Privacy notice

Who controls the information

Each child care program decides what it records about the children and families it serves, and controls those records. TwoQM provides and secures the software on the program’s behalf. Questions about a child’s records — for example an incident report or attendance — are best sent to the program first; we will help them answer.

What we collect

• Account details: name, email address, phone number (optional), language, and sign-in security settings.
• Information programs enter about children and families: names, birth dates, classrooms, guardians and pickup permissions, health information such as allergies, medication and immunizations, custody documents, attendance, daily care notes (meals, naps, sleep checks, health checks), incident reports, progress reports and observations.
• Photos and posts shared in the private class feed. Each photo is checked against the sharing choices made for every pictured child.
• Messages between families and the program, survey answers (anonymous surveys are stored without any name or household), and signed forms.
• Billing: invoices, payments and subsidy records. Card and bank details are handled by Stripe; Nestunzo does not store full card or bank numbers.
• Technical information: device and push-notification tokens, IP addresses and browser information used for security, sign-in sessions and audit logs.

How we use it

• To provide the service to the program and the families it serves.
• To keep people and records safe: access control, audit logs, fraud and abuse prevention.
• To send the notifications and emails people need (sign-in, invitations, reminders). Notification text never includes a child’s name, health information, amounts or message contents.
• We do not sell personal information and do not use it for advertising. Children do not have accounts; the service is used by programs and adults.

Who we share it with

• The child care program that holds the records, and the family members and staff it gives access to, according to their roles and any custody restrictions.
• Service providers that help run Nestunzo: Stripe (payments), TwoQM Central with Resend (email delivery), Expo (push notifications) and our hosting providers. They may use the information only to provide those services.
• Authorities when the law requires it.

How we protect it

• Each program’s data is kept separate at the database level.
• Connections are encrypted; sensitive fields are encrypted at rest; photo links expire within minutes.
• Safety and health logs cannot be silently edited; corrections are recorded with a reason.
• Backups are encrypted and kept for 30 days.

How long we keep it

Programs set how long their records are kept, following their licensing and legal requirements. Nothing is deleted automatically without a person approving it. When an account is deleted, the sign-in identity is removed; records a program must keep by law (for example billing, attendance and incident records) stay with the program. Encrypted backups roll off after 30 days.

Your choices and rights

• Download a copy of your data from your account settings (web: Account → Your data; app: More → Privacy & your data).
• Ask to delete your account — see the account deletion page.
• Correct your profile at any time; ask your program to correct records it keeps about you or your child.
• Choose which photos of your child may be shared, and turn notifications on or off.

Changes

We will post updates on this page and change the date above. Significant changes will also be announced in the app.