PIPEDA & child safety

What we collect

• Account: name, email, password or sign-in provider, optional phone and profile photo, role (parent or centre director).
• Child profiles you add: name and birthdate if you choose to add a child. Allergies, epi-pen flag, medical notes, medications, doctor name and phone, foods, routines, comfort items, emergency contacts, pickup people, and care notes are optional health and care details. You control them. You can leave them blank or delete them. PostHog and Sentry do not receive those health fields.
• Search location you choose: a GPS fix while you search, or a typed address, city, or postal code.
• Requests and messages: inquire, book-a-tour, and request-a-spot fields, plus in-app chat with that centre.
• Calls: live audio on a KidEase voice call, and live audio and video on a video tour. Twilio carries the call. KidEase does not record it. Your phone number stays hidden.
• Claim and enrol (directors): centre identity, licence photo, verification code, and the enrol form (name, email, centre, city, phone, message).
• Payments: amount, method, status, and a KidEase reference: only if a deposit is recorded in-app. We do not store full card numbers.
• Technical: session cookies, device/browser needed to run the site, and first-party search telemetry (a coarse geohash, not a street address).

How we use it

• Show licensed centres near the place you chose and let you filter by distance.
• Send your inquiry, tour, or enrolment request to that centre and keep the conversation.
• Connect a voice call or video tour between you and that centre. The camera and microphone are used only while that call is open.
• Let a claimed director manage spots, fees, photos, and family messages.
• Notify KidEase support at support@kidease.ca of new accounts, claims, and requests so we can run the service.
• Send transactional email (sign-in codes, password reset, claim codes, request notices).
• Record a deposit when in-app payment is used, and improve search quality.
• We do not use children’s profiles for advertising or to train public machine-learning models.

Who processes data for us

KidEase is the organization responsible for personal information on kidease.ca. These companies process data only to run the named job. Some are in the United States. We give them only what that job needs.

• Google Maps, Places, and Geocoding. Map tiles, place suggestions, and turning an address or postal code into a search point. If you allow precise location, we may send a nearby coordinate so suggestions are local. Google does not get your child profiles. Google Privacy Policy ↗
• Google sign-in (OAuth), when you use it. If you tap Continue with Google, Google shares the name and email on that Google account so we can create or open your KidEase session. We do not receive your Google password. Google Privacy Policy ↗
• Better Auth (software we host). Session and password sign-in run on KidEase’s own servers (Vercel + Neon). Better Auth is the library we use: not a separate company that holds a copy of your account.
• Apple or Facebook sign-in, only when those buttons are on. If a Continue with Apple or Facebook button is shown and you use it, that provider shares the name and email they allow for sign-in. If the button is not shown, we are not using that provider.
• Resend. Transactional email we send today: password reset, sign-in verification codes, claim codes, and service notices (new request, claim, support). Resend Privacy Policy ↗
• Titan Email, when the kyle@kidease.ca inbox is connected. Receiving and sending operator mail for kyle@kidease.ca (support, claims, and replies). If Titan is not connected, those messages still go through Resend or stay in the app. Titan Privacy Policy ↗
• Vercel. Hosts the KidEase website and server functions (project kidease-git). Vercel Privacy Policy ↗
• Neon. Postgres database for accounts, listings, messages, child profiles, and payment records. Neon Privacy Policy ↗
• Cloudflare, when traffic is proxied through it. DNS or edge protection in front of the site. If a request is not proxied, Cloudflare does not see it. Cloudflare Privacy Policy ↗
• Stripe. Card, Apple Pay, and Google Pay for a first-month deposit after a centre offers a spot, and for KidEase plan charges. We send amount, currency (CAD), and a booking or plan reference: not full card numbers and not medical notes. Stripe processes the card. KidEase does not store the full card number. Stripe Privacy Policy ↗
• DocuSign, when centre paperwork is sent. eSignature for the licensed centre agreement and enrolment paperwork packs. KidEase sends the provider’s name and email, the document or template, and the envelope status. The signed PDF is stored on that daycare’s KidEase profile for the operator and KidEase admin. Until DocuSign keys are set, centres can still sign the in-app document. DocuSign Privacy Policy ↗
• PostHog, when product analytics is on. Page views, in-app clicks, feature flags, and privacy-masked session replay so we can improve KidEase. We send a random visitor id or your account id: not your password, email, or child-profile fields. Session replay masks form inputs and on-screen text. PostHog is not an advertising or remarketing pixel. PostHog Privacy Policy ↗
• Sentry, when error monitoring is on. Crash and performance reports so we can fix production bugs. We send stack traces and a route tag: not cookies, Authorization headers, emails, tokens, or child names. Sentry is not an advertising pixel. In the iPhone and Android app it starts only after you tap Allow analytics. Sentry Privacy Policy ↗
• Twilio, for voice and video calls. Live audio on a voice call, and live audio plus video on a video tour, between a parent and a daycare. Twilio receives that call media so the two people can hear and see each other. KidEase does not record the call. Phone numbers stay hidden. The Twilio scripts load only on the call page and the video page. Twilio Privacy Policy ↗
• Parent helper, when that guide is on. Short answers drawn from KidEase guide pages (fees programs, tours, search). It does not receive child health fields, and it does not invent a spot, a fee, or a licence. KidEase Help ↗

