Who is responsible

Your child's nursery decides what is recorded about your child and why: for those records the nursery is the data controller, and KidsKlab is its processor - we run the software and handle the data only on the nursery's instructions, under a written agreement. For a few things KidsKlab decides on its own - your account and sign-in, the Offers tab, your privacy choices, error reports from the apps, and enquiries through this website - and for those KidsKlab is the controller. KidsKlab is operated by MJS Compatibles LTD, Stavrou 58, Strovolos, Nicosia, Cyprus.

What is held about your child

What a nursery needs to look after a child and show that it did:

Name, date of birth, gender, class and photo or avatar
Arrival and departure, and who collected them
Daily care notes - meals, naps, nappy changes - and the nursery's day summaries
Allergies, dietary needs, medical notes, doctor's details and medication given
Incidents, first aid and sleep checks
Observations, photos, meeting notes and things the nursery asks you to bring
Emergency contacts and the people allowed to collect them

What is held about you

Your name, email address and phone numbers
Your relationship to your child, and whether you may collect them
Messages you exchange with staff, and comments on the menu
Absences you report, meetings you book and requests to change records
Payment records, where your nursery uses KidsKlab for fees
Your language, notification and privacy choices, app lock setting and a record of signing in
For staff: work details, check-in times, shifts, leave and, where the nursery uses it, pay

Why, and on what legal basis

For the nursery's records, the nursery sets the purpose and the legal basis - usually to provide the childcare you agreed (Art. 6(1)(b) GDPR), to meet the legal duties of a childcare provider (Art. 6(1)(c)), and, for photos shared with other families or used in publicity, your consent (Art. 6(1)(a)). For KidsKlab's own processing:

Your account, sign-in and security: to provide the service you use (Art. 6(1)(b)) and to keep it secure (Art. 6(1)(f), legitimate interest)
Offers shown to all families: our legitimate interest in funding the service (Art. 6(1)(f)); you can switch Offers off at any time
Offers suited to your child's age: only with your consent (Art. 6(1)(a)), which you can withdraw at any time
Error reports from the apps: our legitimate interest in keeping them working (Art. 6(1)(f))
Enquiries through this website: steps you ask us to take before a contract (Art. 6(1)(b))
The record of your privacy choices: to be able to show what you chose (Art. 6(1)(c) and Art. 7(1))

Health information

Allergies, medical notes, medication, incidents and sleep checks are health data - a special category under the GDPR. The nursery holds them because it cannot look after your child safely without them, relying on the provision of care and its legal obligations (Art. 9(2)(h) and 9(2)(b)) or on your explicit consent (Art. 9(2)(a)) where it asks for it. They are visible only to the people at that nursery who need them. They are never used for Offers or anything else of ours.

Who can see it

Access is narrowed by the software, not just by policy. Staff see only the classes they are assigned to. Administrators see their own nursery. No nursery can see another's, and no family can see another family's. A small number of named KidsKlab administrators can technically reach nursery data to keep the service running; they do so only to fix a problem, when the nursery asks for help, or when the law requires it, and they are bound by confidentiality.

Photos

Photos are stored privately and are never public; links to them expire. They are visible to staff at that nursery and to the families of the children in them, following the photo consent recorded for each child - which you can set and withdraw from your child's profile. New nurseries treat a child with no recorded consent as not consented. You can report a photo from the app and ask the nursery to take it down.

Offers

The Offers tab shows products and services for families with young children, from companies that pay KidsKlab to appear there. Your nursery does not choose them and gets nothing from them.

