Privacy Policy

KinderSpotter helps families find licensed childcare that has space, and helps childcare providers fill it. To do that we need some personal information, including a small amount of information about your children. Here is what matters most:

• Child profiles are never public. A child’s first name and birthdate are only ever shown to a provider you choose to apply to, message, book a tour with, or share a Find Me a Spot request with.
• Find Me a Spot starts anonymous. Providers first see a summary (age group, schedule, approximate area, start date). They see who you are only after you decide to share your details with them.
• We don’t sell personal information and we don’t use advertising trackers.
• Some of our service providers are outside Canada (for example, our sign-in and email services), so some information is stored or processed in the United States. See Where your information is stored.
• You’re in control. You can see, correct, export and delete your information from your account settings, or by emailing [email protected].

The rest of this policy explains each of these points in detail.

This Privacy Policy describes how KinderSpotter (“KinderSpotter”, “we”, “us”) collects, uses, discloses and protects personal information when you use kinderspotter.ca, our related web pages, emails and services (together, the “Service”).

We are based in Ontario, Canada. We handle personal information in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and, where they apply, substantially similar provincial laws including Québec’s Act respecting the protection of personal information in the private sector, British Columbia’s and Alberta’s Personal Information Protection Acts, and Canada’s Anti-Spam Legislation (CASL) for the emails we send.

This policy applies to three kinds of people: parents and guardians looking for childcare, providers (licensed childcare centres and home child care agencies and their staff) who list and manage availability, and visitors who browse without an account.

It does not cover how a childcare provider handles the information you give them directly, or that we pass on at your request. Once a provider receives your details, that provider is responsible for them under their own privacy practices and the licensing rules of their province. Ask the provider for their privacy policy before enrolling.

We collect only what we need to run the Service. We do not ask for anything we won’t use.

Information you give us

Account

Your name, email address and the role you choose (parent or provider). Sign-in is handled by Clerk (see Service providers); we never see or store your password.

Family profile

Your postal code, city and province. We convert the postal code into an approximate map location so we can measure distance to providers. We do not need or ask for your street address.

Children

For each child: first name, date of birth (or expected due date if you are expecting), and optional notes about care needs. Please only include what a provider needs to know to assess a spot. You do not need to add a surname, photo, or health card number, and we ask that you do not.

Care requests & alerts

What you are looking for: desired start date, full- or part-time, days of the week, drop-off and pick-up times, search radius, care types, your preference regarding CWELCC-participating providers, and any notes.

Applications, waitlists, offers & tours

The providers you apply to or join a waitlist with, offers you receive and how you respond, tours you book, and providers you save.

Messages

The content of messages you exchange with providers through the Service, and when they were read.

Provider claims

If you claim a listing: your business email, phone number, your role at the centre and any evidence you provide so we can verify that you are authorised to manage it.

Provider listing details

Programs, hours, availability, description, photos, amenities, languages, contact preferences and tour settings you add to your listing. Most of this is published on your public listing page by design.

Correspondence

Anything you send us by email or through the Service, including support requests and feedback.

Information from public and government sources

Every listing on KinderSpotter starts from the official licensed child care dataset published by that province or territory (for example, Ontario’s Licensed Child Care Facilities open data). These datasets contain the facility’s legal name, licensee, address, programme type, licence details and sometimes a phone number. We record where each piece of information came from and when we retrieved it, and we show that provenance on the listing.

To invite providers to claim their listing, we may also look up a facility’s publicly listed business contact information (such as a general website or email address shown on the provider’s own site). Under PIPEDA, business contact information used to reach someone in their business capacity is not treated as personal information; where it is personal (for example, a named person’s work email), we rely on the fact that it was published for business contact purposes and we stop contacting that address as soon as we are asked to.

Information collected automatically

• Approximate location. So the home page can show openings near you, we estimate your city from your internet connection: the same city-level estimate every website receives with a request. We do not ask your device for its precise position unless you press “Use my current location”, and if you do, we keep only the resulting city, not your coordinates. The city you are viewing is stored in a cookie on your device so we can remember it (see Cookies).
• Device and log data. IP address, browser type, pages requested, referring page, timestamps and error reports: standard web server logs we use for security and to keep the Service running.
• Usage analytics. We record first-party events such as “search performed” or “care request created”, together with your role and city. This is our own analytics; it is not shared with an advertising network, and it is not used to build a profile of you.
• Email engagement. Whether an email we sent bounced, was reported as spam, or (for some notification emails) was opened. We use this to keep our sending reputation healthy and to stop sending to addresses that don’t want mail from us.

