Privacy Policy

Most of the personal information in NestliCare is entered by a childcare organization: records about enrolled children, their families, and the organization's staff. For that information, your childcare organization is the data controller and NestliCare processes it on the organization's behalf under a Data Processing Agreement. If you are a parent or staff member with a question or request about those records, the fastest path is your organization; we support them in responding, and you can always contact us too.

For information we collect ourselves, such as organization signup details, visits to our public websites, and support conversations, NestliCare is the data controller.

Account information: Name, email address, phone number, preferred language, and an optional profile photo. Parent and staff accounts are created by the organization's administrators, who invite users to the platform.

Child records: Organizations may record information about enrolled children, including name, date of birth, room assignment, photos, emergency contacts, and health-related information such as allergies, medical conditions, medications, dietary needs, immunization records, and doctor details. The Service also records attendance (check-in and check-out times), daily activities (meals, naps, diapering, learning activities, mood), incident reports, and developmental observations. This information is entered by authorized adults at the organization, not by children.

Forms and signatures: Completed enrollment and consent forms, including typed or hand-drawn electronic signatures and a signing record (such as the time of signing and device information) kept to show a form was validly signed.

State subsidy sign-in records: When a child is enrolled in a state child care subsidy program that requires it (for example Texas Workforce Commission Child Care Services), the sign-in and sign-out of that child may include a photo of the adult signing, a hand-drawn signature and the location of the kiosk or staff device at that moment. NestliCare collects these only for children on such a program, only at the moment of sign-in or sign-out, and sends them to the state's attendance system on the organization's behalf. They are not used for anything else.

Messages and posts: Messages exchanged between parents and staff, announcements, and newsletter content. Message history is stored so conversations remain available to participants.

Voice input: Some staff screens let you speak instead of type. Speech is turned into text on your own device, using your phone's or browser's built-in speech recognition set to on-device only. NestliCare does not receive the audio, only the text you choose to submit.

Data migration files: When an organization moves to NestliCare from other software, it can upload exports such as rosters and family lists so we can import them. These files usually contain the same kinds of child, family and staff information described above.

Payment information: Online payments are processed by our payment processors (Stripe, and for some organizations Adyen). Card and bank account numbers are entered directly with the processor and never touch our servers. We store only references and display metadata, such as a payment token, card brand, and the last four digits of a card or bank account.

Staff and payroll information: For staff users, organizations may record job details, schedules, timesheets, leave, certifications, and compensation such as pay rates. Payroll itself is processed outside NestliCare by the organization's own payroll provider; bank accounts and tax information are not stored by NestliCare.

Device and technical data: Device type, operating system, push notification tokens, IP address, browser type, and log data, including an audit trail of sensitive administrative actions.

Public website analytics: Usage data about visits to our public marketing pages, described in the cookies section below.

Demo summary requests: If you ask us to email you a summary of the demo at nestlicare.com/demo, we keep your email address, the topic you picked, and which demo chapters and tutorial videos you watched. We use it to send that summary and to know who is considering NestliCare. We don't add you to a mailing list or sell it. Ask us at [email protected] and we delete it.

We use the information we collect to:

• Provide and maintain the Service, including daily activity reports, attendance, billing, and real-time updates
• Facilitate communication between parents and childcare staff
• Send notifications about a child's day, attendance, announcements, and payments
• Process payments and maintain billing records
• Keep the Service secure, including sign-in protection, bot detection, device attestation on mobile signup, fraud prevention, and audit logging
• Respond to support requests
• Understand how the Service is used and improve it
• Comply with legal obligations
• Keep the Service safe from fraud and abuse, including automated reviews of new organizations, pages submitted for publishing, and use of AI features, as described in Section 4

Where the GDPR or UK GDPR applies to processing for which we are the controller, we rely on the performance of a contract (providing the Service), our legitimate interests (securing and improving the Service), and compliance with legal obligations as lawful bases.

4.1 AI features for childcare organizations ("NestliAI")

Some features use large language models from Anthropic to draft or summarize content. Each one sends Anthropic only what it needs for that task:

• Quick log: turns a staff member's typed or spoken note into activity entries. It sends the note and the first names in the relevant room so it can tell who the note is about.
• Observation, lesson plan and progress report drafting: sends the notes, activities or plans a teacher is drafting from, including the children's first names that appear in them.
• Daily summaries: built from counts (attendance, meals, naps and similar totals) rather than individual children's records.
• The NestliAI assistant for administrators: sends the administrator's questions and the records the assistant looks up to answer them, which can include children's names, attendance, allergies and family billing. The assistant can propose changes to records, for example correcting an attendance time. Nothing is written unless an administrator reviews and approves the proposal, and every approval is logged to the administrator who made it.
• Automatic data migration: sends the files an organization uploads so the model can read them and propose how to import them. An administrator reviews the plan before anything is imported.
• Form field placement: sends the pages of a blank form the organization uploads so fields can be placed on it automatically.

