Security and privacy
How the data of your centre, its families and its children is protected.
Where the data is
Your centre's data is stored in the European Union. The database and files are in Sweden.
Encrypted connection (HTTPS) for all communications.
Daily backups.
Who gets in and what they see
Access by invitation only. There is no public sign-up.
Each person sees only what concerns them: each family, their own children; each educator, their classrooms. The rule is enforced in the database itself.
These rules are checked automatically with every change and every night.
Strong passwords: at least 12 characters, with an uppercase letter, a number and a symbol.
Protection against login attempts: access is temporarily blocked after several failed attempts.
Sensitive data, photos and consents
Severe allergies, emergency notes and IBANs are stored encrypted, with the keys kept separately.
Private photos and documents, opened through temporary links that expire.
Photos lose their location and metadata when uploaded.
Image consent for each child. A child without consent cannot be tagged, and if the family withdraws it, management receives the photos to review.
Every consent is recorded: version, date, IP and browser.
A change log that nobody can alter from the app and that management can check.
Families' rights
Families can download their data at any time.
Right to erasure from the app.
Data is deleted automatically when its retention period ends.
Providers
Supabase: database, files and sign-in.
Vercel: application hosting.
Resend: sending emails.
Stripe: direct payment from families, only if the centre chooses that option; in that case it processes family data.