Privacy Policy

1. Introduction

CubbyPro ("we," "us," or "our") is committed to protecting the privacy and personal information of every user of our platform. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you access or use the CubbyPro childcare management platform, including our websites, mobile applications, and related services (collectively, the "Services").

By using our Services, you acknowledge and agree to the practices described in this Privacy Policy. Your use of CubbyPro is also subject to our Terms of Service.

2. Important Notes

Customer Data

This Privacy Policy does not apply to personal information that we process on behalf of our customers (childcare centres, directors, and administrators) through their use of our Services ("Customer Data"). Our customers' respective privacy policies govern their collection and use of Customer Data. Our processing of Customer Data is governed by our agreements with those customers. Questions or requests relating to Customer Data — such as requests to delete information about a child on the CubbyPro platform — should be directed to the applicable childcare centre. If you are unable to reach your centre or have not received a response within a reasonable time, you may contact us at privacy@cubbypro.com and we will coordinate a response with the applicable centre.

Children's Information

CubbyPro is a childcare management platform designed for use by licensed childcare centres, educators, and parents or guardians of children enrolled in those centres. The Services process personal information about children — including names, dates of birth, medical information, photos, and activity logs — but this information is always entered by authorized adults, never collected directly from children.

• We do not knowingly permit children to create accounts.
• We do not knowingly collect personal information directly from children.
• We rely on centres to obtain and manage all necessary consents — including consent to photograph, record, and share images of a child — before entering child-related information into the Services. CubbyPro does not verify or record individual consents.
• We comply with applicable Canadian privacy laws including PIPEDA and, where applicable, PHIPA, as well as CCEYA and CWELCC requirements for childcare operators in Ontario.
• We do not use child data for advertising, profiling, or any purpose unrelated to providing the Services.

If you believe a child has provided personal information without appropriate adult consent, contact us at privacy@cubbypro.com.

3. Information We Collect

Information You Provide

• Account Information. Name, email address, phone number, role (director, teacher, parent), and authentication credentials when you register or are invited to the platform.
• Centre Information. Centre name, address, licensing details, operating hours, and CWELCC/CCEYA configuration data provided by directors during onboarding.
• Child Records. Child names, dates of birth, medical information, allergy details, OHIP numbers (encrypted), emergency contacts, custody alerts, and immunization records — entered by authorized staff or parents.
• Activity Data. Attendance check-in/out records, daily activity logs (meals, naps, diapers, mood observations), incident reports, photos, and progress notes entered by educators.
• Financial Information. Billing details, invoice records, expense data, and tax receipt information processed through the platform. We do not store full credit card numbers.
• Communications. Messages exchanged between parents and staff through the platform, announcements, and support requests.

Information Collected Automatically

• Device and Usage Data. Browser type, device identifiers, operating system, IP address, pages visited, features used, and interaction patterns.
• Log Data. Server logs recording access times, errors, and API requests for security monitoring and debugging.
• Cookies and Similar Technologies. We use essential cookies for authentication and session management. See our Cookie Policy for details.

4. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain the CubbyPro platform for your childcare centre.
• Enable digital check-in/out, activity logging, and parent-staff communication.
• Generate attendance reports, billing invoices, and compliance documentation (CWELCC, CCEYA).
• Power AI-powered features including daily plan generation, centre management insights, smart alerts, and automated reporting.
• Send notifications about your child's activities, incidents, schedule changes, and announcements.
• Process billing, generate tax receipts, and manage subscription payments.
• Track curriculum progress across supported Canadian early learning frameworks (Montessori, ELECT, Flight, ELF).
• Improve platform functionality, fix bugs, and enhance the user experience.
• Comply with applicable childcare regulations, licensing requirements, and legal obligations.
• Detect, prevent, and respond to security incidents and fraud.

5. Artificial Intelligence Features

CubbyPro uses AI to power optional features including AI-powered daily plans, AI-powered centre management, smart alerts, and automated reporting. When you use an AI-powered feature:

• Only the class name, age group, and your chosen theme or parameters are sent to the AI model. No child names, personal data, or identifying information is transmitted.
• AI-generated content is always presented for human review before being saved. Teachers and directors must approve all AI suggestions.
• No data submitted to AI features is used to train AI models.
• AI features are optional and clearly labelled with an AI indicator throughout the platform.
• You may opt out of AI features at any time through your centre's settings without affecting other platform functionality.

6. Photos, Videos, and Content

The Services allow educators, directors, and authorized parents to upload photos and videos. Because this content may include images of minors, additional considerations apply:

• Consent. Centres are solely responsible for obtaining, documenting, and managing all parental or guardian consents required for the collection, use, and sharing of children's personal information — including photos and videos — through the Services. CubbyPro does not verify or record such consents.
• Screening. Uploaded content may be automatically screened for safety and integrity purposes before being made generally available on the platform. Content flagged by automated systems may be reviewed by authorized personnel. CubbyPro may introduce, adjust, or expand screening tools at any time at its discretion.
• Metadata. Location and device metadata may be removed from uploaded photos to protect privacy.
• Illegal content. Content identified as, or strongly suspected to be, unlawful is handled in accordance with our Terms of Service and applicable Canadian law, including reporting obligations.