What stays off: these features do not send the photos of children stored in the Service. The only images they send are files an organization uploads to them on purpose: form pages for field placement, and image files (such as a screenshot of a roster) uploaded for a data migration. Our AI providers are not permitted to use this content to train their models.

Who controls it: AI features are controlled by the organization. The organization's owner can turn all of them off at once in Settings, and individual features can be turned off one by one. New organizations in the United States and Canada start with these features available; elsewhere they start off.

4.2 AI we use to run the Service

We also use Anthropic models internally to help keep the Service safe and working: to assess new organizations for fraud, to review pages submitted for public listing before a person approves them, to flag misuse of AI features, and to sort error reports and support requests. These reviews can see an organization's signup details, activity counts, the pages it submits, and short excerpts of AI conversations or support messages. Before anything is sent, email addresses, phone numbers and long numbers are removed, and the names of the organization's children, families and staff are replaced. These reviews are not run on organizations in the European Economic Area, the United Kingdom or Switzerland. A person makes every decision that affects an organization's account.

Answers on our websites: The assistant on our help center and marketing site answers only from our published help articles. It does not have access to any account or organization data. Do not type personal information about children into it. On the demo page (nestlicare.com/demo) we keep the questions visitors ask the assistant, shortened to 300 characters with email addresses and phone numbers removed, together with the demo chapter on screen, so we can see which tutorial videos to make next. We do not store your IP address, browser details or any identifier with them.

We do not sell personal information, and we do not share it for third-party advertising. We share information only as follows:

• Within your organization: Information is visible to authorized parents and staff of the same organization according to their roles. Parents see their own children; staff see the rooms and records they are authorized for.
• State subsidy agencies: For a child enrolled by their organization in a state child care subsidy program, and for no other child, the child's attendance record, the signing adult's photo, signature, and location, and the name of the person who recorded each sign-in or sign-out are transmitted to the state's attendance system on the organization's behalf. The state agency handles that information under its own rules.
• Hosting and infrastructure: Amazon Web Services hosts our databases and media storage in the United States. Cloudflare provides content delivery, security, and bot protection for our websites.
• Payment processing: Stripe (and Adyen, where enabled) process payments and payouts. Payment processors act as independent controllers for the payment data they collect, under their own privacy policies.
• Email delivery: Transactional email (invitations, receipts, password resets, daily summaries) is delivered through SendGrid (Twilio).
• Push notifications: Notifications are delivered through Apple and Google push services and, for web browsers, browser push services. Notification content, which may include a child's first name, passes through these services in order to be delivered.
• AI processing: Anthropic processes content for the AI features and internal reviews described in Section 4, as our service provider, under its terms for business customers. Under those terms it does not use that content to train its models, and it keeps it only for a limited time, for example to detect misuse.
• Legal requirements: We may disclose information if required by law, regulation, legal process, or governmental request.
• Safety: We may disclose information where we believe it is necessary to protect the safety of any person, including a child, or to prevent illegal activity.
• Business transfers: If NestliCare is involved in a merger, acquisition, or sale of assets, personal information may be transferred as part of that transaction, subject to this policy's protections.

Service providers that process personal data on our behalf are bound by contracts that limit their use of the data to providing their service to us.

In the app and dashboard: The signed-in product does not use advertising or third-party analytics trackers. We use only the storage needed to run the Service, such as your sign-in session and language preference.

On public website pages (our homepage, pricing, blog and other marketing pages, the public daycare search and listing pages, the sign-up page, and the live demo) we use PostHog, a product analytics service, to understand how visitors find and use the site. It receives usage data such as IP address, browser and device information, pages visited, and an anonymous identifier stored in a cookie. Session recording is off, and we remove email addresses, names, and similar details from page addresses before anything is sent. We may also use Cloudflare Web Analytics, which sets no cookies. We do not use advertising pixels or tags (such as those from Meta or Google Ads), and we do not sell or share visitor data for advertising.

Pages without analytics: The signed-in dashboard, our mobile apps, enrollment forms, and the sign-in, password, and invitation pages load no third-party analytics, so those tools never receive child, family, or daycare records.

Your choices: Visitors in the European Economic Area, the United Kingdom, and Switzerland are asked first, and analytics stays off unless they allow it. Everywhere, if your browser sends a Global Privacy Control or Do Not Track signal, PostHog does not load. You can also block or delete cookies in your browser settings.

NestliCare is operated from the United States, and data is stored on Amazon Web Services infrastructure in the United States. If you use the Service from another country, including Canada, the United Kingdom, Australia, or the European Economic Area, your information is transferred to and processed in the United States.

Where the GDPR or UK GDPR applies, we rely on appropriate safeguards for these transfers, including the European Commission's Standard Contractual Clauses incorporated into our Data Processing Agreement with organizations, together with the UK Addendum where applicable.

The internal reviews described in Section 4.2 are not run on organizations in the European Economic Area, the United Kingdom or Switzerland, and their names and records are left out of reviews that cover many organizations at once.

