Privacy Policy

1. Overview

Zukeepr helps parents find and manage applications to licensed childcare providers. This Privacy Policy explains what information we collect, how we use it, how we share it, how long we keep it, and the rights you have over your data.

By using Zukeepr you agree to the practices described here. All amounts referenced are in U.S. dollars (USD) unless otherwise stated.

This Privacy Policy supplements our other privacy-related documents:

• Children's Privacy Notice — additional protections for information about children;
• Cookie Policy — how we use cookies and similar technologies;
• Data Processing Agreement — applies to daycares regarding parent and child information;
• Subprocessor List — public list of third-party service providers, available at zukeepr.com/subprocessors.

Where this Privacy Policy conflicts with the Children's Privacy Notice on matters specific to children's information, the Children's Privacy Notice controls.

2. Who We Are

Zukeepr operates through two separate legal entities:

• ZuKeepr Inc., a corporation incorporated under the Canada Business Corporations Act, with an address at 914 Graythorpe Place, Victoria, BC V8X 4K5, Canada; and
• Zukeepr US LLC, a limited liability company organized under the laws of Wyoming, United States, with a business correspondence address at 30 N Gould St, Ste N, Sheridan, WY 82801, United States.

For general Platform and account services (including searching for, saving and comparing daycares, messaging and account administration), the contracting party for a Parent account is Zukeepr US LLC where the account is registered in the United States and ZuKeepr Inc. where it is registered in Canada; for a Daycare account, it is determined by the country in which the daycare facility operates. For Platform services relating to a particular daycare (including applications, enrollment administration, tuition collection, registration and administrative fees, Platform fees and payouts), the contracting party is Zukeepr US LLC where the daycare operates in the United States and ZuKeepr Inc. where it operates in Canada. For Premium subscriptions, the contracting party is Zukeepr US LLC where the purchaser's account is registered in the United States and ZuKeepr Inc. where the account is registered in Canada.

ZuKeepr Inc. and Zukeepr US LLC are separate legal entities. In this Policy, "Zukeepr," "we," "our" and "us" mean the applicable contracting party for the service or transaction concerned, unless expressly stated otherwise. Each is responsible for the personal information it handles as described in this Policy, under Canadian privacy law and applicable U.S. state privacy law, whatever term that law uses.

3. Information We Collect

3.1 Account Information

• Email address;
• A password — collected only for accounts created with an email and password, stored only as a salted bcrypt hash, and never seen by us in plain text;
• No password for accounts that use Google sign-in — those accounts are authenticated through Firebase Authentication, and no password is received or stored by us;
• Contact name and phone number;
• Home address, province or state, and city;
• Account role (parent or daycare) and related preferences.

3.2 Sensitive Child Information (Parents Only)

When you create or update a child profile on Zukeepr, you provide us with information about that child. We treat the following categories of information as sensitive and apply additional safeguards (including limited internal access and exclusion from analytics tools):

• Full name and date of birth;
• Allergies, medical information, and immunization records;
• Doctor or clinic information;
• Emergency contacts and pick-up authorizations;
• Care schedule preferences;
• Primary and secondary languages.

Information about children is provided exclusively by parents and legal guardians, who confirm at signup that they have legal authority and that no court order or custody arrangement prevents such use of the Platform. Zukeepr does not allow children to create accounts or submit information directly. Our handling of children's information is described in detail in our Children's Privacy Notice.

Where reasonably possible, certain sensitive child fields (such as medical information) are collected closer to the enrollment acceptance stage rather than at initial application, in keeping with our data minimization approach.

3.3 Daycare Information

If you create a Daycare account, we collect:

• Business name, contact information, and operating address;
• Childcare license number and a copy of the license document (uploaded as part of administrative verification);
• Banking information collected by Stripe for payouts (handled by Stripe, not stored by Zukeepr);
• Facility description, photos, capacity, hours, services, and pricing.

