Privacy Policy

Effective date and contact

Effective date: July 1, 2026.

For privacy requests, data access questions, or deletion requests, contact [email protected].

This policy is written for users in British Columbia and Canada, including parents, guardians, daycare operators, staff, teachers, applicants, and visitors. It is intended to explain our practices in clear terms and does not replace advice from privacy counsel.

Information we collect

We collect information needed to provide CareOpenings, including account details, names, email addresses, phone numbers, roles, login and security information, communication preferences, consent records, support messages, and device, log, IP address, browser, and usage data.

Depending on the features used, CareOpenings may process daycare profiles, public profile content, website pages, media uploads, waitlists, inquiries, tours, invitations, registration packages, e-consents, child and family details, emergency contacts, medical and allergy notes, parent or guardian details, classroom records, attendance, daily reports, journals, photos, videos, messages, activity plans, monthly themes, observations written by daycare staff about children (including children's own words as recorded by staff), learning stories, newsletters, posters, keepsake books, photo-use consent records kept by the daycare, billing fee plans, invoices, receipts, subsidy information, staff and teacher profiles, schedules, time logs, job posts, job applications, hiring invites, and related workflow history.

Where a daycare uses voice notes in Documentation Studio, a recording made in the classroom, which may include children's voices, is passed to a speech-to-text service and returned as text. CareOpenings does not store the recording; it stores the text that the staff member saves.

For CASL and account compliance, consent actions may be stored with timestamp, IP address, user-agent metadata, source, locale, consent version, and preference snapshots.

We may receive information directly from you, from daycare operators or authorized staff, from parents or guardians, from invited users, from public sources, from imported daycare data, from payment and email providers, and from automated platform logs.

How we use information

We use information to provide, secure, support, maintain, troubleshoot, and improve CareOpenings; authenticate users; route users to the correct workspace; operate daycare discovery, waitlists, admissions, registrations, parent portals, classroom tools, learning documentation (learning stories, newsletters, posters, and keepsake books), messaging, billing, subscriptions, public profiles, careers, notifications, and support workflows.

We use information to send required service communications, security notices, account messages, invitation and registration updates, billing notices, daycare-branded emails, support responses, policy notices, and other operational communications.

We use information to maintain audit logs, consent records, abuse-prevention controls, rate limits, security monitoring, fraud prevention, data integrity checks, backups, analytics, service measurement, product improvement, and legal or regulatory compliance.

Optional promotional communications are sent according to your preference settings and applicable Canadian anti-spam requirements.

Data roles for platform and daycare records

CareOpenings generally controls platform account data, authentication, security logs, analytics, marketing signups, product communications, support records, payment relationship metadata, and records needed to operate and protect the platform.

For daycare operational records, including waitlists, admissions, registration packages, classroom records, staff records, messages, billing documents, and daycare public content, CareOpenings generally acts as a service provider or processor for the daycare. The daycare remains responsible for deciding what information it collects, why it collects it, who may access it, and how it uses it in its childcare operations.

Where a privacy request involves daycare-controlled records, we may need to verify your identity and coordinate with the relevant daycare operator before providing access, correction, deletion, restriction, or export.

Service providers, analytics, AI, and cross-border processing

We share information only as needed for service operation, legal obligations, authorized support, security, payment processing, analytics, or the workflows requested by users and daycare operators.

We use service providers for hosting, database storage, file storage, email delivery, payment processing, analytics, logging, security monitoring, AI-assisted drafting, image description, illustration, and speech-to-text, and related technical operations.

If the daycare website builder or other website content generation features are used, prompts, selected daycare profile details, website content, and related context may be processed by AI providers to generate draft content. Users and daycare operators should avoid including unnecessary sensitive personal information in website prompts and must review generated output before use. Documentation Studio works differently, because it drafts documents about children from the daycare's own records; it is described in the next two sections.

Service providers may process information in Canada, the United States, or other locations where they or their infrastructure operate. Information may therefore be subject to the laws of those locations.

We do not sell personal information. We do not use children's personal information for behavioural advertising.

Documentation Studio and AI processing of children's records

Documentation Studio is part of the paid Single Classroom and Multi Classroom plans. Daycare staff use it to record observations about children, to prepare learning stories, newsletters, posters, and keepsake books for families, and to get AI help when planning activities. Its AI features stay switched off until an administrator of the daycare has read and accepted an AI processing statement inside the product, and the daycare can withdraw that acceptance at any time. Every document is reviewed and approved by daycare staff before it is shared with a family.

