PIPEDA & child safety

What we collect

• Account: name, email, password or sign-in provider, optional phone and profile photo, role (parent or centre director).
• Child profiles you add: first or full name, birthdate, allergies, epi-pen flag, medical notes, medications, doctor, foods, routines, comfort items, emergency contacts, pickup people, and care notes.
• Search location you choose: a GPS fix while you search, or a typed address, city, or postal code.
• Requests and messages: inquire, book-a-tour, and request-a-spot fields, plus in-app chat with that centre.
• Claim and enrol (directors): centre identity, licence photo, verification code, and the enrol form (name, email, centre, city, phone, message).
• Payments: amount, method, status, and a KidEase reference — only if a deposit is recorded in-app. We do not store full card numbers.
• Technical: session cookies, device/browser needed to run the site, and first-party search telemetry (a coarse geohash, not a street address).

How we use it

• Show licensed centres near the place you chose and let you filter by distance.
• Send your inquiry, tour, or enrolment request to that centre and keep the conversation.
• Let a claimed director manage spots, fees, photos, and family messages.
• Notify kyle@kidease.ca of new accounts, claims, and requests so we can run the service.
• Send transactional email (sign-in codes, password reset, claim codes, request notices).
• Record a deposit when in-app payment is used, and improve search quality.
• We do not use children’s profiles for advertising or to train public machine-learning models.

Who processes data for us

KidEase is the organization responsible for personal information on kidease.ca. These companies process data only to run the named job. Some are in the United States. We give them only what that job needs.

• Google Maps, Places, and Geocoding. Map tiles, place suggestions, and turning an address or postal code into a search point. If you allow precise location, we may send a nearby coordinate so suggestions are local. Google does not get your child profiles. Google Privacy Policy ↗
• Google sign-in (OAuth), when you use it. If you tap Continue with Google, Google shares the name and email on that Google account so we can create or open your KidEase session. We do not receive your Google password. Google Privacy Policy ↗
• Better Auth (software we host). Session and password sign-in run on KidEase’s own servers (Vercel + Neon). Better Auth is the library we use — not a separate company that holds a copy of your account.
• Apple or Facebook sign-in, only when those buttons are on. If a Continue with Apple or Facebook button is shown and you use it, that provider shares the name and email they allow for sign-in. If the button is not shown, we are not using that provider.
• Resend. Transactional email we send today: password reset, sign-in verification codes, claim codes, and service notices (new request, claim, support). Resend Privacy Policy ↗
• Titan Email, when the kyle@kidease.ca inbox is connected. Receiving and sending operator mail for kyle@kidease.ca (support, claims, and replies). If Titan is not connected, those messages still go through Resend or stay in the app. Titan Privacy Policy ↗
• Vercel. Hosts the KidEase website and server functions (project kidease-git). Vercel Privacy Policy ↗
• Neon. Postgres database for accounts, listings, messages, child profiles, and payment records. Neon Privacy Policy ↗
• Cloudflare, when traffic is proxied through it. DNS or edge protection in front of the site. If a request is not proxied, Cloudflare does not see it. Cloudflare Privacy Policy ↗
• Stripe, when card payments are enabled. Card, Apple Pay, and Google Pay for a first-month deposit after a centre offers a spot. We send amount, currency (CAD), and a booking reference — not full card numbers and not medical notes. Until a live Stripe key is on, charges stay on KidEase’s internal ledger and are not taken from a card. Stripe Privacy Policy ↗
• DocuSign, when centre paperwork is sent. eSignature for the licensed centre agreement and enrolment paperwork packs. KidEase sends the provider’s name and email, the document or template, and the envelope status. The signed PDF is stored on that daycare’s KidEase profile for the operator and KidEase admin. Until DocuSign keys are set, centres can still sign the in-app document. DocuSign Privacy Policy ↗
• PostHog, when product analytics is on. Page views, in-app clicks, feature flags, and privacy-masked session replay so we can improve KidEase. We send a random visitor id or your account id — not your password, email, or child-profile fields. Session replay masks form inputs and on-screen text. PostHog is not an advertising or remarketing pixel. PostHog Privacy Policy ↗
• Sentry, when error monitoring is on. Crash and performance reports so we can fix production bugs. We send stack traces and a route tag — not cookies, Authorization headers, emails, tokens, or child names. Sentry is not an advertising pixel. Sentry Privacy Policy ↗

A centre you contact is not our processor. They receive what you send so they can reply, tour, or enrol. After that, they are responsible for how their staff handle it.

