Data Processing Agreement

1. Definitions

• "Customer Data" means personal information about children, parents/guardians, staff, and your operations that you (or your authorized users) submit to the Service, as described in the Terms.
• "Personal information" means information that identifies, relates to, or could reasonably be linked with a particular individual or household, as defined under applicable U.S. privacy laws.
• "Applicable privacy laws" means U.S. federal and state privacy laws applicable to the processing of Customer Data, including the Children's Online Privacy Protection Act ("COPPA") and state consumer privacy laws such as the CCPA/CPRA and comparable laws in Virginia, Colorado, Connecticut, Utah, and Texas.
• "Sub-processor" means a third party engaged by Limmia to process Customer Data in connection with the Service.
• "Process"/"Processing" means any operation performed on Customer Data, such as collection, storage, use, transmission, disclosure, or deletion.

2. Roles of the parties

As between the parties, you are the controller (or "business") that determines the purposes and means of processing Customer Data, and Limmia is the processor (or "service provider") that processes Customer Data only on your behalf. Limmia will not sell, rent, or trade Customer Data or "share" it for cross-context behavioral advertising, will not retain, use, or disclose Customer Data for any purpose other than performing the Service (or as otherwise permitted by applicable privacy laws), and will not combine Customer Data with personal information from other sources except as permitted by those laws to provide the Service.

3. Subject matter and duration

The subject matter of the processing is the provision of the Service. This DPA applies for as long as Limmia processes Customer Data on your behalf — that is, for the term of your account plus any post-termination period described in Section 9 (Return and deletion) and in our Privacy Policy.

4. Nature and purpose of processing

Limmia processes Customer Data to host, operate, secure, support, and improve the Service — including managing children's enrollment and records, classroom and ratio planning, staff scheduling and attendance, billing, and parent communications — and to comply with law. Processing is performed on your documented instructions, which include these Terms, this DPA, your configuration of the Service, and your authorized use of its features, including sharing records with a recipient you choose (for example a link to your CACFP claim for your sponsor).

5. Categories of data subjects and data

Categories of data subjects:

• Children enrolled at, or on the waitlist for, your center;
• Parents and guardians and other authorized contacts/pickups;
• The members of a child's household named on a CACFP income eligibility form;
• Your staff and administrators.

Categories of personal information:

• Identifiers and contact details (names, email addresses, phone numbers, relationships);
• Children's records (date of birth, room assignment, schedule, attendance and any signature drawn at check-in or check-out, medications and doses given, immunization records, health documents, incident reports, daily reports, signed forms, emergency contacts, authorized pickups, photos, transition notes, for centers in the Child and Adult Care Food Program (CACFP), a meal eligibility category of free, reduced-price or paid and the household's income eligibility form (household members and their income, or a SNAP, TANF or FDPIR case number, foster and Head Start status, and the adult's typed signature), for a child whose tuition an agency, an employer or a grant pays part of, who pays, the child's case number, the amount or percentage it covers and the family's share, and, for an employer, which parent works there (named, with the child's first name, the dates of care and the amounts, on the invoices and receipts the center sends that employer), and, for Pennsylvania centers that take the Child Care Works subsidy, a child's subsidy authorization and state case ID, the family's weekly copays and which were paid, paid absences used at other providers, the center's reports to its Early Learning Resource Center, and a parent's typed signature confirming a month's attendance);
• Sensitive information, including children's personal information, health information such as allergies, dietary restrictions, medications, immunizations and incident reports, staff health and background check records, CACFP eligibility categories and income eligibility forms, and child care subsidy information (enrollment, authorization, copays and case IDs), which reflect household income;
• Staff/employment information (phone, role, schedule, time off, attendance, certifications and credentials such as a TB test, physical or background check);
• Messages between families and staff, and your announcements;
• Account, sign-in (hashed passwords, passkey public keys, one-time sign-in codes), preference, billing, usage, and device/log information, including the IP address and browser recorded when a form is viewed or signed or a family answers a seat offer, and the push address of a device that turned notifications on.

