1. Who is responsible for what
- The nursery decides why and how the information about its children, parents and staff is used. For that information the nursery is the controller (in Canada, the organization responsible) and SphereHub is its processor (service provider): we handle it only on the nursery's instructions, to provide the Service.
- SphereHub is the controller of the information we keep about the people who sign up and sign in for a nursery (account, billing and security records), about visitors to our own pages, and about people who contact us.
Parents and carers who want to see, correct or delete their child's information should ask the nursery first. We help the nursery answer.
2. What we handle
- Account details: name, email address, a hashed password, passkeys, two-step sign-in settings, sign-in times and network addresses.
- Billing details: plan, invoices and payments between SphereHub and the nursery. Card numbers are handled by our payment provider and never stored by us.
- Nursery records, on the nursery's behalf: children, parents and carers, emergency contacts, health and dietary notes, attendance, daily reports, photos and videos, messages, invoices and payments, staff, and the compliance records a nursery keeps (for example CWELCC fees, wages and closures in Canada).
- Sign-up requests: the details given when a nursery asks to join, including country, province and Region, and which version of our terms was accepted and when.
- Website and contact: messages you send us and, on our public website, basic usage figures.
- Technical records: security and audit logs that show who changed what and when.
3. Why we use it
To provide and secure the Service, to bill for it, to give support, to meet legal duties and to improve the Service. Where the law requires a legal basis, it is the contract with the nursery, our legitimate interest in running a secure service, consent where we ask for it, or a legal duty. Nursery records are used only as the nursery instructs. We do not sell personal information, we do not show advertising inside the Service, and we do not use nursery records to train artificial intelligence models.
4. Where and how it is kept
Each nursery's records are kept in a separate database. Production data is hosted with our hosting provider (the country is available on request). Secrets such as API keys are stored encrypted. Connections use encryption in transit. Access is limited to people who need it and is recorded. Sign-in can be protected with two-step verification and passkeys, and a nursery can limit access to chosen network addresses. Backups are encrypted and kept for a limited time.
5. Who we share it with
We use service providers to run the Service and share only what they need. The list below is kept current in the Data Processing Addendum, with a notice period for changes.
- payment providers, to take card payments;
- email delivery providers, to send messages such as invitations and receipts;
- push notification services, to deliver phone notifications, if the nursery uses the apps;
- accounting software, only if the nursery connects it, and only the invoices and payments the nursery chooses to send;
- hosting, network and infrastructure providers.
We may also disclose information when the law requires it, and we tell the nursery when we are allowed to.
6. How long we keep it
Nursery records are kept while the nursery uses the Service. When a nursery is deleted, its data is removed after a grace period of 14 days, and from backups as they expire. Account, billing and security records are kept as long as needed for the purposes above and for legal and accounting duties, then deleted or made anonymous.
7. Children's information
Information about children is entered by the nursery, which is responsible for having the parents' consent where it is needed (for example for photos). We use it only to provide the Service to that nursery. The Service is not directed to children, and children do not hold accounts.
8. Security incidents
If we confirm an incident that affects personal information, we tell the nursery without undue delay and within 72 hours, with what happened, what information is involved and what we are doing. The nursery decides whether and how to notify families and regulators, and we help with that.
9. Your rights
You can ask for access to, correction of, deletion of or a copy of your personal information, and you can object to or limit some uses, as the law where you live allows. Write to help@spherehub.co, and we answer within 30 days. If you are not satisfied, you can complain to your data protection authority.
10. Cookies
We use only the cookies the Service needs to work: to keep you signed in, to protect forms against forgery, to remember your language and, if you ask, to remember you on this device. We do not use advertising cookies in the Service.
11. International transfers
Some of our providers may handle information outside your country. When that happens we use contracts and safeguards that give it the protection the law requires, and the section for your country below says more.
12. Changes
We update this policy when our practices change and show the version and date at the top. We tell nurseries about important changes by email.
13. Contact
The person responsible for privacy at SphereHub can be reached at help@spherehub.co.
Canada
- Laws. We handle personal information in line with the federal Personal Information Protection and Electronic Documents Act (PIPEDA), Quebec's Act respecting the protection of personal information in the private sector (Law 25), and the Alberta and British Columbia Personal Information Protection Acts where they apply.
- Roles. The nursery is the organization responsible for its children's, families' and staff records. We are its service provider and use them only to provide the Service.
- Person responsible. Our person responsible for privacy answers questions and complaints at help@spherehub.co. A Quebec nursery can also ask us for the information Law 25 requires, in French.
- Quebec. When personal information of people in Quebec is communicated outside Quebec, the nursery's privacy impact assessment can rely on this page and the Data Processing Addendum. Ask us for help with it.
- Incidents. For an incident that creates a real risk of significant harm, we give the nursery what it needs to notify the Office of the Privacy Commissioner of Canada, the Commission d'accès à l'information du Québec or the provincial commissioner, and the people concerned, and we keep a record of every incident.
- Funding records. CWELCC fees, wages, closures and similar records belong to the nursery. We keep them as part of its records and do not send them to a Region or ministry ourselves.
- Complaints. You can complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca), the Commission d'accès à l'information du Québec (cai.gouv.qc.ca) or your provincial commissioner.