When someone at the daycare uses an AI feature, CareOpenings sends the material that feature needs to an AI service provider and receives a draft, a transcript, or a picture in return. Each request also carries CareOpenings' own reference numbers for the records involved. Depending on the feature, the material is:

• Learning story: the child's first or preferred name, age in months or years, pronouns where the daycare records them, the centre and classroom names and the classroom's age group, the month's theme, observations about the child that a staff member has confirmed (including the child's own words as recorded), the child's activity entries from that month's daily reports, and the classroom activity plans linked to them or chosen for the story. A learning story about a whole classroom is written from other material: the centre and classroom names and the classroom's age group, the period the story covers and the theme, the observations of that period that a staff member has confirmed and that are recorded for the whole classroom (including children's own words as recorded), the classroom's activities of that period that are marked done, with their activity plans, and any note typed for the request; children's first or preferred names are attached only where the daycare switches on showing names, and then only for children for whom its photo-use records or default allow sharing with the family; the photos chosen for the story are not sent.
• Poster or newsletter: centre and classroom names and age groups, themes, activity plans, holidays, closures and other important dates, staff observations (including children's own words as recorded) and parts of published learning stories, notes typed by daycare staff, and, only where the daycare chooses to include them and its photo-use records or default allow it, children's first or preferred names and the day and month of birthdays.
• Keepsake book: the child's first or preferred name, the centre and classroom names, the period covered, the daily-report entries, activity descriptions, and observation notes linked to the photos chosen for the book, and excerpts of the child's published learning stories.
• Rewriting part of a learning story, poster, or newsletter with AI: the same material again, together with the current text of the document, including anything staff typed into it, and the instruction typed for the rewrite.
• Activity ideas and daily-entry drafts: the classroom's name and age group, the ages in whole months of the youngest and the oldest child enrolled in the room (without names or dates of birth), the theme and planned activities, what the staff member types, and for an entry draft the activity plan and the first or preferred names of the children selected.
• Activity descriptions: the activity's title and what the staff member has typed about it, the classroom's age group and the theme; and, where the staff member chooses to write from a picture, a picture of the activity or its materials. Staff are asked to confirm that the picture does not show children, and CareOpenings does not keep it.
• AI photo description: the photos a staff member selects, reduced in size, with the date recorded for each photo and, where the request is about one child, that child's first or preferred name; and only where someone at the daycare has confirmed who is pictured and the daycare has recorded how and when the family of every child pictured agreed in writing.
• Voice notes: the recording made in the classroom, which may include children's voices.
• Learning the layout of a past newsletter, learning story, poster or keepsake book: the first pages of the file the daycare uploads (up to 4 pages of a newsletter, 2 of a learning story, 1 of a poster, 4 of a keepsake book; a picture is reduced in size first), which CareOpenings does not keep. A PDF is sent together with its file name, except for a keepsake book, whose file name is not sent. When the daycare later has a document written from a template learned this way, the request also carries what was learned about the tone and the approximate length of each section.
• Illustrations: a short written description of the picture.

Documentation Studio: what is not sent, who receives it, and your choices

Photos of children are sent to an AI service provider only for AI photo description. Two other features send an image that a staff member supplies: a past newsletter, learning story, poster or keepsake book that a daycare chooses to upload, with whatever photos its pages contain (the pages of a past keepsake book usually show the child it was made for), and a picture of an activity or its materials used to write an activity description. Learning stories, posters, newsletters, and keepsake books are drafted from text; the photos placed in them are not sent, only details about them such as their dates, the kind of photo, and CareOpenings' reference numbers. These features do not send children's family names, full dates of birth, home addresses, parent or guardian names and contact details, or health, allergy, and medical records, unless a person has typed that information into the material a feature sends (for example a child's first-name or preferred-name field, a note, a daily-report entry, an activity plan, a document, or a request), or it appears in an uploaded file or picture. Notes and other text are sent as staff wrote them. For learning stories, posters, and keepsake books, where CareOpenings recognises in a note the name of another child of the classroom who is not to be named in that document, it replaces the name with neutral wording before sending. It does not do this for a child's recorded words or for the other features, and it cannot recognise every name.