A centre you contact is not our processor. They receive what you send so they can reply, tour, or enrol. After that, they are responsible for how their staff handle it.

Location

Location is for distance search only: licensed centres near the point you chose. We do not share your location with other parents.

• GPS (precise location): we ask once. The prompt says we use precise location only while you search, and we never request background location. “Use precise location” allows a when-in-use fix. “Not now” leaves you on a typed city, address, or postal code.
• While Explore or Search is open and you have allowed when-in-use location, the map can update as you move. We do not request always-on or background location, and we do not track you after you leave the app.
• Typed address, city, or postal code: we send that text to Google Places / Geocoding to get a map point. If you also allowed GPS, we may send a nearby coordinate so suggestions are local.
• The map itself loads Google Maps in your browser (tiles and the map script).
• What we keep: your last search point and a yes/no location choice in this browser (local storage). First-party telemetry may store a coarse geohash (about neighbourhood scale) to improve search: not a street address and not a continuous trail.
• Raw GPS used to draw the map stays in that browsing session.
• Turn it off in your phone or browser location settings, tap “Not now” / change location in the app, or clear this site’s data. That stops new GPS use. It does not delete a request you already sent to a centre.

Cookies and local storage

We use cookies and similar storage to keep you signed in and remember search settings. We do not use advertising pixels or ad-tech trackers. On the website and in the iPhone and Android app, a banner asks you to choose Essential (required cookies only) or Allow analytics before we load PostHog. In the app, crash reports also wait for that Allow tap.

Read the Cookie Policy

What a parent shares with a centre

Nothing goes to a centre until you contact that centre. We do not put your child on a public board or show them to other parents.

• Inquire (💬 Contact): your name, email, and message, plus the listing name and link. That form goes to KidEase (support@kidease.ca) so we can help; we may pass it to the centre.
• Book a tour: parent name, child name, preferred date, optional note. This opens an in-app conversation with that centre. Birthdate is included if you enter it.
• Request a spot / enrol: parent name, child’s name, birthdate, start date, schedule, days, and optional message.
• Saved child profile: if you attach a profile that already has care details, that centre can also see allergies, epi-pen, medical notes, medications, doctor, foods, routines, emergency contacts, pickup people, and notes: because those fields help them offer safe care.
• Reuse: profiles stay on your account. We send them only to centres you contact. We do not reuse them for ads or for other families.
• Once a centre has the details, its staff are responsible for how they store and use them (their own privacy duties). Use KidEase messages for placement and care: not for marketing lists.

What we expect of centres

Directors and staff who claim a listing are running an organization, not a personal hobby page. When a parent sends you family or child details, treat them as that child’s information: not KidEase’s to resell, and not yours to use for ads.

• Use parent and child details only to reply, book a tour, enrol, and care for that child.
• Limit staff access to people who need it for that job.
• Do not post a child’s name, photo, or medical notes on a public listing or social page unless the parent has clearly agreed with you.
• Keep licence, spots, hours, and fees truthful. A false claim can get the listing paused.
• If a parent asks you to correct or delete what they sent, handle that request. Deleting a KidEase account does not pull copies off your own paper files or inbox.
• Screening certificates (Vulnerable Sector Checks, Child Abuse Registry, Prior Contact) stay with the daycare and the KidEase team. Parents never see the PDF or the person’s name. KidEase reviews files; it does not issue police checks.
• You remain responsible for your own PIPEDA (or provincial) duties as a childcare operator. KidEase is the platform, not the provider.