We use personal information for the following purposes, and we identify any new purpose to you before using your information for it:

• To provide the Service: create and manage your account, show providers near you, let you search, save, apply, join waitlists, book tours and message providers.
• To match families with providers: when you use Find Me a Spot or set up an alert, we compare your child’s age group, schedule, start date, radius and preferences against providers’ confirmed availability and notify the ones that fit. Matching is rule-based (distance, age group, schedule, start date). It does not score or rank you as a person, and no enrolment decision is ever made by the Service; providers and families decide.
• To communicate with you: send notifications about applications, offers, tours, messages, availability confirmations and alerts. Every in-app notification is also sent by email so you don’t miss a time-limited offer. You can turn categories of email off in your settings; some service messages (for example, a security notice or a response deadline) are necessary to run the Service.
• To verify providers: confirm that a person claiming a listing is authorised to manage it, and keep availability honest.
• To invite providers to claim their listing: by email, with a clear unsubscribe link and our mailing address in every message, as CASL requires.
• To keep the Service safe: detect abuse, fraud, scraping and misuse; enforce our Terms of Service; investigate reports.
• To improve the Service: understand which features are used and where people get stuck, using aggregated or de-identified data wherever possible.
• To meet legal obligations: respond to lawful requests, keep required records and defend legal claims.

We do not sell personal information, we do not share it with data brokers, and we do not use it for third-party advertising.

We rely on your consent to collect, use and disclose personal information. When you create an account you agree to this policy; when you add a child, create a care request or apply to a provider, you are consenting to the specific uses described for that feature at the point you use it.

Information about your children

By adding a child to your family profile you confirm that you are the child’s parent or legal guardian (or have their authority) and that you are entitled to share that information for the purpose of finding childcare. Information about a child is sensitive, and we treat it that way: it is never public, never used for analytics, and shared only with providers you choose. We do not knowingly collect personal information directly from anyone under 18; the Service is for adults.

Withdrawing consent

You can withdraw consent at any time, subject to legal or contractual restrictions and reasonable notice. Depending on what you withdraw, we may no longer be able to provide part or all of the Service. For example, we cannot match you with providers without a postal code and a child’s age. To withdraw consent, change your settings, delete the relevant item (a child, a care request, an alert), or email [email protected].

Emails

Transactional emails (an offer, a tour reminder, a message) are part of the Service. Commercial emails (such as invitations to claim a listing, or news about KinderSpotter) are sent only with your consent as required by CASL, and every one includes an unsubscribe link that works within 10 business days (usually immediately). We keep a record of unsubscribed addresses so we can honour your request.

With childcare providers (parents)

Providers only ever see what you choose to show them:

• Find Me a Spot: matched providers first receive an anonymised summary: age group, schedule, approximate area and start date. Your name, contact details and your child’s name are released to a provider only when you accept that provider’s response.
• Applications, waitlists, tours and messages: the provider you apply to, join, book with or message receives your name, email, your child’s first name and birthdate, the care details you entered, and the content of your messages.
• Alerts and availability requests: a provider sees that an availability request exists for their listing; they do not see who sent it unless you follow up.

With families (providers)

Your listing details, programs, hours, availability (with the date it was confirmed) and tour settings are shown publicly. Your business email and phone number are shown only if you choose to display them. Your personal staff account details are not shown to families.

With service providers that work for us

We use a small number of carefully chosen companies to run the Service. They may only use personal information to provide their service to us, and each is bound by contractual confidentiality and security obligations.

Clerk

Authentication and account sign-in. Stores your email address, name and sign-in credentials. United States.

Amazon Web Services

Email delivery (Amazon SES) for every notification we send; may also host our servers, database and backups. We select Canadian regions (Montréal) where available; some AWS services process data in the United States.

Mapbox

Interactive maps and converting postal codes and addresses into map coordinates. Receives the location being looked up and standard request data (such as your IP address) when a map loads. United States.

Hosting & infrastructure

The cloud platforms that run our website and database. They receive the information needed to deliver pages to you (such as your IP address) and store our database, which may be located in Canada or the United States.

Automated contact lookup

To find a provider’s publicly listed website or email so we can invite them to claim their listing, we use automated search and AI tools. Only the facility’s public name and address are sent to these tools, never family or child information.

Other circumstances

• Legal reasons. If required by law, a court order, or a lawful request from a Canadian or foreign authority; or where we believe disclosure is necessary to protect a child, prevent fraud or harm, or defend our legal rights.
• Business transfers. If KinderSpotter is involved in a merger, acquisition, financing or sale of assets, personal information may be transferred as part of that transaction, subject to confidentiality and to this policy continuing to apply.
• With your direction. Anyone else you ask us to share with.

Our organisation is in Canada and we prefer Canadian hosting regions where they are available. However, some of the service providers listed above store or process personal information in the United States. While it is there, it is subject to the laws of that country, and its courts, law enforcement and national-security agencies may be able to access it under those laws.

Before transferring personal information outside Canada we assess the sensitivity of the information, the purpose of the transfer and the protections in place, and we use contractual and technical safeguards (encryption in transit and at rest, access controls, data-processing agreements) to provide a level of protection comparable to what applies in Canada. If you have questions about where a specific category of information is stored, contact our Privacy Officer.