7. Data Sharing and Disclosure

We do not sell, rent, or trade personal information. We may share data only in these limited circumstances:

• Within Your Centre. Teachers, directors, and parents within the same centre can access information relevant to their role, as configured by the centre director.
• Service Providers. We rely on a limited number of trusted service providers to host, store, secure, and deliver the Services. These providers are bound by confidentiality and data protection obligations. A current list of our service providers is available on request at privacy@cubbypro.com.
• Legal Requirements. We may disclose information if required by law, regulation, subpoena, court order, or legal process.
• Child Safety. We will cooperate with law enforcement and child protection authorities if we become aware of, or are notified of, potential child safety concerns.
• Business Transfers. In the event of a merger, acquisition, or sale of assets, user data may be transferred as part of the transaction. We will notify affected users before their data becomes subject to a different privacy policy.

8. Data Storage, Security, and Residency

Customer Data is stored on infrastructure located in Canada. Certain specific service-provider functions operate from the United States and are used only to the extent strictly necessary to deliver the Services:

• Authentication. Account credentials (including passwords, federated sign-in tokens, and multi-factor identifiers such as phone numbers) are managed by our identity provider and stored in the United States.
• AI inference. Non-personal parameters you submit to optional AI features (such as class name, age group, or theme) are processed by US-based AI providers. Child names, personal identifiers, and sensitive information are not transmitted to AI providers.
• Payment processing. Where your centre enables payment collection, payment data is processed by a US-based payment processor under that processor's own terms.

Where personal information is processed or stored outside Canada, it may be subject to the laws of the receiving jurisdiction, including lawful government access requests. We select providers that offer contractual data-protection safeguards and limit cross-border transfers to what is necessary to deliver the Services.

We employ industry-standard security measures including encryption in transit and at rest, role-based access controls, and regular security assessments. For full details on our security practices, see our Security page.

9. Your Rights

Under applicable Canadian privacy laws (including PIPEDA) and other regulations, you have the right to:

• Access the personal information we hold about you and your child.
• Correct inaccurate or incomplete information.
• Delete your data, subject to regulatory retention requirements.
• Withdraw Consent for optional data processing at any time.
• Export your data in a portable format (CSV or PDF).
• Object to certain types of data processing.
• File a Complaint with the Office of the Privacy Commissioner of Canada if you believe your privacy rights have been violated.

To exercise these rights, contact your centre director or email us at privacy@cubbypro.com. We will respond to verifiable requests within 30 days.

10. Data Retention

We retain personal information for as long as necessary to provide the Services, comply with legal obligations, resolve disputes, and enforce our agreements.

• Active accounts. Data is retained while the centre's account is active.
• Account closure. Customers have thirty (30) days following account closure to export their data. Customer Data is then deleted within a reasonable period, except as required for regulatory retention or legal hold.
• Regulatory retention. Certain records (including attendance, incident, immunization, and financial records) may be retained for longer periods as required by provincial childcare licensing regulations.
• Legal holds. Data subject to a legal hold, preservation order, or investigation is retained for the period required.
• Aggregated data. De-identified and aggregated data that cannot be linked to any individual may be retained for service improvement purposes.

11. Security Incidents

No system is completely secure. In the event of a security incident affecting personal information under our control, we will notify affected Customers and, where applicable, affected individuals and regulatory authorities, in accordance with applicable Canadian privacy laws. We maintain an internal incident response process and review it periodically.

12. Cookies

We use essential cookies for authentication and session management. We do not use advertising or third-party tracking cookies. For detailed information about the cookies we use and how to manage them, please see our Cookie Policy.

13. Third-Party Links

Our Services may contain links to third-party websites or services. We are not responsible for the privacy practices of those third parties. We encourage you to review the privacy policies of any third-party sites you visit.

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify registered users of material changes via email or in-app notification at least 30 days before they take effect, except where a shorter period is required by law. Continued use of the platform after changes constitutes acceptance of the updated policy. Previous versions of this policy are available upon request.

15. Reporting Concerns

If you encounter content on CubbyPro that you believe is inappropriate, harmful, or violates these policies, please contact your centre director or email us at support@cubbypro.com. Centre directors are responsible for managing content and user access within their centre. CubbyPro will investigate reports of platform-level abuse and may suspend or terminate accounts that violate our Terms of Service.

16. Privacy Officer

CubbyPro has designated a Privacy Officer responsible for our compliance with this Privacy Policy and applicable Canadian privacy laws.

CubbyPro — Privacy Officer
Office 184, 145 1/2 Church Street, Unit 5
Toronto, Ontario M5B 1Y4, Canada
Email: privacy@cubbypro.com

Individuals may also file a complaint with the Office of the Privacy Commissioner of Canada at priv.gc.ca.

17. Contact Us

If you have questions about this Privacy Policy or our data practices, contact us at:

CubbyPro
Office 184, 145 1/2 Church Street, Unit 5
Toronto, Ontario M5B 1Y4, Canada
Privacy: privacy@cubbypro.com
General: support@cubbypro.com