtaining parental consent where the law requires it (for example, for photos and videos).

Media content is visible only to authorised users within the kindergarten — typically the parents of children in the same group or kindergarten, according to the settings chosen by the kindergarten.

Children’s data is never used for advertising and is not subject to automated decision-making or profiling.

5. Who we share data with

We do not sell or rent personal data. Data is accessible only to:

• The kindergarten and its authorised users — parents only see information about their own children.
• Our service providers, who process data on our behalf: hosting and storage in the European Union, Stripe for payment processing, the Apple and Google push notification services and our transactional e-mail provider.
• Public authorities, where the law requires us to.

6. International transfers

Data is hosted on servers in the European Union. Certain providers (for example, push notification services) may process limited data outside the European Economic Area; in such cases we ensure appropriate safeguards are in place, such as the standard contractual clauses approved by the European Commission.

7. How long we keep data

• Account data and content remain in the platform for as long as the account is active and the contract with the kindergarten is in force.
• When a kindergarten’s contract ends, its data is deleted or anonymised within 90 days, except for data we are legally required to keep.
• Invoices and accounting documents are kept in accordance with Romanian fiscal legislation.
• Technical logs are kept for short periods, as needed for security and diagnostics.

8. How we protect data

We use appropriate technical and organisational measures: encryption of data in transit, secure authentication, role-based permissions (each user only sees what is intended for them), private storage for sensitive documents and regular backups. Our team’s access to data is limited to what is strictly necessary to operate and maintain the platform.

9. Your rights

Under the GDPR you have the right to access your data, and the rights to rectification, erasure, restriction of processing, data portability, objection, and to withdraw your consent where processing is based on it.

To exercise these rights, contact your kindergarten (for data it manages) or write to us at [email protected]. We respond within 30 days.

You also have the right to lodge a complaint with the Romanian supervisory authority, ANSPDCP — dataprotection.ro — or with your local data protection authority.

10. Cookies and similar technologies

The web app uses only cookies and local storage that are strictly necessary for authentication and for remembering your preferences (such as language and theme). We do not use advertising or cross-site tracking cookies. The mobile apps use the device’s secure storage for the same purposes.

11. Changes to this policy

We may update this policy from time to time. The current version is always published on this page, and we will notify users through the platform of any significant changes. The date of the latest update is shown at the top of the page.

12. Contact

For any questions about data protection, write to us at [email protected].