3.4 Payment Information

Payment card and ACH details are collected and processed by Stripe (https://stripe.com/privacy), our payment processor, and are never stored on Zukeepr servers. Stripe is PCI DSS Level 1 certified and handles all sensitive payment information directly. We retain transaction records (described in Section 11).

3.5 Communications

Messages exchanged between parents and daycares through the Platform's messaging tools. Messages may be reviewed by Zukeepr only for safety, fraud, abuse, legal compliance, support, dispute, or product-integrity purposes. Default retention is up to thirteen (13) months from the date of the message; longer retention applies only where required for safety, fraud prevention, disputes, legal holds, regulator requests, or other legal obligations.

3.6 Usage and Analytics Data

With your consent to analytics cookies, we use Microsoft Clarity to record session interactions (page views, click patterns, scroll behaviour) for product analytics. Clarity sets cookies and identifiers in your browser, on its own domains and on Microsoft's bing.com domains, so that visits from the same browser can be recognised. Google Analytics, also only with your consent to analytics cookies, receives a pseudonymous browser identifier stored in its cookies, a session identifier, the address of the page you are on, and browser and device details. Clarity is configured to:

• Mask all form fields by default;
• Exclude child profile pages, medical-information pages, payment pages, message-entry pages, and account settings from recording;
• Limit data retention to Microsoft's standard analytics retention window.

Clarity does not have access to plain-text passwords, payment card numbers, or sensitive child information. See our Cookie Policy for details, and our Subprocessor List for Microsoft Clarity's role.

3.7 Device and Technical Information

• IP address, browser type and version, device type, and operating system — captured for security, fraud prevention, and consent audit purposes;
• Cookies and similar technologies as described in our Cookie Policy.

Push notifications. If you allow notifications in the Zukeepr mobile app, we collect a device notification token (and, on Android, a Firebase installation identifier). We use them only to deliver notifications to your device, and we delete a token when you sign out of that device or it is no longer valid.

3.8 Consent Records

We record your affirmative acceptance of our Terms of Service, Privacy Policy, Children's Privacy Notice (for parents), your role-specific agreement, and any recurring payment authorization, including the document name, version, date and time of acceptance, your IP address, your user-agent, the user identifier, your role, the exact checkbox text presented, and the route or interface where consent was captured. These records form a consent audit trail.

3.9 Error Reports

When something goes wrong on our servers or website, we send an error report to Sentry, our error-monitoring provider, so we can find and fix the problem. A report describes the error: its message, where in our code it happened, the page or address involved, and the type of browser or device. Before a report leaves our systems we remove your account identity, email addresses, phone numbers, IP addresses, sign-in tokens, cookies, the contents of what was submitted, and fields that name a person or a child. We do not use error reports for analytics or advertising. See our Subprocessor List for Sentry's role.

3.10 How You Found Us

When you create an account, we record how you arrived at Zukeepr: the campaign details included in the link you followed (such as the source, campaign and ad named in the link), the website that referred you, and the Zukeepr page you started from on the way to signing up. We record this once, at sign-up. We do not store it in your browser, and we do not track your activity on other websites.

3.11 Parent Trackers (Parent Premium)

If you turn on trackers, we store the sleep, nap, feeding and diaper entries you add for your child. We use them only to show you your child's patterns. Your daycare cannot see them. Authorized Zukeepr staff can access them only through our logged admin process, for example to answer a support request or meet a legal obligation. You can stop tracking at any time, and you can delete your tracker history from your account.

4. Children's Privacy — COPPA Compliance

Zukeepr complies with the U.S. Children's Online Privacy Protection Act ("COPPA") and equivalent Canadian privacy law. We do NOT knowingly collect personal information directly from children. Information about children is provided by a parent or legal guardian who has given verifiable parental consent before any information is submitted and, after enrollment, may also be created or entered by the child's daycare in connection with providing and documenting the child's care. Children do not create accounts or submit information directly through the Platform.