The AI service that CareOpenings currently uses for these features (text, photo description, illustrations, and speech-to-text) is provided by OpenAI. It may process this information in the United States or other locations outside Canada, where it may be subject to the laws of those locations. CareOpenings itself does not use this material to train AI models and does not keep a voice recording once it has been turned into text. How long OpenAI keeps what it receives, and whether it may use it for any purpose other than providing the service, is governed by its own terms and policies, which it publishes at https://openai.com/policies/. CareOpenings does not make promises on its behalf. If we change the AI service used for these features, we will update this policy.

CareOpenings keeps the drafts and finished documents, the material each draft was built from, the AI activity ideas and what was typed to request them, who requested each and when, and counts of AI use against the monthly allowances of the daycare's plan. These are kept with the daycare's other records as described under "Retention, safeguards, and breach response".

For Documentation Studio, as for other classroom records, the daycare decides what it records and whether it uses AI features, and is responsible for informing families and for obtaining any consent that applies. A photo-use consent shown in the product is a record made by the daycare; CareOpenings does not collect it from families directly.

If you are a parent or guardian and want to know whether your child's daycare uses these features, want to see or correct what is recorded, or do not want your child's information or photos processed this way, speak to your daycare first. You can also contact us at the privacy address at the top of this policy, and we will coordinate with the daycare.

Children and family information

CareOpenings is not intended for children to create accounts or use directly. Child information is collected from parents, guardians, daycare operators, or other authorized users for daycare discovery, waitlist, registration, classroom, billing, and related childcare workflows.

Parents, guardians, and daycare operators are responsible for ensuring they have the authority and consent required to submit child, family, emergency, medical, allergy, photo, video, consent, and registration information.

Because child and family information can be sensitive, users should submit only what is necessary for the relevant daycare workflow and should keep records accurate and up to date.

CareOpenings uses no behavioural advertising directed at children and does not knowingly invite children to provide personal information directly to us.

Where a daycare uses Documentation Studio, information about a child may be processed by an AI service provider as described in the Documentation Studio sections above.

Communications and consent choices

You can review and update communication preferences from your account where available. Optional promotional communications may be unsubscribed from or adjusted through the available preference and unsubscribe tools.

Required service communications remain enabled for active accounts because they support authentication, security, waitlists, invitations, admissions, registrations, billing, legal notices, and other requested service workflows.

You may withdraw consent where applicable, but withdrawing consent may limit or prevent use of parts of the service where the information or communication is necessary for the requested service, legal compliance, safety, or security.

Retention, safeguards, and breach response

We retain personal information for as long as reasonably needed for the purposes described in this policy, including account operation, daycare workflows, legal obligations, audit logs, consent records, billing records, security, dispute resolution, backup, and legitimate business needs.

Retention periods may vary by record type, user role, daycare relationship, legal requirement, and whether a daycare-controlled record remains needed by a daycare operator. We may preserve records where necessary to protect users, children, families, staff, applicants, daycares, CareOpenings, or legal rights.

We use administrative, technical, and organizational safeguards designed to protect personal information relative to its sensitivity. No system can be guaranteed completely secure, and users must also protect their accounts, devices, and credentials.

If a privacy breach involving personal information under our control creates a real risk of significant harm, we will assess reporting and notification obligations under applicable Canadian privacy law and keep breach records as required.

Your privacy choices and requests

You may request access, correction, deletion, restriction, or portability where applicable law provides those rights. You may also ask questions or challenge our privacy practices by contacting [email protected].

We may need to verify your identity, ask for information needed to locate records, decline or limit requests where permitted or required by law, and coordinate requests involving daycare-controlled records with the relevant daycare operator.

Deletion or restriction may not be available for records that must be retained for security, billing, tax, legal, audit, dispute, fraud-prevention, consent, or daycare operational reasons, or where deletion would affect another person's rights or records.

Accuracy, account controls, and shared responsibility

Users should keep account, child, family, staff, daycare, billing, registration, and communication information accurate and current. Inaccurate records may affect waitlists, invitations, billing, classroom records, communications, or daycare operations.

Daycare operators are responsible for maintaining appropriate internal access controls, staff permissions, legal bases, and notices for information they collect and manage through CareOpenings.

CareOpenings may update, correct, suspend, delete, or restrict records where appropriate to maintain platform integrity, comply with law, address support requests, or protect privacy and safety.

Policy updates

We may update this Privacy Policy to reflect product, legal, security, or operational changes. If changes are material, we will provide notice appropriate to the circumstances.

Continued use of CareOpenings after an updated policy becomes effective means the updated policy applies to your use of the service, subject to any consent or notice requirements under applicable law.