Payments (Stripe)

• Roles: a parent may pay a first-month deposit after the centre offers a spot. KidEase records the payment. The care contract stays between the parent and the centre. Childcare is a real-world service, not a digital in-app purchase.
• Stripe processes the card, Apple Pay, or Google Pay. KidEase never stores the full card number. We may send Stripe the amount, CAD, payment method type, and identifiers for the booking, parent, and centre: not allergy or medical notes.
• Interac e-Transfer and other bank methods may be added later. We will say so on the pay screen when they are on.
• Refunds follow the centre’s policy. Chargebacks go through Stripe. Email support@kidease.ca if a deposit looks wrong.

Sensitive child data and adults-only accounts

• Allergies, epi-pen, medical notes, medications, doctor name and phone, and emergency contacts are optional and parent-controlled. We collect them only when you type them, and only to help you and a centre you contact keep that child safe.
• Purpose limit: placement and care: not advertising, not sale, not training public or advertising machine-learning models.
• Only add a child you have the legal right to enrol (parent or guardian).
• Accounts are for adults 18 or older: parents, guardians, and centre directors. KidEase is not a children’s app and is not directed at children.
• We do not livestream children. Video or voice check-in, if offered, is started by the parent.
• Providers must be provincially or territorially licensed before they can claim and edit a listing.

Purpose and category

Storage and transfers outside Canada

KidEase is a Canadian company. Hosting and processors above may store or see data in the United States (Google, Vercel, Resend, Neon, Stripe, DocuSign when centre paperwork is sent, Cloudflare when proxied, PostHog when analytics is on, Sentry when error monitoring is on, Twilio when a voice or video call is open). We use them only to run this service and rely on their contracts and safeguards. We do not sell the data because it sits on a US server.

Email, CASL, and future alerts

• Transactional mail we send without a marketing opt-in: sign-in codes, password reset, claim codes, request and support notices, and similar service mail. These are not promotional.
• Search-alert email and any future KidEase news or offers need an unchecked-by-default CASL checkbox. We store who consented, when, the wording they saw, and the email or mobile. Unsubscribe at kidease.ca/unsubscribe, in alert or profile settings, or by replying STOP / ARRÊT to a text.
• We do not send promotional KidEase campaigns today. SMS alerts stay off until you grant express consent in your profile or alert settings. When enabled, we only text people who opted in, and we honour STOP immediately.
• Push or lock-screen alerts, when we enable them, will be opt-in on the device. You can turn them off in the operating system. We will not use push for ads.

Unsubscribe from marketing email or SMS

Text messages (SMS)

KidEase may send transactional and service text messages when you give a mobile number and opt in. Examples: sign-in or verification codes, tour or waitlist updates, centre-request notices, and support replies. Message frequency varies. Message and data rates may apply.

All the above categories exclude text messaging originator opt-in data and consent; this information won't be shared with any third parties.

• Consent is not a condition of using KidEase or of purchasing a plan.
• Reply STOP to cancel. You will get one confirmation text and then no further program messages.
• Reply HELP for help, or email kyle@kidease.ca.
• You can also turn SMS off in account or alert settings and at /unsubscribe.
• No mobile information will be shared with third parties or affiliates for marketing or promotional purposes.
• Twilio is our text-message processor. It receives the destination number and message body only to deliver that text. See https://www.twilio.com/en-us/legal/privacy

SMS program terms

Unsubscribe from marketing email or SMS

Retention, deletion, and security

• We keep account, request, message, and payment records while the account is open.
• Delete account, under Account, schedules the close. You can restore the account for 30 days. After that KidEase removes your children, messages, bookings, saved centres, director links, profile, and sign-in rows. We keep billing records because tax law requires them, and we keep fraud and security logs. Marketing email or SMS stops at /unsubscribe without deleting the account.
• Deletion does not erase copies a centre already received, emails already sitting in kyle@kidease.ca or Titan, or records a law or chargeback requires us to keep for a time.
• You can also email privacy@kidease.ca to access, correct, or delete.
• Security we actually use: HTTPS in transit; signed-in sessions in first-party cookies; OAuth tokens encrypted at rest; email sign-in codes; access checks on parent and director desks; payment card data stays with Stripe; audit events do not store card numbers or medical notes.
• We do not claim the internet is risk-free. If a breach creates a real risk of significant harm, we will notify affected people and the Office of the Privacy Commissioner of Canada as PIPEDA requires.

