Privacy Policy

Who uses it and who decides about the data

KidEntry is used by churches, schools, events and other organizations that register children, guardians and staff. As a rule, the organization defines which data is entered, who can access it and how long it must be kept. KidEntry provides the technology to store, query, sync and protect that information.

Data we may process

Depending on how the organization configures and uses the system, the following may be processed:

• Child data, such as first and last name, date of birth, class, room, photo, sex for the avatar, dietary restrictions, health notes and specific needs.
• Guardian data, such as name, relationship, phone, email, identification document, photo, protected password and the link to one or more children.
• Staff data, such as name, access profile, contact, email, phone, tax ID when provided, photo and protected password.
• Check-in and checkout records, including time, room, class, operator and the operational information needed to confirm entry, stay and pickup.
• Consents, including type, version of the accepted text, date, any revocation and minimal technical signature data such as IP and browser, when collected.
• Subscription and billing data of the organization, such as plan, status and Stripe customer, subscription and price IDs, without storing full card numbers in KidEntry.
• Technical data, such as session identifiers, audit logs, push notification tokens, errors, browser, device and security records.

What the data is used for

We use personal data to deliver KidEntry's core functions: creating accounts, authenticating users, organizing rooms and classes, recording attendance, identifying who may pick a child up, issuing labels and QR codes, sending notices, supporting service and meeting legal, contractual, tax, security and audit obligations.

We do not sell personal data and we do not use children's data for behavioral advertising. We also do not allow guardians or children to publish content that is open to other users outside the organization's context.

Data protection law and children's data

Children's data requires special care. The organization must collect and record parental or guardian consent where the law requires it, and must enter only the data necessary for care, safety, identification and operating the service. KidEntry offers consent records and access controls to support that routine.

Sensitive information, such as health notes, dietary restrictions, specific needs and legal pickup restrictions, should be filled in only when it is useful to protect the child or to meet an obligation of the organization.

Services that may process data

To run the platform, some vendors may process data on our behalf or on behalf of the organization:

• Application database and hosting, used to keep accounts, records, attendance, auditing and settings.
• S3-compatible file storage, such as AWS S3, SeaweedFS, MinIO or an equivalent service, used for photos, logos and images needed for registration.
• AWS SES or another SMTP provider configured by the operator, used for transactional email, email tests, invitations and account recovery.
• Stripe, used for checkout, the billing portal, invoices and the organization's subscription status.
• Firebase Cloud Messaging and Apple Push Notification service, when enabled, used to deliver notifications to Android, Web and iOS devices.

These services must be configured with the operator's own accounts and protected credentials. KidEntry avoids exposing secrets in the browser and keeps real keys out of the repository.

Offline use and on-device cache

KidEntry can run as a PWA and keep temporary data in the browser or app so the team can browse and record check-ins even on an unstable connection. This cache may include lists of children, rooms, classes, attendance status and actions pending upload.

That data stays on the device used by the team member or guardian and is synchronized with the server once the connection returns. We therefore recommend using password-protected devices, avoiding uncontrolled shared devices and signing out when appropriate.

Retention and deletion

We keep data for as long as needed to provide the service, preserve the safety history, meet legal obligations or serve the organization's legitimate interests, such as pickup and attendance auditing. Plans may limit how much history is available.

When an organization, guardian or data subject requests deletion, the request is reviewed considering legal obligations, child safety, consent records, auditing and fraud prevention. Locally cached data may need to be removed on the device itself by signing out, clearing the app/browser or syncing again.

Data subject rights

Parents, guardians, staff members and other data subjects may request confirmation of processing, access, correction, portability where applicable, information about sharing, review of consents, objection and deletion, within legal and operational limits. The most direct path is to speak first with the organization that created the record.

Security

KidEntry uses controls such as authentication, protected sessions, access profiles, audit logs, per-organization separation, HTTPS in production, passwords stored in protected form and care with environment secrets. No platform is free of risk, but we work to reduce exposure and limit access to what is necessary.

Contact

For questions about a specific record, contact the organization responsible for it. For technical questions or platform-related requests, use the support channel listed in the app or in the organization's contract.