Privacy Policy

When a licensed childcare center subscribes to Daily Cubby, the center is the controller of the records it keeps about the children and families it serves. The center decides which children are enrolled, which fields are recorded, who on its staff may see them, and how long they are retained beyond the minimums its license requires. Daily Cubby acts as a service provider and processor for those records: we store and process them to deliver the service the center has asked for, under the terms of our agreement with that center, and we do not use them for our own independent purposes.

That distinction has a practical consequence. We cannot unilaterally correct, disclose, or delete a child's record at a parent's request, because doing so would override decisions that belong to the center and could conflict with the recordkeeping its license requires. Requests about a child's information are handled by the center, and we support the center in fulfilling them.

We are the controller in our own right for a narrower set of information: the accounts and billing details of the centers that subscribe to us, the support conversations we have with center staff, our own security and audit logs, and the information visitors give us through this website when they request a demo or contact our team.

The information in the product is entered by the center and its families rather than gathered by us. It falls into three groups, and the details in each depend on how the center configures its account.

We use the information in a center's account to deliver the service that center has subscribed to: authenticating users, recording attendance, generating invoices and receipts, routing messages and daily reports between staff and families, producing the reports a director runs, and keeping the account's data available and intact.

We use account and technical information to secure the service — detecting credential-stuffing and other abuse, investigating incidents, and maintaining the audit trail a licensed center needs. We use it in aggregate to understand which parts of the product are slow or failing so we can fix them. We use contact details for center administrators and staff to send service notices such as maintenance windows, security advisories, billing confirmations, and material changes to this policy or our terms.

We use website and inquiry information to respond to what you asked for and, where you have asked to hear from us, to send product news you can unsubscribe from at any time.

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We do not use children's information to build advertising profiles, and we do not use it to train models. Where we publish aggregate statistics about how centers use the product, they are derived from de-identified data that cannot reasonably be linked back to a child, family, or staff member.

Where the GDPR or UK GDPR applies, the center is responsible for establishing the legal basis for the records it controls, which is ordinarily the performance of its enrollment contract with the family and compliance with the legal obligations of its childcare license. We process those records on the documented instructions of the center under a data processing agreement.

For the information we control in our own right, we rely on the performance of our contract with the subscribing center to administer accounts, provide support, and take payment; on our legitimate interests in securing the service, preventing abuse, and improving the product, balanced against the rights of the people concerned; on compliance with legal obligations for tax, accounting, and lawful requests; and on consent where we ask for it, such as marketing email, which you can withdraw at any time.

Health information, including allergies, medications, and immunization records, receives additional protection. It is processed to protect the vital interests of the child and to allow the center to meet its duty of care and licensing obligations, and it is visible only to the staff the center has authorized.

We keep this deliberately small. Daily Cubby does not run advertising cookies, and we do not operate third-party analytics or tracking tooling on this website or in the product. There is no cross-site tracking to opt out of.

The signed-in product sets a session cookie so that the application knows who you are as you move between pages, and a cookie carrying a token that protects form submissions against cross-site request forgery. Both are strictly necessary: without them, signing in and staying signed in would not work. The session cookie is cleared when you sign out, and expires on its own after a period of inactivity.

Because we set only strictly necessary cookies, there is nothing that requires consent under the ePrivacy rules, and we therefore do not present a consent banner or a cookie preferences center. If that ever changes — if we introduce analytics or any non-essential cookie — we will update this section and put a consent mechanism in place before switching it on.

We use a small number of vendors to run the service. Each is bound by a written agreement that limits them to processing data on our instructions, requires security measures appropriate to the data, and prohibits them from using it for their own purposes. We disclose the categories rather than a list frozen at publication time, because vendors change; a center can request our current subprocessor list, and its data processing agreement governs notice of changes.

Retention for children's and families' records is driven by the center's obligations, not by a period we pick. Childcare licensing regulations set minimum retention for enrollment records, attendance registers, immunization and health records, medication logs, and incident reports, and those minimums vary by state and by record type — several years past a child's last day of attendance is common, and some jurisdictions require records to be kept until the child reaches a specified age. We retain a center's records for as long as its account is active so the center can meet those requirements, and we honor the retention configuration the center sets where it wants to keep records longer than the minimum.

When a center closes its account, we make its data available for export for thirty days, then delete it from active systems within ninety days of closure unless the center has instructed us in writing to retain it longer for licensing or litigation-hold reasons. Encrypted backups roll off on their own schedule and are fully purged within twelve months. Where a center is mid-way through a licensing inspection or an open regulatory matter when it closes, we will hold the affected records until the center confirms the matter is resolved.

For the information we control ourselves: billing and tax records are kept for seven years as accounting rules require; security and audit logs are kept for twelve months; support conversations are kept for two years after they close; and website inquiries are kept for two years from our last exchange with you, or until you ask us to delete them.

