Legal documents Privacy Policy

1. Who is responsible for your data

For the data kindergartens enter into the platform — child and parent profiles, attendance, meals, photos, daily reports — the kindergarten is the data controller and Kinderbase acts as a data processor, processing the data solely on the kindergarten’s instructions and under the data processing agreement concluded with it.

For account data, service billing data and technical data generated by using the platform, Kinderbase acts as the data controller.

If you have questions about how your kindergarten uses your child’s data (for example, which photos it publishes or who can see them), we recommend contacting the kindergarten first.

2. What data we process

• Account data: name, e-mail address, phone number, platform role (parent, teacher, administrator), profile picture.
• Child profile: name, date of birth, group, schedule, allergies or medical notes entered by the kindergarten.
• Daily activity: attendance, meals, sleep, daily reports and other information filled in by kindergarten staff.
• Media content: photos and videos published in posts, stories or conversations, together with their captions.
• Messages: conversations held through the platform’s chat feature.
• Billing: invoices issued by the kindergarten to parents and their payment status. If the kindergarten connects its own Stripe account (optional), parents can pay invoices by card in the app: card details are processed by Stripe and are not stored by Kinderbase, and the payment goes to the kindergarten’s account. Automated subscription collection is not available during the pilot.
• Pick-up: the people authorised to pick up a child and the pick-up history.
• Technical data: device type, push notification tokens, IP address, access logs, error reports and platform response times.
• Usage statistics: the screens opened and actions taken in the app, without the content of posts or messages — only with your consent.
• Visits to the kinderbase.ro website: pages viewed and clicks on the main buttons, measured in aggregate, without cookies or personal identifiers.

3. Purposes and legal bases

• Providing the service (accounts, the feed, attendance, menus, invoicing, chat) — performance of the contract.
• Safety features, such as managing the people authorised to pick up a child — performance of the contract and the kindergarten’s legitimate interest in keeping children safe.
• Issuing and keeping invoices — legal obligation and performance of the contract.
• Sending notifications about platform activity (new posts, messages, invoices, pick-ups) — performance of the contract; notifications can be turned off in your device settings.
• Platform security, abuse prevention and troubleshooting (including error reports and response times) — legitimate interest.
• App usage statistics, to understand which features are used and improve the platform — your consent, which you can withdraw at any time.
• Aggregate visit statistics for the kinderbase.ro website — legitimate interest.
• Complying with legal obligations and requests from authorities — legal obligation.

4. Children’s data

Kinderbase processes children’s data exclusively on the instructions of the kindergarten, which is responsible for obtaining parental consent where the law requires it (for example, for photos and videos).

Media content is visible only to authorised users within the kindergarten — typically the parents of children in the same group or kindergarten, according to the settings chosen by the kindergarten.

Allergies and medical notes are health data, a special category of data (GDPR Art. 9). The kindergarten enters them to protect the child’s health and safety; we protect them with the same measures as all other data and never use them for any other purpose.

Children’s data is never used for advertising and is not subject to automated decision-making or profiling.

5. Who we share data with

We do not sell or rent personal data. Data is accessible only to:

• The kindergarten and its authorised users — parents only see information about their own children.
• Our service providers, who process data on our behalf: hosting and storage in the European Union, the Apple and Google push notification services and our transactional e-mail provider.
• Stripe, only if the kindergarten connects its own Stripe account for online invoice payment: Stripe processes the payment and card details, and the payment goes to the kindergarten’s account.
• Google Gemini, only when an authorised user starts the AI feature: text and up to five selected photos are transmitted to generate a draft. The kindergarten decides whether this feature may be used and must have a lawful basis for the submitted content.
• GIPHY and Unsplash when a user searches for GIFs or images; these providers may receive the search term and technical data such as the IP address.
• Plausible Analytics (Plausible Insights OÜ, Estonia, EU), for aggregate statistics of the kinderbase.ro website; it uses no cookies and does not store IP addresses.
• Public authorities, where the law requires us to.

6. International transfers

Data is hosted on servers in the European Union. Certain providers (for example, push notification services) may process limited data outside the European Economic Area; in such cases we ensure appropriate safeguards are in place, such as the standard contractual clauses approved by the European Commission.

Using Google Gemini, GIPHY or Unsplash may involve international transfers under the relevant provider safeguards and policies. The AI feature is optional and displays a notice before first use.

7. How long we keep data

• Account data and content remain in the platform for as long as the account is active and the contract with the kindergarten is in force.
• When a kindergarten’s contract ends, its data is deleted or anonymised within 90 days, except for data we are legally required to keep.
• Invoices and accounting documents are kept in accordance with Romanian fiscal legislation.
• Technical logs are kept for short periods, as needed for security and diagnostics.

8. How we protect data

We use appropriate technical and organisational measures: encryption of data in transit, secure authentication, role-based permissions (each user only sees what is intended for them), private storage for sensitive documents and regular backups. Our team’s access to data is limited to what is strictly necessary to operate and maintain the platform.

9. Your rights

Under the GDPR you have the right to access your data, and the rights to rectification, erasure, restriction of processing, data portability, objection, and to withdraw your consent where processing is based on it.

To exercise these rights, contact your kindergarten (for data it manages) or write to us at contact@kinderbase.ro. We respond within one month of receiving your request; for complex requests this may be extended by two further months, and we will let you know.

You can withdraw your consent to functional cookies and usage statistics at any time from Profile → Privacy, as easily as you gave it.

You also have the right to lodge a complaint with the Romanian supervisory authority, ANSPDCP — dataprotection.ro — or with your local data protection authority.

10. Cookies and similar technologies

The app uses cookies and local storage on your device in three categories:

• Strictly necessary (no consent needed): your login session, your cookie choice and display preferences you set explicitly (language, theme, text size).
• Functional: preferences remembered between visits, such as admin mode, recent searches, stories you have already seen and how reports are displayed. In the web app only with your consent; in the mobile apps they are settings you chose and stay on your device.
• Usage statistics (only with your consent): the screens opened and actions taken, sent to our own servers in the EU. We do not share them with third parties or use them for advertising.

In the web app you choose between "Accept all" and "Reject" on your first visit; the mobile apps ask for your consent to usage statistics on first use. If you reject, the platform works fully: only functional preferences are not remembered between visits and no usage statistics are collected. You can change your choice at any time from Profile → Privacy.

Error reports and platform response times are collected on the basis of our legitimate interest in keeping the platform secure and working. The kinderbase.ro website uses no cookies. We do not use advertising or cross-site tracking cookies.

11. Changes to this policy

We may update this policy from time to time. The current version is always published on this page, and we will notify users through the platform of any significant changes. The date of the latest update is shown at the top of the page.

12. Contact

For any questions about data protection, write to us at contact@kinderbase.ro.