Parental rights regarding children's information are described in detail in our Children's Privacy Notice. In summary:

• You may review the children's information we hold at any time through your account dashboard or by contacting us;
• You may correct inaccurate information through your account settings;
• You may request deletion of all children's data, which we will action within the period required by applicable law, subject to legal retention obligations;
• You may withdraw consent at any time by closing your account or contacting us.

5. How We Use Your Information

We use the information we collect to:

• Operate the Platform — match parents with eligible daycares, process applications, manage enrollments, and process payments;
• Send transactional emails (OTP codes, application updates, invoices, receipts);
• Send marketing communications only to users who have explicitly opted in, with the ability to unsubscribe at any time;
• Maintain Platform security and prevent fraud;
• Investigate safety, fraud, abuse, or legal compliance concerns, including review of Platform messages where necessary;
• Improve our product through limited and masked analytics;
• Measure which of our marketing — advertising, press, partner links and outreach — brings people to Zukeepr. This information is never used to target advertising to you and never includes children's information.
• Comply with our legal obligations, including childcare licensing law and tax law.

We do NOT use your information for targeted advertising. We do NOT sell personal data. We do NOT use children's information for advertising, profiling, or behavioural analytics.

With your consent, we use Google Ads conversion measurement to learn whether our ads led to a visit or a sign-up (Cookie Policy Section 3.4). It is never used to target ads to you, and it never uses children's information.

6. Sharing With Daycares: Roles Under Privacy Law

6.1 For information about parents and children that is shared between Zukeepr and a Daycare through the Platform, the parties' roles under privacy law are as follows:

• Under Canadian privacy law (PIPEDA, BC PIPA): Zukeepr and the Daycare act as joint controllers, with independent obligations to the affected individuals;
• Under applicable U.S. state privacy law: Zukeepr and the Daycare may each act as a separate "controller" or "business" with respect to specific portions of the information, and may share controller/business obligations where information is jointly determined;
• Where Zukeepr stores or processes information solely on behalf of a Daycare (for example, internal attendance logs or daycare-controlled records uploaded to the Platform), Zukeepr acts as a processor or service provider for that information.

6.2 Sharing happens in two stages, as described in our Children's Privacy Notice and enforced in the Platform:

• Application stage: The daycare you apply to sees a limited profile of you and your child (such as general care needs, age range, and scheduling preferences). Sensitive information (full date of birth, medical and dietary details, emergency contacts, pick-up authorizations) is NOT shared at this stage;
• Enrollment stage: After you accept an offer of enrollment, the full parent and child profile is shared with that specific daycare for the purpose of providing care.

6.3 Daycares are bound by their Daycare Agreement and the Data Processing Agreement to handle parent and child information securely, lawfully, and only for the purpose of providing childcare services.

7. How We Share Your Information

7.1 With Daycares

As described in Section 6, we share parent and child information with daycares you apply to or enroll with, on the two-stage model.

7.2 With Service Providers (Subprocessors)

We share information as needed with service providers that help us operate the Platform. A complete, current list of subprocessors — including vendor name, purpose, data jurisdiction, the categories of data each handles, and the date last updated — is available at zukeepr.com/subprocessors. Material additions to or removals from this list are communicated to users in accordance with our change-management process.

To deliver mobile push notifications we use Firebase Cloud Messaging (Google LLC) for Android devices and Apple Push Notification service (Apple Inc.) for Apple devices. These services receive the device token or installation identifier, delivery information and the notification itself. Notifications contain only brief, general text and the routing information needed to open the right area of the app. They never contain children's names, medical or allergy information, incident details or the contents of messages; viewing those still requires signing in to Zukeepr.

Subprocessors are bound by contract to use information only for the services they provide to Zukeepr and to maintain appropriate safeguards.

7.3 For Legal Reasons

We may share information when we believe in good faith that disclosure is necessary to:

• Comply with applicable law, court order, or valid legal process;
• Cooperate with law enforcement, child protection authorities, or childcare licensing authorities;
• Prevent imminent harm to a child or other person;
• Protect the rights, property, or safety of Zukeepr, our users, or the public.