By default you see only offers meant for every family; nothing about your child is used to choose them
Offers suited to your child's age appear only if you switch that on in Privacy & your data; we then use your child's date of birth to match them
We count views and taps to report results to advertisers; we record your name against them only if you switched on age-suited offers, otherwise under a one-way code that does not identify you
Advertisers never receive your name, your child's details or anything that identifies you; links to their sites carry only the campaign name
You can switch Offers off completely at any time

Optional features your nursery may switch on

Evening day summary: a short account of your child's day, filled in from the day's records on our own servers. Nothing is sent to an outside company to write it
Online payments: handled by Stripe; card details go to Stripe, never to us or the nursery
Sign in with Google or Apple, if you choose it: they confirm who you are to us

Where it is held, and transfers outside the EU

The database and files are held in the EU, in Ireland, with a nightly copy of each nursery's data in private storage with the same provider. Some of the companies below are based in the United States or have a US parent (Cloudflare, Amazon, Resend, Stripe, Expo, Google, Apple). Where personal data reaches them, the transfer is covered by the EU-US Data Privacy Framework where the company is certified, and by the EU Standard Contractual Clauses otherwise.

Who else handles it

Nothing is sold. These are the companies involved; the full list, with what each receives, is at kidsklab.com/subprocessors:

Supabase - database, files, sign-in and servers, in the EU (Ireland)
Cloudflare - hosting for this website and the web versions of the apps
Amazon Web Services - sending email such as invitations, reminders and alerts, from the EU (Sweden)
Resend - sending sign-in code emails
Expo, Apple and Google - delivering push notifications to phones; Expo also delivers app updates
Stripe - payments, only where your nursery has switched them on

How long it is kept

Records about your child: as long as your nursery's retention policy requires. When a nursery stops using KidsKlab, its data is deleted within 30 days of the end of its contract. Nightly database copies expire after 30 days; the backup copy of photos is kept until the nursery's account is closed
Your account: removed within 30 days of your request being approved; the nursery keeps its records about your child, with your name taken out
Offer views and taps: 13 months
Website enquiries: 24 months; the one-way code used against abuse, 30 days
Error reports from the apps: 90 days
Push notification text: 30 days
The record of your privacy choices: as long as your account exists

Cookies and storage on your device

This website sets no cookies and uses no analytics or advertising trackers. The apps keep your sign-in, language, appearance and app lock settings on your device so they work; these are strictly necessary and need no consent. The console's fonts are served by us, not by Google.

Your rights

You can ask to see your data, correct it, delete it, restrict or object to how it is used, or receive a copy. In the app, Privacy & your data lets you download everything held about you and your children, switch Offers off, and withdraw any consent you gave. For your child's records, start with your nursery - it decides, and we act on its instructions and help it answer you. No decision with legal or similarly significant effect is made about you or your child by automated means. You can complain to the Office of the Commissioner for Personal Data Protection in Cyprus (dataprotection.gov.cy) or to the authority where you live.

Security

All traffic is encrypted; photos and files are private and reached only through links that expire
Each person sees only what their role allows, enforced in the database itself
Sensitive actions are written to an audit log the nursery can read
Each nursery's data is backed up nightly
If personal data is ever exposed, we tell the nursery without undue delay so it can meet its duties, and we tell you directly where the law requires

Children

KidsKlab is used by adults - parents, guardians and nursery staff. Children do not have accounts and cannot sign in.

If you advertise with KidsKlab

Companies that place offers use the advertiser portal at ads.kidsklab.com. For that, KidsKlab is the controller and holds:

Your company's billing details, and the names and email addresses of the people you invite to your team
Your sign-ins, the campaigns you write and the pictures you upload
Your orders and payments. Card payments are handled by Stripe; we never see the full card number
Legal basis: the contract with your company (Art. 6(1)(b)) and our accounting obligations (Art. 6(1)(c)). Orders and invoices are kept as long as Cypriot tax law requires; team members are removed when you remove them
You receive only totals about your campaigns - views, families reached, taps, code reveals and saves - never anything that identifies a family or a child

Changes

If this changes we will update this page and the date at the top of it, and the apps will show you the new notice the next time you open them.

Asking us directly

Email hello@kidsklab.com, or write to MJS Compatibles LTD, Stavrou 58, Strovolos, Nicosia, Cyprus. For anything about your own child's records, your nursery can answer faster.

What KidsKlab holds, and who can see it.