Quebec Law 25

This section is for Quebec’s Act respecting the protection of personal information in the private sector, as modernized by Law 25. The PIPEDA sections above still apply.

• Person in charge of the protection of personal information: Kyle Lernout, Privacy Officer, privacy@kidease.ca.
• Access or correction: email privacy@kidease.ca. Say what you want to see or change. You can also edit a child profile in your account, or close the account at /delete-account. We may ask you to confirm you hold the account before we change it.
• Consent: an account needs a name and an email. Allergies, medical notes, medications, and a doctor’s name and phone are optional. You type them, you can leave them blank, and you can change or delete them. A centre sees those details only after you contact that centre. We ask before using precise location. Marketing email and text stay off unless you check the box. Analytics loads only after you choose Allow analytics.
• Retention: we keep account, request, message, and payment records while the account is open. Delete account waits 30 days, then removes children, messages, bookings, saved centres, director links, the profile, and sign-in rows. We keep billing records because tax law requires them. We keep fraud and security logs. A centre that already received a message keeps its own copy.
• Where data is stored: accounts, listings, messages, child profiles, and payment records are in Neon Postgres. The website and server functions run on Vercel. When Cloudflare R2 is configured, listing photos, licence uploads, screening files, and signed contracts are stored in the kidease-media bucket. Our setup notes place that bucket in Western North America. Email we send goes through Resend. Card payments are processed by Stripe. KidEase does not store the full card number. Search maps can use Google. PostHog analytics and Sentry error reports run only when those tools are on. Analytics waits for Allow analytics. Centre paperwork can use DocuSign when that service is connected. Mail to the privacy address can be read in Titan Email when that mailbox is connected.
• Confidentiality incidents: if an incident creates a risk of serious injury, we will tell the people affected. We will tell the Commission d'accès à l'information du Québec when Quebec law requires it, and the Office of the Privacy Commissioner of Canada when PIPEDA requires it.
• Transfers outside Quebec: Quebec law requires a privacy impact assessment before personal information is communicated outside Quebec. Some processors named on this page may store or see information outside Quebec, including in the United States. We send only what that job needs and rely on their contracts. We do not publish a separate assessment file for each processor on this site. Questions about a transfer go to privacy@kidease.ca.

Quebec recognized home daycares

KidEase is a Canadian company. When we publish a Quebec recognized home daycare (milieu familial reconnu), we follow Quebec's Law 25 and PIPEDA.

• These listings are stored apart from licensed centre listings.
• If the name on the source page is a person's name, the public page says Recognized home daycare and the municipality instead.
• We show the municipality, the neighbourhood, or the first three characters of the postal code. We do not show a street address or an exact map pin. The map, when we have a town point, is an area circle.
• A badge names the bureau coordonnateur and the date we checked their public page, and links to that page.
• Phone and email stay hidden until a visitor chooses to show them.
• Open spots, when the source lists a number, are shown with that date. The number may be out of date. We do not invent a number.
• We do not email or text these providers. Canada's anti-spam law (CASL) applies. The provider can ask us to correct or remove the listing from the page. We store that request for an admin to review. We do not send a message back.
• The public directory is at /milieux-familiaux when this list is turned on.
• Person in charge of the protection of personal information: Kyle Lernout, Privacy Officer, privacy@kidease.ca. You can also contact the Commission d'accès à l'information du Québec, or the Office of the Privacy Commissioner of Canada.

Your rights

You can access, correct, or delete your account and child profiles at /delete-account, in the app, or by emailing privacy@kidease.ca. You can withdraw marketing consent at /unsubscribe, by closing the account, or by turning off location in the OS. For a PIPEDA complaint you can also contact the Office of the Privacy Commissioner of Canada.

Changes to this page

We will post a new effective date here when the policy changes. If a change is material and we have your email, we will also send a short notice.