Privacy Policy

Childcare KPI is operated from Ohio, USA. This policy describes how we handle information when you use our website and dashboard. We manage account and billing information to operate the service. For financial and enrollment information supplied by a childcare organization, we process that information on the organization's behalf to provide its dashboard; the childcare provider remains responsible for its relationships with families and its lawful instructions to us.

Account and organization information: your name, email, authentication credentials handled by our login service, business name, state, centers, capacities, team invitations, and membership roles.

QuickBooks information: account names and identifiers, classes and locations, financial reports such as profit and loss, and derived revenue, labor, expense, and operating-income figures. We store encrypted connection tokens so authorized syncing can continue.

Enrollment and Brightwheel files: supported uploads may include children's names, attendance schedules, dates, centers, room labels, and enrollment counts. The current upload flow parses files in your browser rather than storing the original files. We retain computed KPI values, room-count records, file names, uploader information, and validation errors. Child-name columns are not needed for the current enrollment calculation; avoid including names or other identifiers unless necessary. File names or validation messages may themselves reveal information you included.

Billing information: Stripe customer and subscription identifiers, plan interval, center quantity, subscription status, trial and billing dates, and relevant payment-failure or promotion information. We never store card numbers; Stripe collects and processes card details.

Contact and operational information: information you put in a contact or demo request, and limited technical or security logs needed to run and protect the service. Website-wide contact requests are accessible to organization owners through the owner inbox; do not include children's information, confidential financial reports, or credentials in these messages.

QuickBooks financial information and enrollment/Brightwheel information are used only to calculate and display the customer's dashboard: its KPIs, history, center comparisons, room counts, and related import results. We do not use this information for advertising, unrelated profiling, or sale.

Account and operational information is used to authenticate users, enforce organization access, manage invitations, maintain security, respond to requests, and deliver essential service notices. Billing information is used to manage trials and subscriptions through Stripe. Contact information is used to respond to your inquiry. We do not use children's information to contact or market to children or families.

Our QuickBooks operations are read-only. We retrieve reports and reference information and do not create, edit, or delete transactions. You can disconnect anytime in Settings → QuickBooks or revoke through Intuit. We remove locally stored connection tokens, stop future syncing, and request Intuit revocation. If revocation cannot be completed, you can revoke directly in Intuit. Imported dashboard values remain until separately deleted.

Intuit data is used only for the requested dashboard purpose. It is never sold, rented, traded, or shared with advertisers, data brokers, or unrelated third parties. Essential hosting and authorized organization users necessarily handle or access it to deliver your dashboard. We do not send your QuickBooks reports to Stripe. Any disclosure legally required of us is limited to what the law requires.

The service uses Lovable Cloud's managed database and authentication hosting. Data travels over encrypted HTTPS/TLS connections. QuickBooks access and refresh tokens are additionally encrypted with AES-GCM before being stored and are not exposed to browser users. Authentication credentials are handled by the authentication service, not displayed in the dashboard.

Database row-level security limits ordinary access to organization data according to membership and owner, manager, or viewer permissions. Sensitive connection-token storage has no ordinary client access. Authorized server operations use separate protected access and checks. These controls reduce risk but cannot guarantee absolute security. Keep account credentials secure and invite only authorized people.

Our hosting and authentication providers process information to run and secure the service. Stripe processes payments under its own privacy policy; we do not store payment-card numbers. Intuit supplies data you authorize and governs its own account and authorization services. Providers receive only information needed for their role, and financial or enrollment information is not shared for unrelated commercial purposes.

We may disclose limited information where legally required, to respond to valid legal process, or to protect against unlawful access or threats to the service. We do not sell personal or business data, including children's information.

Childcare KPI is intended for adult childcare owners and authorized staff, not children. We do not invite children to create accounts or knowingly collect information directly from children. A provider may supply children's names or schedules in enrollment files. We handle that information on behalf of the provider solely for the dashboard, not as a separate consumer service for the child.

The provider is responsible for lawful collection, necessary family notices and permissions, and responding to families' rights requests. Parents or guardians should first contact their childcare provider about a child's records. If you contact us, we will coordinate with the provider and verify authority before disclosing, changing, or deleting organization data. Please minimize identifying information in uploads.

We retain dashboard and account information while your account is active as needed to provide the service. Disconnecting QuickBooks deletes our stored connection tokens but does not automatically erase previously imported figures. Undoing an upload removes the KPI and room-count records associated with that upload; its history may remain as an audit record.

An authorized organization owner may request deletion or account closure by emailing info@childcarekpi.com. Following verification, we arrange deletion of organization dashboard data and unneeded account records when the account is closed or a deletion request is approved. Requests are handled without undue delay, subject to applicable law; we confirm the scope and timing rather than promise instant deletion.

We may retain limited information where needed for legal, tax, billing, fraud-prevention, or dispute obligations. Residual copies may remain in protected backups until those backups expire through normal retention cycles and are not used for ordinary service delivery. Stripe and Intuit retain information under their own policies. Cancelling payment alone is not an account-closure request.

You can review and update available account or center details, control organization memberships if authorized, disconnect QuickBooks, stop providing uploads, and request access to or correction or deletion of information held about you or your organization. You may also request a copy of your data or ask about restrictions, objections, or other rights available under applicable law.

Email info@childcarekpi.com with your request. We may verify your identity and authority and coordinate with your organization before acting. Rights may be subject to legal exceptions and retention requirements. We will explain any limitation and respond according to applicable law. We do not sell data, so there is no sale to opt out of. Requests involving a child's records should normally be directed to the childcare provider.

We do not add advertising cookies, cross-site tracking, or marketing analytics cookies. Authentication may use necessary cookies or browser storage to keep you signed in and protect your session. The app also uses browser storage for your selected demo mode and a promo code you choose to use; these values are not advertising trackers. No additional tracking cookies are required to browse the public pages.

You can clear browser storage using your browser settings, but doing so may sign you out or reset choices. Third-party Stripe or Intuit pages have their own cookie and privacy practices when you visit them.

We update the date at the top when this policy changes. Material changes are announced by email to the account contact or a prominent in-app notice before they take effect, with the effective date stated. Updated wording is posted here.

For privacy questions, access or correction requests, data deletion, or account closure, email info@childcarekpi.com. Childcare KPI is operated from Ohio, USA. Our Terms of Use and End-User License Agreement explain subscription and service conditions.