Location

Location is for distance search only — licensed centres near the point you chose. We do not share your location with other parents.

• GPS (precise location): we ask once. The prompt says we use precise location only while you search, and we never request background location. “Use precise location” allows a when-in-use fix. “Not now” leaves you on a typed city, address, or postal code.
• While Explore or Search is open and you have allowed when-in-use location, the map can update as you move. We do not request always-on or background location, and we do not track you after you leave the app.
• Typed address, city, or postal code: we send that text to Google Places / Geocoding to get a map point. If you also allowed GPS, we may send a nearby coordinate so suggestions are local.
• The map itself loads Google Maps in your browser (tiles and the map script).
• What we keep: your last search point and a yes/no location choice in this browser (local storage). First-party telemetry may store a coarse geohash (about neighbourhood scale) to improve search — not a street address and not a continuous trail.
• Raw GPS used to draw the map stays in that browsing session.
• Turn it off in your phone or browser location settings, tap “Not now” / change location in the app, or clear this site’s data. That stops new GPS use. It does not delete a request you already sent to a centre.

Cookies and local storage

We use cookies and similar storage to keep you signed in and remember search settings. We do not use advertising pixels or ad-tech trackers. On the website, a banner asks you to choose Essential (required cookies only) or Allow analytics before we load PostHog or session replay. The native iPhone and Android app does not show this banner.

Read the Cookie Policy

What a parent shares with a centre

Nothing goes to a centre until you contact that centre. We do not put your child on a public board or show them to other parents.

• Inquire (💬 Contact): your name, email, and message, plus the listing name and link. That form goes to KidEase (support@kidease.ca) so we can help; we may pass it to the centre.
• Book a tour: parent name, child name, preferred date, optional note. This opens an in-app conversation with that centre. Birthdate is included if you enter it.
• Request a spot / enrol: parent name, child’s name, birthdate, start date, schedule, days, and optional message.
• Saved child profile: if you attach a profile that already has care details, that centre can also see allergies, epi-pen, medical notes, medications, doctor, foods, routines, emergency contacts, pickup people, and notes — because those fields help them offer safe care.
• Reuse: profiles stay on your account. We send them only to centres you contact. We do not reuse them for ads or for other families.
• Once a centre has the details, its staff are responsible for how they store and use them (their own privacy duties). Use KidEase messages for placement and care — not for marketing lists.

What we expect of centres

Directors and staff who claim a listing are running an organization, not a personal hobby page. When a parent sends you family or child details, treat them as that child’s information — not KidEase’s to resell, and not yours to use for ads.

• Use parent and child details only to reply, book a tour, enrol, and care for that child.
• Limit staff access to people who need it for that job.
• Do not post a child’s name, photo, or medical notes on a public listing or social page unless the parent has clearly agreed with you.
• Keep licence, spots, hours, and fees truthful. A false claim can get the listing paused.
• If a parent asks you to correct or delete what they sent, handle that request. Deleting a KidEase account does not pull copies off your own paper files or inbox.
• Screening certificates (Vulnerable Sector Checks, Child Abuse Registry, Prior Contact) stay on the daycare and Admin desks. Parents never see the PDF or the person’s name. KidEase reviews files; it does not issue police checks.
• You remain responsible for your own PIPEDA (or provincial) duties as a childcare operator. KidEase is the platform, not the provider.