7.4 In Connection with a Business Transaction

If Zukeepr is involved in a merger, acquisition, financing, or sale of assets, your information may be transferred as part of that transaction. Where reasonably possible, we will notify affected users in advance and provide options consistent with applicable privacy law.

7.5 With Your Consent

We may share information for additional purposes with your express consent.

We do NOT share children's information beyond the daycare you have chosen and the service providers described above. See the Children's Privacy Notice for details.

8. Data Retention

Different types of information are retained for different periods, summarized in the table below.

8.1 Legal holds. If we receive a legal request, court order, or are involved in active litigation, we may retain relevant information longer than the periods above for as long as legally required.

8.2 Zukeepr-held vs. daycare-held records. The retention periods above apply only to information that Zukeepr holds. A daycare that has received information about you or your child through Zukeepr retains that information under its own policies and applicable law — including any childcare licensing record-retention requirements that apply to it, which may be shorter or longer than the periods in the table above. Closing your Zukeepr account or requesting deletion from Zukeepr does not, by itself, delete information held by a daycare and does not override the daycare's separate legal retention obligations. To request deletion from a specific daycare, contact that daycare directly. Zukeepr will assist you in identifying the appropriate contact upon request.

8.3 Parent account closure and daycare-controlled records. For clarity, closure of a parent account, or deletion of Zukeepr-controlled parent or child-profile information, does not require deletion of daycare-controlled care records that Zukeepr stores as a Processor or Service Provider on behalf of a daycare. Those records are retained for the periods stated in the table above, measured from the child's last day in care, and are then deleted or anonymized unless a longer period is required by law, licensing requirement, or legal hold.

8.4 Retention-policy periods. The three-year period for daycare-controlled care records, the seven-year period for serious or critical incident records, the seven-year period for payment and transaction records, and the life-of-account-plus-seven-years period for consent records are retention-policy periods set by Zukeepr and the daycares that use the Platform. They are chosen for limitation-period, insurance, dispute-resolution, child-safeguarding and evidentiary reasons. They are not stated as requirements of Texas childcare licensing law or of tax law, and the legal minimums are generally shorter or vary. For example, the Texas Health and Human Services Commission Minimum Standards for child-care centers generally require records to be kept for at least three months, and require incident and illness reports to be kept while the child is in care and for at least three months after the child's last day (§746.709). The periods for which payment records must be kept vary: U.S. Internal Revenue Service requirements depend on the circumstances, and Canadian corporate and tax records must generally be kept for six years from the end of the tax year to which they relate. Where applicable law, legal process or an unresolved claim requires a longer period, the longer period applies.

8.5 Deletion is record-based. Deletion is applied record by record, not user by user. When an account is closed, the account's own clock governs the account and general profile information. Each record that is retained — for example, a care record, an incident record or a payment record — follows its own retention period, and only the information reasonably necessary to preserve the integrity and meaning of that record stays attached to it. Other information continues to be deleted in accordance with the account-deletion process. At the end of a record's retention period, the record is deleted or de-identified unless continued retention is required or permitted by applicable law.

9. Data Security and Breach Notification

9.1 We use industry-standard physical, technical, and administrative safeguards to protect your information, including:

• Encryption of data in transit (TLS) and at rest where reasonably feasible;
• Password hashing — for accounts created with an email and password, the password is stored only as a salted hash (bcrypt) and never in plain text;
• Federated sign-in — accounts that use Google sign-in are authenticated by the identity provider through Firebase Authentication, and we never receive or store a password for those accounts;
• Role-based access controls and authentication mechanisms;
• Logging and monitoring of access to personal information;
• Regular security reviews and prompt remediation of identified vulnerabilities;
• Staff training on privacy and data-handling practices.

9.2 Zukeepr uses cloud infrastructure in Canada and the United States. Our application servers, file storage and weekly database exports are hosted in AWS Canada Central (ca-central-1). Our primary application database, including its automated backups, is hosted by MongoDB Atlas in AWS Oregon (us-west-2), United States. Other service providers may process personal information in additional jurisdictions as described in our Subprocessor List.

