Privacy Policy

1. Who we are

Kinderhub (“we”, “us”, “our”) operates the kindergarten management platform available at kinderhub.app. We are the data controller for the personal data processed through this platform. For questions about this policy, contact us at privacy@kinderhub.app.

2. What data we collect

We collect the following categories of personal data:

• Account data: name, email address, and password (hashed) when you create an account.
• Organisation data: kindergarten name, address, and billing information.
• Child records: name, date of birth, medical notes, and allergy information provided by your school.
• Family data: parent/guardian names, contact details, and authorised pickup information.
• Staff data: name, email, role, and qualification records.
• Usage data: anonymised analytics on how the platform is used (via Vercel Analytics — no cookies required).

3. How we use your data

We process personal data for the following purposes:

• To provide and operate the Kinderhub platform (contractual necessity).
• To send billing invoices and payment reminders (contractual necessity).
• To send service-related emails such as password resets (legitimate interest).
• To improve platform performance and detect issues (legitimate interest).
• To comply with legal obligations under EU law.

We do not use your data for advertising or sell it to third parties.

4. Data storage and security

All data is stored on EU servers (Supabase, Frankfurt region). We implement the following security measures:

• Encryption at rest (AES-256).
• Encryption in transit (TLS 1.3).
• Role-based access control — staff only access data relevant to their role.
• Automated daily backups with 30-day retention.
• Audit logs for all data access events.

5. Data retention

We retain personal data for as long as your subscription is active and for up to 30 days after cancellation, during which you can export your data. After 30 days, data is deleted from our systems unless we are required to retain it for legal reasons.

6. Your rights under GDPR

As a data subject in the EU, you have the following rights:

• Access: request a copy of the personal data we hold about you.
• Rectification: request correction of inaccurate data.
• Erasure: request deletion of your data (“right to be forgotten”).
• Portability: receive your data in a machine-readable format.
• Objection: object to processing based on legitimate interest.
• Restriction: request restricted processing in certain circumstances.

To exercise any of these rights, contact privacy@kinderhub.app. We will respond within 30 days.

7. Cookies

Kinderhub uses a single session cookie for authentication purposes only. We do not use advertising, tracking, or third-party marketing cookies. Our analytics are handled by Vercel Analytics, which uses no cookies and processes anonymised data only.

8. Third-party processors

We share data with the following sub-processors, all of which are GDPR-compliant and covered by EU Standard Contractual Clauses:

• Supabase Inc. — database and authentication (EU region).
• Vercel Inc. — hosting and anonymised analytics.
• 2Checkout (Verifone) — payment processing. We do not store your full card details; payment data is collected and processed directly by 2Checkout under its own privacy policy.

9. Changes to this policy

We may update this Privacy Policy from time to time. We will notify subscribers by email at least 30 days before any material change takes effect. Continued use of the platform after that date constitutes acceptance of the updated policy.