Payments (Stripe when enabled)

• Roles: a parent may pay a first-month deposit after the centre offers a spot. KidEase records the payment. The care contract stays between the parent and the centre. Childcare is a real-world service, not a digital in-app purchase.
• When Stripe is live: Stripe processes the card, Apple Pay, or Google Pay. KidEase never stores the full card number. We may send Stripe the amount, CAD, payment method type, and identifiers for the booking, parent, and centre — not allergy or medical notes.
• When Stripe is not live: the app can still show a receipt on an internal ledger. No card is charged.
• Interac e-Transfer and other bank methods may be added later. We will say so on the pay screen when they are on.
• Refunds follow the centre’s policy. Chargebacks, when Stripe is on, go through Stripe. Email support@kidease.ca if a deposit looks wrong.

Sensitive child data and adults-only accounts

• Allergies, epi-pen, medical notes, medications, doctor contacts, and emergency contacts are sensitive. We collect them only to help you and a centre you contact keep that child safe.
• Purpose limit: placement and care — not advertising, not sale, not training public or advertising machine-learning models.
• Only add a child you have the legal right to enrol (parent or guardian).
• Accounts are for adults 18 or older — parents, guardians, and centre directors. KidEase is not a children’s app and is not directed at children.
• We do not livestream children. Video or voice check-in, if offered, is started by the parent.
• Providers must be provincially or territorially licensed before they can claim and edit a listing.

Purpose and category

Storage and transfers outside Canada

KidEase is based in Winnipeg, Manitoba. Hosting and processors above may store or see data in the United States (Google, Vercel, Resend, Neon, Stripe when enabled, DocuSign when centre paperwork is sent, Cloudflare when proxied, PostHog when analytics is on, Sentry when error monitoring is on). We use them only to run this service and rely on their contracts and safeguards. We do not sell the data because it sits on a US server.

Email, CASL, and future alerts

• Transactional mail we send without a marketing opt-in: sign-in codes, password reset, claim codes, request and support notices, and similar service mail. These are not promotional.
• Search-alert email and any future KidEase news or offers need an unchecked-by-default CASL checkbox. We store who consented, when, the wording they saw, and the email or mobile. Unsubscribe at kidease.ca/unsubscribe, in alert or profile settings, or by replying STOP / ARRÊT to a text.
• We do not send promotional KidEase campaigns today. FEATURE_SMS stays off until express SMS consent is on file. When SMS is on, we will only text a parent or provider who granted consent, and we honour STOP immediately.
• Push or lock-screen alerts, when we enable them, will be opt-in on the device. You can turn them off in the operating system. We will not use push for ads.

Retention, deletion, and security

• We keep account, request, message, and payment records while the account is open.
• Delete my account at /delete-account (or in the app) removes your children, messages, bookings, payments, saved centres, director links, profile, and sign-in rows on KidEase. This cannot be undone. Marketing email or SMS stops at /unsubscribe without deleting the account.
• Deletion does not erase copies a centre already received, emails already sitting in kyle@kidease.ca or Titan, or records a law or chargeback requires us to keep for a time.
• You can also email support@kidease.ca to access, correct, or delete.
• Security we actually use: HTTPS in transit; signed-in sessions in first-party cookies; OAuth tokens encrypted at rest; email sign-in codes; access checks on parent and director desks; payment card data (when Stripe is on) stays with Stripe; audit events do not store card numbers or medical notes.
• We do not claim the internet is risk-free. If a breach creates a real risk of significant harm, we will notify affected people and the Office of the Privacy Commissioner of Canada as PIPEDA requires.

Your rights

You can access, correct, or delete your account and child profiles at /delete-account, in the app, or by emailing support@kidease.ca. You can withdraw marketing consent at /unsubscribe, by closing the account, or by turning off location in the OS. For a PIPEDA complaint you can also contact the Office of the Privacy Commissioner of Canada.

Changes to this page

We will post a new effective date here when the policy changes. If a change is material and we have your email, we will also send a short notice.