We keep personal information only as long as needed for the purposes it was collected, to meet legal requirements, or to resolve disputes. In practice:

• Active accounts: for as long as your account exists. Closed care requests, past applications and old messages stay in your account so you have a record; you can delete individual items at any time.
• When you delete your account: your name, email and sign-in link are removed; each child’s name and notes are erased; your postal code and map location are cleared; care requests and alerts are closed; and your messages are replaced with “[message removed]”. Providers you previously shared information with keep what you sent them, under their own policies.
• Audit and security logs: we keep a minimal record that an account existed and was deleted, and logs of security-relevant actions, for up to 2 years, to detect abuse and demonstrate compliance.
• Unsubscribe list: we keep unsubscribed and bounced email addresses indefinitely so we never email them again.
• Backups: deleted information may persist in encrypted backups for up to 35 days before it is overwritten.
• Listing data from government sources is business information about licensed facilities and is kept as long as the facility is licensed, and marked inactive afterwards.

We use safeguards appropriate to the sensitivity of the information: encryption in transit (HTTPS) and at rest, role-based access so that providers only see families who have chosen to share with them, authenticated and audited administrator access, least-privilege credentials for our systems, and sign-in handled by a dedicated identity provider with support for multi-factor authentication.

No method of storage or transmission is completely secure. If a breach of our safeguards creates a real risk of significant harm to you, we will notify you and the relevant privacy commissioner as required by law, and tell you what we are doing about it.

Please keep your own account secure: use a strong, unique password or passkey, turn on multi-factor authentication, and tell us immediately at [email protected] if you suspect unauthorised access.

Subject to limited exceptions under applicable law, you have the right to:

• Access the personal information we hold about you and learn how it has been used and to whom it has been disclosed.
• Correct information that is inaccurate or incomplete. Most profile, child and listing details can be edited directly in your account.
• Delete your account and the information associated with it, from Account settings or by request.
• Withdraw consent as described above.
• Receive a copy of the personal information you provided to us, in a structured, commonly used format (data portability), where this right applies to you.
• Ask questions or complain about our practices.

To exercise any of these rights, use the controls in your account or email our Privacy Officer at [email protected]. We will verify your identity before acting, and we respond within 30 days (we will tell you if we need longer and why). We do not charge for these requests except where the law allows and we tell you in advance.

If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada, or the privacy regulator in your province, including the Commission d’accès à l’information du Québec, the Office of the Information and Privacy Commissioner for British Columbia or the Office of the Information and Privacy Commissioner of Alberta.

We use a small number of cookies and browser storage items. None are used for advertising.

Sign-in (Clerk)

Keeps you signed in and protects your session. Strictly necessary; set only once you sign in.

ks_loc

Remembers the city you chose or we estimated so the home page can show openings near you. Set by us; expires after about a year; change it from the home page or clear your cookies to remove it.

ks_provider_location

For provider accounts managing more than one location: remembers which location you last worked on.

ks_lang

Remembers the language you picked (English or French). Stored in a cookie and in your browser’s local storage; expires after about a year; change it with the language selector at the top of any page.

Maps (Mapbox)

When an interactive map loads, Mapbox may use browser storage to cache map tiles for performance.

You can block or delete cookies in your browser settings. If you block the sign-in cookie you will not be able to use your account.

Find Me a Spot and availability alerts use deterministic rules (not machine learning) to decide which providers to notify: is the provider within your radius, do they have confirmed space for your child’s age group, does their schedule fit yours, and are they open to new requests. The result is a list of providers who have been asked whether they have a spot. Accepting an offer, being placed on a waitlist and enrolling are always human decisions made between you and the provider.

We use AI tools only on the provider-outreach side (to find public contact details for licensed facilities) and never to analyse families, children, messages or applications. If that ever changes, we will update this policy and ask for consent first.

If you live in Québec, the Act respecting the protection of personal information in the private sector gives you additional rights, including the right to request de-indexing in certain circumstances, the right to receive computerised personal information you provided to us in a structured, commonly used technological format, and the right to be informed when we communicate your information outside Québec. The person in charge of the protection of personal information at KinderSpotter can be reached at [email protected].

Our cookies and location features are described in the Cookies section; the only non-essential item (the remembered city) is set at your request or from a city-level estimate and can be cleared at any time. A French version of this policy is available on request.

We may update this policy as the Service and the law change. The effective date at the top tells you when it was last revised. For material changes (for example, a new category of information, a new purpose, or a new type of recipient), we will notify you by email or with a notice in the Service before the change takes effect, and where required we will ask for your consent again.

We have appointed a Privacy Officer who is accountable for our compliance with this policy and with Canadian privacy law.

General questions about the Service can go to [email protected].