Data is encrypted in transit with TLS and encrypted at rest in our databases, file storage, and backups. Access to production systems is limited to the engineers who need it, requires multi-factor authentication, is granted on the principle of least privilege, and is logged. We do not use production data in development or test environments.

Inside the product, a center controls who sees what. Roles determine which records a staff member can open, families see only their own child's information, and sensitive fields such as medication and incident records are limited to the staff the center authorizes. Every access to a child's record is written to an audit trail the center's administrators can review.

We back up data continuously and test restores. We patch dependencies on a regular cadence, review code before it ships, and run periodic security assessments and penetration testing. Staff receive security and privacy training on joining and annually thereafter, and access is revoked the day someone leaves.

If a breach affects a center's data, we will notify that center without undue delay and no later than seventy-two hours after becoming aware of it, with what we know about the scope, the records involved, and the steps we are taking. Because the center is the controller, the center is responsible for notifying affected families and its licensing authority, and we will give it the information it needs to do so. No system is perfectly secure, and we cannot guarantee absolute security — but we will tell you plainly when something goes wrong.

Depending on where you live, you may have the right to know what personal information is held about you, to get a copy of it, to have inaccuracies corrected, to have it deleted, to restrict or object to certain processing, to receive it in a portable format, and not to be discriminated against for exercising any of these rights. Residents of California, Colorado, Connecticut, Virginia, and other states with comprehensive privacy laws, and people in the EEA and the UK, have these rights under their respective statutes.

How you exercise them depends on whose records are involved. If you are a parent or guardian asking about your child's records, or your own contact and billing details held inside a center's account, contact your childcare center. The center controls those records, decides what its license requires it to keep, and can act on your request directly in the product. We will help the center respond, but we will not override its decisions about records it controls.

If you are center staff or a center administrator asking about your own account, or a website visitor asking about an inquiry you sent us, write to info@dailycubby.com. We will verify your identity before acting, respond within thirty days of a verifiable request, and tell you if we need more time or cannot grant the request and why. You may use an authorized agent, and we will ask for proof of their authority.

If you are in the EEA or the UK you may complain to your national data protection authority, and if you are elsewhere you may complain to your state attorney general or equivalent regulator. We would rather hear from you first so we can put it right.

Daily Cubby is not directed to children and children do not hold accounts. Information about a child reaches the product in one of two ways: a center's staff record it as part of caring for that child, or the child's own parent or guardian enters it in the family account.

The Children's Online Privacy Protection Act (COPPA) governs the online collection of personal information from children under thirteen. We operate as a service to the center under COPPA's school-and-provider framework: the center collects the information for its own educational and custodial purposes, obtains the parental authorization required at enrollment, and instructs us to process it. We use children's information only to provide the service to that center. We do not use it for advertising, we do not disclose it to third parties except the subprocessors listed above, and we do not condition a child's participation on disclosing more than is reasonably necessary. A parent who wants to review or delete a child's information, or withdraw consent to its further use, should contact their center, which can act on the request and instruct us accordingly.

Where a center operates a program that makes it subject to the Family Educational Rights and Privacy Act (FERPA) — typically a pre-kindergarten or early education program receiving applicable federal funding — records in Daily Cubby may be education records under that Act. In that case we act as a school official with a legitimate educational interest under the direct control of the center: we use the records only for the purpose the center engaged us for, we do not redisclose them without the center's authorization or a permitted exception, and we support the center in providing the access and amendment rights FERPA gives parents. FERPA does not apply to every childcare center, and a center that is unsure of its status should take its own advice.

If you believe a child's information reached us other than through a center or a parent, write to info@dailycubby.com and we will investigate and delete it.

We are based in the United States and our primary infrastructure is located there. Centers on our Enterprise plan can request that their data be stored in a specific region, and where we agree to that in writing we honor it.

If you are in the EEA, the UK, or Switzerland, information you or your center provide may be transferred to and processed in the United States, which its authorities have not deemed to offer equivalent protection. Where we make such a transfer we rely on the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, together with technical measures including encryption in transit and at rest and access controls limiting who can reach the data. Our data processing agreement incorporates those clauses, and a center can request a copy.

We update this policy when the product changes, when we add or replace a subprocessor category, or when the law requires it. The date at the top of the page shows when the current version took effect, and we keep prior versions so a center can see what changed.

For material changes — a new purpose for which we use information, a new category of recipient, or a change that reduces your rights — we will email the administrators of every active center and post a notice on this page at least thirty days before the change takes effect. Minor clarifications take effect when posted. Continuing to use Daily Cubby after a change takes effect means the updated policy applies, and a center that objects to a material change may terminate under our terms and export its data.

Privacy questions, requests about your own information, data protection correspondence, and general inquiries all go to info@dailycubby.com or 650-271-6181 during business hours, and our contact page has more ways to reach the team.

Written notice can be sent to Daily Cubby, 100 El Campo Dr, South San Francisco, CA 94080, USA. If your question concerns a child's records held by a center, please contact that center first — they control those records and can usually resolve it faster than we can.