1. Who is responsible for what
- The nursery decides why and how the information about its children, parents and staff is used. For that information the nursery is the controller and SphereHub is its processor: we handle it only on the nursery's instructions, to provide the Service.
- SphereHub is the controller of the information we keep about the people who sign up and sign in for a nursery (account, billing and security records) and about visitors to our own pages.
Parents and carers who want to see, correct or delete their child's information should ask the nursery first.
2. What we handle
- Account details: name, email address, a hashed password, passkeys, two-step sign-in settings, sign-in times and addresses.
- Billing details: plan, invoices and payments between SphereHub and the nursery.
- Nursery records, on the nursery's behalf: children, parents and carers, emergency contacts, health and dietary notes, attendance, daily reports, photos and videos, messages, invoices and payments, and staff.
- Sign-up requests: the details given when a nursery asks to join.
- Technical records: security and audit logs that show who changed what and when.
3. Why we use it
To provide and secure the Service, to bill for it, to give support, to meet legal duties and to improve the Service. Where the law requires a legal basis, it is the contract with the nursery, our legitimate interest in running a secure service, or a legal duty. Nursery records are used only as the nursery instructs.
4. Where and how it is kept
Each nursery's records are kept in a separate database. Secrets such as API keys are stored encrypted. Connections use encryption in transit. Access is limited to people who need it and is recorded. Sign-in can be protected with two-step verification and passkeys, and a nursery can limit access to chosen network addresses.
5. Who we share it with
We do not sell personal information. We use service providers to run the Service, and we share only what they need:
- payment providers such as Stripe, to take card payments;
- email delivery providers, to send messages such as invitations and receipts;
- Google Firebase Cloud Messaging, to deliver phone notifications, if the nursery uses the apps;
- accounting software such as Zoho Books, QuickBooks Online or Xero, only if the nursery connects it, and only the invoices and payments the nursery chooses to send;
- hosting and infrastructure providers.
We may also disclose information when the law requires it.
6. How long we keep it
Nursery records are kept while the nursery uses the Service. When a nursery is deleted its data is removed after a grace period. Account, billing and security records are kept as long as needed for the purposes above and for legal and accounting duties.
7. Children's information
Information about children is entered by the nursery, which is responsible for having the parents' consent where it is needed (for example for photos). We use it only to provide the Service to that nursery.
8. Your rights
You can ask for access to, correction of, deletion of or a copy of your personal information, and you can object to or limit some uses, as the law where you live allows. Write to support@next.spherehub.co. If you are not satisfied, you can complain to your data protection authority.
9. Cookies
We use only the cookies the Service needs to work: to keep you signed in, to protect forms against forgery, to remember your language and, if you ask, to remember you on this device. We do not use advertising cookies.
10. Changes
We will update this policy when our practices change and show the date at the top. We will tell you about important changes.
11. Contact
SphereHub, support@next.spherehub.co, next.spherehub.co