Children's Privacy Notice

1. Who This Notice Is For

1.1 This Notice is written for parents and legal guardians who use Zukeepr on behalf of their child or children. If you are not the parent or legal guardian of a child, you should not provide information about that child through the Platform.

1.2 Zukeepr is intended for use by adults who have reached the age of majority in their jurisdiction and are legally capable of using the Platform. Children may not create accounts on Zukeepr. The Platform does not include features for direct child onboarding, child messaging, child profile self-management, or any other direct child interaction. Information about children is provided and managed by an authorized parent or legal guardian through their own adult account and, after enrollment, may also be created or entered by the child's daycare as part of providing and documenting the child's care.

1.3 Who We Are. Zukeepr operates through two separate legal entities: ZuKeepr Inc., a corporation incorporated under the Canada Business Corporations Act, with an address at 914 Graythorpe Place, Victoria, BC V8X 4K5, Canada; and Zukeepr US LLC, a limited liability company organized under the laws of Wyoming, United States, with a business correspondence address at 30 N Gould St, Ste N, Sheridan, WY 82801, United States. For general Platform and account services, the contracting party for a Parent account is Zukeepr US LLC where the account is registered in the United States and ZuKeepr Inc. where it is registered in Canada; for a Daycare account, it is determined by the country in which the daycare facility operates. For Platform services relating to a particular daycare, including applications, enrollment administration, tuition collection, registration and administrative fees, Platform fees and payouts, the contracting party is Zukeepr US LLC where the daycare operates in the United States and ZuKeepr Inc. where it operates in Canada. For Premium subscriptions, the contracting party is Zukeepr US LLC where the purchaser's account is registered in the United States and ZuKeepr Inc. where the account is registered in Canada. ZuKeepr Inc. and Zukeepr US LLC are separate legal entities. In this Notice, “Zukeepr,” “we,” “our” and “us” mean the applicable contracting party for the service or transaction concerned, unless expressly stated otherwise.

2. What Information We Collect About Children

When you create or update a child profile on Zukeepr, you provide us with information about that child. The table below describes the categories of information we may collect, why, and at what stage the information is shared with a daycare.

Category

Examples

Why We Collect / When Shared

Identity

First name, last name, date of birth

Identification at care facility; age eligibility. Full DOB shared at enrollment acceptance only.

Health and safety (sensitive)

Allergies, medical information, immunization records, doctor or clinic

Safe care and emergency response. Shared with the chosen daycare at enrollment acceptance, not at application.

Emergency contacts

Names and relationships of contacts; phone numbers

So someone can be reached in case of urgent need. Shared at enrollment acceptance.

Pick-up authorizations

Authorized and unauthorized pick-up persons

So the daycare only releases the child to approved adults. Shared at enrollment acceptance.

Language

Primary and secondary languages spoken

So the daycare can communicate appropriately. Shared at application stage as part of general care needs.

Daycare care records

Photographs; sleep and rest records; meal records; attendance records; developmental or progress reports; incident or illness records

Created by the daycare after enrollment to document the child's care, communicate with the authorized parent or legal guardian, and meet the daycare's operational and licensing obligations. Visible to that daycare and to the child's authorized parent or legal guardian only.

2.1 Information about a child may be provided by the child's parent or legal guardian or, after enrollment, created or entered by the child's daycare in connection with providing and documenting care. Zukeepr does not knowingly collect personal information directly from children.

2.2 We do not collect biometric data, geolocation data, or behavioural tracking data about children.

2.3 We do not allow children to communicate directly through the Platform. All messaging takes place between the parent's adult account and the daycare.

2.4 Sensitive fields (medical information, full date of birth, emergency contacts, pick-up authorizations) are optional at the application stage and can be supplied closer to enrollment acceptance. The Platform encourages but does not require these fields to be completed before an offer of enrollment is extended.

3. How We Use Children's Information

Information about your child is used solely to operate the Platform and facilitate childcare placement. Specifically, we use the information to:

• Show eligible daycares a limited profile of your child when you apply (such as age range, languages, and general care needs);
• Share full child profile information with a daycare only after you accept that daycare's offer of enrollment;
• Maintain records of enrollments, payments, and communications relating to your child's care;
• Respond to your requests, including access, correction, or deletion of your child's information;
• Comply with our legal obligations under applicable privacy, childcare, and consumer protection law.

3.1 We do not use children's information for advertising, marketing, profiling, or behavioural analytics. We do not sell, rent, or trade children's information. We do not allow third-party advertisers to access children's information.

3.2 After enrollment, Zukeepr also Processes daycare-created care records on behalf of the child's daycare so that the daycare can document the child's care and make appropriate information available to the child's authorized parent or legal guardian. For these records the daycare is the Controller or Business and Zukeepr acts as a Processor or Service Provider, as set out in the Data Processing Agreement.

4. Verifiable Parental Consent and Legal Authority

4.1 When you create a Parent account, you are asked to confirm that you are the parent or legal guardian of any child whose information you will provide, and that you consent to Zukeepr collecting and using that information as described in this Notice. This is recorded with a timestamp, IP address, user-agent, and Notice version, and is stored as part of your account record.