9.3 Breach notification. In the event of a confirmed breach of security safeguards affecting your personal information, we will notify you and applicable authorities as soon as feasible and as required by applicable law. Internally, Zukeepr targets initial notification within seventy-two (72) hours of confirming the breach. The 72-hour figure is an internal operational target, not an absolute promise; actual timing depends on the facts of the incident, ongoing investigation needs, and applicable law.

10. International Data Transfers

10.1 Personal information may be stored or processed in Canada and the United States, including in our primary application database hosted in the United States. Certain service providers may also process information in other jurisdictions. See our Subprocessor List for their services, data categories and relevant processing locations.

10.2 Where information is transferred internationally, we take reasonable steps to ensure the information remains protected under safeguards comparable to those required by PIPEDA and applicable provincial privacy law, including contractual commitments from service providers.

10.3 You acknowledge that, as a result of these transfers, information about you may become subject to lawful access requests by foreign authorities under the laws of the jurisdiction where the service provider is located.

11. Payment Data

11.1 When you make or receive a payment through Zukeepr, your payment card and ACH details are collected and processed by Stripe, our payment processor. Zukeepr does not store full payment card numbers, CVV codes, or raw card or ACH data.

Payments involving a daycare operating in the United States, and Premium subscriptions purchased through United States accounts, are processed through the applicable Stripe account of Zukeepr US LLC. Payments involving a daycare operating in Canada, and Premium subscriptions purchased through Canadian accounts, are processed through the applicable Stripe account of ZuKeepr Inc.

11.2 We retain the following transaction records for accounting, tax, and dispute purposes:

• Transaction amount and currency (USD);
• Payment date and status;
• Name of the daycare receiving funds;
• Zukeepr service fee applied;
• Stripe invoice and charge identifiers;
• Where applicable, your acknowledgement of any non-refundable fee or recurring payment authorization at the time of payment, including the version of the applicable Terms or Refund Policy in effect.

11.3 Transaction records are retained for seven (7) years under our retention policy, for accounting, tax, dispute and evidentiary purposes (see Section 8.4). This retention period applies even after account closure.

11.4 You can request a record of your transactions at any time through your payments dashboard or by contacting privacy@zukeepr.com.

12. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access — review the personal information we hold about you;
• Correct — update inaccurate information;
• Delete — request deletion of your personal information, subject to legal retention requirements;
• Port — request a portable copy of your information in a commonly used format;
• Restrict — request that we limit how we use your information in specific circumstances;
• Withdraw consent — for processing based on your consent;
• Object — to certain types of processing, including marketing communications;
• Appeal — request review of a decision we made about your information, where required by applicable law.

To exercise any of these rights:

• Use the self-serve options in your account dashboard;
• Email privacy@zukeepr.com or support@zukeepr.com;
• Write to ZuKeepr Inc., 914 Graythorpe Place, Victoria, BC V8X 4K5, Canada, or to Zukeepr US LLC at its business correspondence address, 30 N Gould St, Ste N, Sheridan, WY 82801, United States.

We respond to verified privacy-rights requests within the period required by applicable law. For example, applicable Canadian privacy laws generally require responses to qualifying access requests within 30 days, while the Texas Data Privacy and Security Act generally requires responses within 45 days. These periods may be extended where permitted by applicable law, in which case we will provide any notice required by law. We may request additional information to verify your identity before action. We will not charge a fee for honouring rights requests except where permitted by law for excessive or unfounded requests.

13. Texas and U.S. State Privacy Rights

13.1 We do not sell children's personal information or use children's care records for advertising.

Where a visitor chooses to enable advertising measurement cookies, we may allow Google Ads to receive cookie identifiers, advertising-click identifiers and limited information about visits or conversions on our public website. We use this information to assess advertising effectiveness. We do not intentionally provide names, contact details or children's care records for this purpose.

