Privacy Policy

1. Introduction

TinyRoots Pro ("we", "our", or "us") provides early childcare and family child care home (FCCH) management software through our web portal (app.tinyrootspro.com) and native mobile applications (iOS and Android).

This Privacy Policy explains how we collect, use, disclose, and safeguard personal and organizational information when licensed child care operators, staff members, parents, and authorized guardians use our services.

2. Information We Collect

We collect information only as necessary to provide childcare operations, maintain emergency safety rosters, and support regulatory compliance under California Title 22 (CCR) and California Health and Safety Code:

A. Account & Authentication Information

• Staff & Admin Users: Full name, professional email address, phone number, role, facility affiliation, and login credentials authenticated via Keycloak.
• Parents & Guardians: Full name, email address, phone number, and relationship to enrolled children.

B. Child Roster & Care Information

• Child Profiles: Child legal name, date of birth, enrollment dates, schedule (full-time/part-time), allergies, special medical needs, and immunization dates (required under California child care health regulations).
• Authorized Pickup Contacts: Full name, relationship, contact telephone number, and emergency contact priority.

C. Attendance & Check-In Records

• Digital check-in and check-out timestamps, caregiver verification, signature records, and emergency pickup authorization notes as mandated by California Code of Regulations (CCR § 102419).

D. Photos & User Content

• Emergency ID Verification Photos: Photos taken or uploaded by facility staff solely to verify the identity of an unlisted or emergency pickup person.
• Child Photos & Moments: Photos captured by staff to document daily activities and shared exclusively with the enrolled child's verified guardians.

E. Tuition & Billing Records

• Invoices, rate tiers, attendance-based tuition calculations, and state child care subsidy claim numbers. We do not store raw credit card numbers or banking passwords on our servers.

F. Device & Technical Logs

• Operating system version, device identifiers, IP address, and application crash diagnostics used strictly for service reliability, offline sync reconciliation, and debugging.

3. How We Use Your Information

We process collected data exclusively for the following purposes:

• Service Delivery: Facilitating attendance tracking, real-time caregiver-to-child ratio monitoring, child profiles, and billing calculations.
• California Regulatory Compliance: Generating inspection-ready attendance audit trails (CCR § 102419), incident logs (CCR § 102424), and Title 22 capacity ratio safeguards.
• Safety & Emergency Pickup Verification: Ensuring children are released only to verified guardians and authorized emergency contacts.
• Parent Communication: Sending parents real-time check-in/out confirmation notices, daily moments, and emergency alerts.
• System Security & Diagnostics: Maintaining platform stability, protecting against unauthorized access, and resolving technical support issues.

4. Information Sharing & Disclosure

We do not sell, rent, or lease your personal information or child data to third parties. We disclose data only in the following limited circumstances:

• Within Your Facility Organization: Authorized facility staff and verified guardians can only view records for children under their direct care or guardianship.
• Trusted Infrastructure Providers: Encrypted hosting and cloud infrastructure providers (e.g., database hosting, object storage, and transactional messaging) operating under strict data protection agreements.
• Regulatory & Legal Authorities: If required by California Community Care Licensing Division (CCLD), Child Protective Services, law enforcement, or valid court order to protect child welfare or comply with state law.

5. Multi-Tenant Data Isolation & Security

We employ enterprise-grade security controls to protect sensitive child care data:

• Multi-Tenant Isolation: All database queries strictly partition data by facility tenant (tenant_id). Cross-facility data leakage is blocked at both the database and API authorization layers.
• Encryption: Data is encrypted in transit using Transport Layer Security (TLS 1.3) and encrypted at rest on storage volumes.
• Role-Based Access Control (RBAC): Privileged actions (such as editing ratios, billing, or incident records) require authenticated staff or administrator roles.

6. Children's Privacy

Protecting young children's privacy is our highest priority:

• Our applications are operated by adult childcare providers, educators, and adult parents/guardians. Children are not given user accounts and do not directly access the platform.
• Child information is collected and processed solely on behalf of the licensed child care facility and under the authorization of the child's legal parent or guardian.
• We do not build commercial profiles on children, and we never use child information for behavioral marketing.

7. Data Retention & Your Rights

Under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), you have specific rights regarding your personal information:

• Access & Portability: You may request an export of your personal information and child records.
• Correction: You may request correction of inaccurate profile or contact records.
• Deletion: You may request account deletion. Please note that certain attendance and incident logs must be retained for the minimum statutory period mandated by California Title 22 licensing regulations (e.g., 3 years for attendance records under CCR § 102419).

To exercise these rights, please contact us at [email protected] or [email protected].

8. Updates to this Policy

We may update this Privacy Policy from time to time to reflect operational, legal, or regulatory changes. When changes are made, we will update the "Last Updated" date at the top of this policy and notify active facility administrators.

9. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact our privacy team:

• Email: [email protected]
• Support: [email protected]
• Website: https://tinyrootspro.com