4.2 You also confirm, separately at signup, that:

• You have legal authority to make decisions about the child's care and to share information about the child with childcare providers;
• No court order, custody arrangement, or other legal restriction prevents you from using the Platform with respect to the child or from sharing the child's information with potential or chosen daycares;
• You will promptly notify Zukeepr at support@zukeepr.com if your legal authority changes or if a court order or custody arrangement is put in place that affects your use of the Platform with respect to the child.

4.3 This confirmation is presented as a dedicated checkbox at signup, separate from your acceptance of the Terms of Service, the Privacy Policy, and this Notice. The text presented to you reads substantially as follows: "I confirm that I am the parent or legal guardian of any child I add to Zukeepr, that I have authority to share that child's information with daycares through this Platform, and that no court order or custody arrangement prevents this use."

4.4 By providing information about your child, you reaffirm your verifiable parental consent under the U.S. Children's Online Privacy Protection Act ("COPPA") and equivalent Canadian privacy law.

4.5 If you are not the parent or legal guardian of a child, you should not provide that child's information through the Platform. Doing so is a violation of our Acceptable Use Policy, may be a misuse of the Platform under the Parent Agreement, and may also violate applicable law.

5. Who We Share Children's Information With

5.1 Zukeepr shares your child's information only with the licensed daycare provider you have applied to or enrolled with through the Platform. Sharing happens in two stages and is enforced technically by the Platform:

• Application stage: The daycare you apply to sees a limited profile of your child (such as age range, general care needs, and scheduling preferences). Sensitive fields — full date of birth, medical and dietary details, emergency contacts, and pick-up authorizations — are NOT shared at this stage;
• Enrollment-acceptance stage: After you accept an offer of enrollment from a specific daycare, the full child profile (including sensitive fields you have provided) is shared with that specific daycare for the purpose of providing care. At this stage, you will be presented with a confirmation step summarizing what is about to be shared and with which daycare, before the share takes effect.

5.2 We do not share your child's information with:

• Daycares you have not applied to or accepted an offer from;
• Other parents or families;
• Advertising or marketing partners;
• Analytics providers (Microsoft Clarity and similar services are excluded from child profile pages by configuration);
• Affiliated services or future Zukeepr products (such as babysitter, camp, tutoring, special-needs, healthcare, or seniors services we may launch later) — those would each require fresh, specific consent from you.

5.3 The only exceptions to the above are:

• Service providers that help us operate the Platform (such as our cloud hosting and database providers), who handle information under strict confidentiality and security obligations and are not permitted to use the information for their own purposes — a current list is available at zukeepr.com/subprocessors;
• When required by law, court order, or valid legal process;
• When necessary to prevent imminent harm to a child or other person;
• When you, the parent, expressly direct us to share the information with a specific party.

5.4 Daycare-created care records are associated with the enrolled child and are made available through the Platform only to the applicable daycare and the authorized parent or legal guardian associated with that child, except where disclosure is required by law or to service providers acting on our or the daycare's behalf. One family's care records are never visible to another family.

6. Daycares and Joint Responsibility

6.1 Once your child's information is shared with a daycare at the enrollment-acceptance stage, that daycare is jointly responsible with Zukeepr (under Canadian privacy law) or has its own separate responsibilities (under applicable U.S. state privacy law) for handling the information appropriately. The daycare has its own legal obligations to use the information only for caring for your child, to maintain appropriate safeguards, and to honour your access, correction, and deletion requests.

6.2 Daycares listed on Zukeepr are required, through the Daycare Agreement and the Data Processing Agreement, to:

• Use children's information only for providing childcare services;
• Limit access to staff with a legitimate need to know;
• Maintain appropriate physical, technical, and administrative safeguards;
• Notify Zukeepr promptly of any actual or suspected data breach involving information received through the Platform.

6.3 If you have concerns about how a daycare is handling your child's information, you may raise those concerns with the daycare directly and report them to Zukeepr at support@zukeepr.com.

7. How Long We Keep Children's Information

7.1 Active accounts: We retain your child's information for as long as your Zukeepr account is active and as needed to provide the Platform's services.

7.2 Account closure: When a parent closes their Zukeepr account, the account enters a 30-day reactivation period. After that period, we begin permanent deletion of the parent's account information and the child's general profile information, which may take up to an additional 90 days.

Closing an account does not necessarily result in the deletion of every record relating to the child. Certain records created by or for a childcare provider, transaction records, incident records, or other records may be retained for the periods described in our Privacy Policy or for a longer period where required by applicable law, legal process or an unresolved claim.

Where a retained record must remain identifiable — for example, an attendance record or incident report — we may retain the limited identifying information reasonably necessary to preserve the integrity and meaning of that record. Information that is not necessary for the retained record will continue to be deleted in accordance with the account-deletion process.

At the end of the applicable retention period, retained personal information will be deleted or de-identified unless continued retention is required or permitted by applicable law.