Advertising measurement is optional and disabled by default. Visitors can change their choices through our cookie settings.

Where applicable law grants additional rights regarding the sale, sharing or use of personal information for advertising, Zukeepr will honour those rights as required by law.

13.2 If you are a resident of a U.S. state with applicable privacy law (including Texas, California, Virginia, Colorado, and others), you may have specific rights in addition to those described in Section 12. These typically include:

• The right to know what categories of personal information Zukeepr collects, processes, and shares about you;
• The right to access your personal information;
• The right to correct inaccurate personal information;
• The right to delete personal information Zukeepr has collected from you, subject to legal retention exceptions;
• The right to obtain a portable copy of your personal information;
• The right to opt out of any "sale" or "sharing" of personal information for advertising purposes, as described in Section 13.1;
• The right to non-discrimination in the exercise of these rights;
• The right to appeal a decision Zukeepr makes about a privacy request, where provided by applicable law.

13.3 To exercise any state privacy right, use the channels described in Section 12 and indicate the U.S. state in which you reside. Zukeepr will respond within the period required by applicable law, as described in Section 12.

13.4 Zukeepr does not knowingly collect personal information from children under the age of 13 directly, and does not sell or share children's personal information.

13.5 Where state law requires a designated point of contact for privacy requests, that contact is privacy@zukeepr.com.

14. Cookies and Tracking

14.1 We use strictly necessary cookies to keep you signed in and process payments, and analytics cookies (Microsoft Clarity and Google Analytics) to understand how the Platform is used, subject to the masking and exclusion practices described in Section 3.6, and, only if you turn them on, advertising cookies for Google Ads conversion measurement.

14.2 We use advertising cookies only for Google Ads conversion measurement, only with your consent, and never on signed-in pages. We do not use retargeting, ad personalization or cross-site tracking cookies. If your browser sends a Global Privacy Control signal, we treat it as your choice not to allow advertising cookies: they stay off, even if you accept all cookies.

14.3 Where required by law, Zukeepr presents a cookie consent banner allowing you to accept, reject, or customize non-essential cookies, and respects your choice on future visits.

14.4 Full details, including a cookie inventory and instructions for managing your preferences, are in our Cookie Policy.

15. Marketing Communications and Electronic Communications Consent

15.1 We send transactional emails (related to your account, applications, payments, and enrollments) as part of providing the Platform. These cannot be turned off while you have an active account.

15.2 We send marketing communications only to users who have explicitly opted in at signup or through account preferences. You can unsubscribe from marketing emails at any time using the unsubscribe link in any marketing email or through your account settings. Unsubscribing does not affect transactional emails.

15.3 By providing your contact information and creating an account, you consent to receive electronic communications from Zukeepr in connection with your account, including legal notices, invoices, receipts, policy updates, support replies, and other transactional communications.

16. Changes to This Policy

16.1 We may update this Privacy Policy from time to time. Material changes will be communicated to registered users by email or in-app notice at least thirty (30) days before they take effect.

16.2 If a change materially expands how we collect, use, or share information about children, we will seek your renewed consent before the change applies to your child's information, as described in the Children's Privacy Notice.

16.3 The version of this Privacy Policy in effect at the time of any given interaction governs that interaction. Prior versions are retained and may be made available on request.

17. Contact

Privacy questions, requests, or concerns can be sent to:

ZuKeepr Inc.

914 Graythorpe Place, Victoria, BC V8X 4K5, Canada

Zukeepr US LLC

Business correspondence address: 30 N Gould St, Ste N, Sheridan, WY 82801, United States

support@zukeepr.com

zukeepr.com

privacy@zukeepr.com (privacy-specific) or support@zukeepr.com (general)

If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada (https://www.priv.gc.ca/), the British Columbia Office of the Information and Privacy Commissioner (https://www.oipc.bc.ca/), the U.S. Federal Trade Commission (https://www.ftc.gov/), or your state Attorney General's office in the United States.