We protect your information with measures that include:

• Encryption in transit (TLS) and encryption at rest on AWS infrastructure
• Role-based access controls, so users only see data they are authorized to access, and strict isolation between organizations
• Photos and documents kept in private storage, accessible only through short-lived signed links issued to authorized users
• Audit logging of sensitive administrative actions, with the actor, timestamp, and IP address
• Bot protection on signup and device attestation for our mobile apps

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we learn of a breach affecting personal data, we will notify affected organizations without undue delay and support them in meeting their own notification duties.

While an account is active, we retain the records the organization keeps in the Service. Childcare organizations are often legally required to retain records such as attendance, incident, and health records for a period set by their licensing rules, so we do not automatically purge those records; the organization controls them.

Some data is deleted automatically on a schedule: in-app notifications are removed after at most 180 days, AI-generated daily summaries after 30 days, NestliAI assistant conversations 90 days after their last message, and web server access logs after about 30 days. Security audit logs are retained while the organization's account exists.

Records of our automated fraud and safety reviews are kept for up to one year, or up to three years where a person has reviewed them or found abuse.

Data migrations: 90 days after a data migration is finished, or has had no activity, the files the organization uploaded are deleted. To improve future migrations we keep a record of how the migration went, such as the kinds of files, the questions we asked, the options chosen, and how many families, children and staff were involved. We remove names, contact details, birthdays, addresses and health information from that record. The children, families and staff the migration created are the organization's own records and are kept as described above.

Demo summary requests: Deleted 12 months after your last request, or sooner if you ask.

Backups are encrypted and expire on a rolling schedule: database point-in-time recovery covers roughly the last 7 days, and nightly archive copies expire automatically after about 31 days.

When an organization stops using NestliCare, its records remain stored until the organization asks us to delete them, so that data can still be exported, transferred, or reactivated. When an organization's owner submits a verified deletion request, we delete the organization's records from our production systems within 90 days, after which backup copies expire on the rolling schedule above. Copies of uploaded media files may persist in cloud storage for a period after database deletion while storage cleanup completes. We may retain information we are legally required to keep, such as financial and tax records, and records needed to resolve disputes.

State subsidy sign-in records: Photos, signatures and device locations collected for a state subsidy program are deleted from NestliCare after the retention window the organization sets (90 days by default, between 30 days and 3 years) once the state has accepted the day. A day the state never accepted is kept for one year at most. The state keeps its own copy for its record-retention period. Attendance times themselves are kept as part of the organization's attendance records.

Parents can request deletion of their account from the app's profile settings, or by contacting us at [email protected]. Because some records a parent appears in (such as attendance, incident, and billing records) are records your childcare organization is required to keep, deletion requests are reviewed by the organization.

When a request is approved, we disable sign-in, delete the parent profile and device tokens, remove stored payment references, and anonymize the account's identifying details so the account is no longer linked to you. Records the organization must retain, such as its attendance and billing history, remain under the organization's control. If you believe your organization has wrongly refused a deletion request, contact us and we will work with you and the organization.

Depending on where you live, you may have rights to access, correct, delete, or receive a copy of your personal information, to restrict or object to certain processing, and to withdraw consent. These rights exist under laws including the GDPR (European Economic Area), the UK GDPR, PIPEDA (Canada), the Privacy Act and Australian Privacy Principles (Australia), and various US state privacy laws.

For records your childcare organization entered about you or your child, please direct your request to the organization first; it is the controller of those records, and we assist it in responding. For information NestliCare controls, contact us at [email protected] and we will respond within the time required by applicable law. If you are in the EEA or the UK, you also have the right to lodge a complaint with your data protection authority.

AI: An organization's owner can turn off all of the organization's AI features at once.

Notifications: You can turn off push notifications in your device settings at any time.

NestliCare is designed for use by adults: childcare professionals and parents or guardians. Children do not use the Service, and we do not knowingly collect personal information directly from children under 13. All information about children in the Service is entered by authorized adults, and childcare organizations are contractually required to obtain consent from a parent or guardian for the collection of a child's information, including written consent before photos or videos of a child are uploaded.

Parents and guardians can review their child's information in the app at any time, and can ask their childcare organization, or us, to correct or delete it, subject to records the organization is legally required to keep.

We may update this Privacy Policy from time to time. We will post the updated policy on this page and update the "Last updated" date, and for material changes we will notify organizations by email or in the app. We encourage you to review this policy periodically.

If you have questions or concerns about this Privacy Policy or our data practices, contact us:

• Email: [email protected]
• Company: NestliCare LLC
• Website: nestlicare.com

For individuals in the European Union, European Economic Area, and United Kingdom: NestliCare LLC has appointed Data Protection Representative Limited (trading as DataRep) as its data protection representative under Article 27 of the GDPR and UK GDPR. You can contact NestliCare via DataRep:

• Email: [email protected], quoting "NestliCare LLC" in the subject line
• Web form: www.datarep.com/data-request
• Post: DataRep, 77 Camden Street Lower, Dublin, D02 XE80, Ireland (or any DataRep location in the EU/EEA or UK; mark letters for 'DataRep')

For questions about NestliCare's products or your account, please email [email protected] instead.