7.3 Daycare-held information. A daycare that has received your child's information through Zukeepr retains that information under its own policies and applicable law. Childcare licensing law may require a daycare to keep certain records after a child stops attending; the legal minimum varies by jurisdiction and is often shorter than the retention-policy periods in Section 7.5 — for example, the Texas Health and Human Services Commission Minimum Standards for child-care centers generally require incident and illness reports to be kept while the child is in care and for at least three months after the child's last day (§746.709). Closing your Zukeepr account does not, by itself, delete information held by a daycare and does not override the daycare's separate legal retention obligations. To request deletion from a specific daycare, contact that daycare directly. Zukeepr will assist you in identifying the appropriate contact upon request.

7.4 Legal holds: If we receive a legal request, court order, or are involved in active litigation, we may retain relevant information longer than the periods above for as long as legally required.

7.5 Retention periods for daycare-controlled care records. Closing your Zukeepr account, or the deletion of Zukeepr-controlled parent or child-profile information, does not delete daycare-controlled care records that Zukeepr stores as a Processor or Service Provider on behalf of a daycare. Those records are retained for the following retention-policy periods, measured from the child's last day in care:

• Care records — photographs, sleep and rest records, meal records, attendance records, and developmental or progress reports — three (3) years;
• Incident records classified by the daycare as serious or reportable (Level 2) or critical (Level 3) — seven (7) years.

These periods are set by Zukeepr and the daycares that use the Platform for limitation-period, insurance, dispute-resolution, child-safeguarding and evidentiary reasons. They are not requirements of childcare licensing law, whose minimums are generally shorter (see Section 8.4 of our Privacy Policy).

After the applicable period the records are deleted or anonymized, unless a longer period is required by applicable law, licensing requirement, or legal hold.

8. Your Rights as a Parent

As the parent or legal guardian, you have the following rights regarding your child's information on Zukeepr:

8.1 Right to Review

You can view your child's information at any time through your account dashboard.

8.2 Right to Correct

You can update or correct your child's information through your account dashboard at any time.

8.3 Right to Delete

You can request deletion of your child's information at any time, in whole or in part, from your dashboard or by contacting support@zukeepr.com. Submitting a request does not delete information automatically or immediately; each verified request is handled as follows. We respond to verified privacy-rights requests within the period required by applicable law. For example, applicable Canadian privacy laws generally require responses to qualifying access requests within 30 days, while the Texas Data Privacy and Security Act generally requires responses within 45 days. These periods may be extended where permitted by applicable law, in which case we will provide any notice required by law. For records a daycare controls, the daycare decides the request, and Zukeepr may deliver the daycare's response to you on the daycare's behalf. Deletion remains subject to legal retention obligations.

8.4 Right to Refuse Further Collection

You may stop providing further information about your child at any time. Doing so may limit your ability to use parts of the Platform but will not affect your right to have previously collected information reviewed, corrected, or deleted.

8.5 Right to Withdraw Consent

You may withdraw your consent to Zukeepr's collection and use of your child's information at any time by closing your account or contacting support@zukeepr.com. Withdrawal of consent does not apply retroactively to information already shared with daycares; that information remains subject to the daycare's own privacy practices and legal retention obligations.

9. Security

9.1 Zukeepr maintains physical, technical, and administrative safeguards designed to protect your child's information against unauthorized access, alteration, disclosure, or destruction. Child profile pages, medical information pages, and similar sensitive interfaces are subject to additional access restrictions and are excluded from analytics tools.

9.2 No system is perfectly secure. In the event of a data breach affecting your child's information, we will notify you and applicable authorities as soon as feasible and as required by law.

10. International Transfers

10.1 Information about children may be stored or processed in Canada and the United States. Our primary application database, including its automated backups, is hosted by MongoDB Atlas in the United States; our application servers, file storage and weekly database exports are hosted in AWS Canada Central. Access by authorized service providers and any additional processing locations are described in our Subprocessor List.

10.2 Where information is transferred internationally, we take reasonable steps to ensure the information remains protected under safeguards comparable to those required by PIPEDA and applicable provincial privacy law. See zukeepr.com/subprocessors for current vendor jurisdictions.

11. Changes to This Notice

11.1 We may update this Children's Privacy Notice from time to time. Material changes will be communicated to parents via email or in-app notice at least thirty (30) days before they take effect.

11.2 If a change materially expands how Zukeepr collects, uses, or shares children's information — or if Zukeepr begins offering new services that would involve children's information in a different way — we will seek your renewed consent before the change applies to your child's information.

12. How to Contact Us

Questions, concerns, or requests regarding this Children's Privacy Notice or your child's information on Zukeepr can be sent to:

ZuKeepr Inc.

914 Graythorpe Place, Victoria, BC V8X 4K5, Canada

Zukeepr US LLC

Business correspondence address: 30 N Gould St, Ste N, Sheridan, WY 82801, United States

support@zukeepr.com

zukeepr.com

If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada, the British Columbia Office of the Information and Privacy Commissioner, the U.S. Federal Trade Commission, or your state Attorney General's office in the United States.

─────────────────────────────────────────────────────────────────────────