You are responsible for ensuring you have a lawful basis — including any parental consent or authorization required under COPPA — to provide this information to the Service.

6. Limmia's processing obligations

• Process only on documented instructions. Limmia will process Customer Data only to provide the Service and as otherwise documented in the Terms and this DPA, unless required to act otherwise by law (in which case, to the extent legally permitted, Limmia will inform you first).
• Confidentiality. Limmia limits access to Customer Data to personnel who need it to provide or support the Service, and those personnel are bound by appropriate confidentiality obligations.
• Security measures. Limmia maintains reasonable technical and organizational measures designed to protect Customer Data, including encryption in transit and at rest, tenant isolation, role-based access controls, hashed-and-salted password storage, passkeys with a second sign-in step for any account that has one, audit logging of sensitive admin actions, restricted need-to-know staff access, and regular dependency and security review (see our Privacy Policy for more detail).
• No artificial intelligence or machine learning. Limmia does not send Customer Data to, or process it with, any artificial intelligence or machine-learning service or model, and does not use Customer Data to train, fine-tune, or evaluate any such model. Limmia will not begin doing so without first updating this DPA, giving you advance notice, and obtaining your prior written consent. (Our payment processor, Stripe, runs its own automated fraud screening on the card payments it handles; see Section 7.)
• Sensitive and children's data. Limmia treats children's personal information, health-related notes, CACFP eligibility categories and child care subsidy information as sensitive and limits their use to providing the Service to you and the child's authorized family, keeping the Service secure, and complying with law.
• Assistance with data-subject requests. Taking into account the nature of the processing, Limmia will provide reasonable assistance to help you respond to requests from individuals to exercise their rights (such as access, correction, and deletion) under applicable privacy laws. Where a request reaches Limmia directly, Limmia will, where permitted, refer the individual to you or forward the request to you.
• Breach notification. Limmia will notify you without undue delay after becoming aware of a breach of security leading to the accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of or access to Customer Data, and will provide information reasonably available to help you meet your own notification obligations.
• Compliance assistance. Limmia will provide you with information reasonably necessary to demonstrate compliance with this DPA and, upon reasonable written request and subject to confidentiality, will make available a summary of its relevant security practices.

7. Sub-processors

You authorize Limmia to engage sub-processors to process Customer Data in connection with the Service. Limmia imposes on each sub-processor data protection and security obligations that are substantially as protective as those in this DPA, and remains responsible for each sub-processor's performance of its obligations. Our current sub-processors are:

• Fly.io, Inc. — application hosting.
• Neon, Inc. — managed PostgreSQL database hosting.
• Google LLC (Google Cloud Storage) — storage of uploaded files such as photos and documents.
• Stripe, Inc. — payment processing. Card details are collected and stored by Stripe, not Limmia, and Stripe applies its own automated fraud screening to those payments.
• Resend (Plus Five Five, Inc.) — delivery of transactional email.
• Functional Software, Inc. (Sentry) — error reporting. Before a report leaves the Service, what was typed or sent (form contents, request bodies, cookies and search values) is removed and email addresses in error messages are replaced; reports identify a person only by an account number, do not store IP addresses, and are deleted after at most 90 days.

We keep this list and the matching list in our Privacy Policy current, and will give notice before adding a new sub-processor so you have an opportunity to object on reasonable data-protection grounds.

8. International processing

Limmia and its sub-processors process Customer Data in the United States. The Service is intended for U.S. daycare centers and families.

9. Return and deletion of Customer Data

When your plan ends, your account locks (or, for a center that was on another center's shared bill, moves to the Starter plan) and its Customer Data is kept, so nothing is lost if you subscribe again. When your owner deletes your center in the Service, Limmia deletes its Customer Data, including the photos and documents it uploaded, right away; you can also ask us to return or delete it, and we will do so within 30 days of confirming the request. In each case we follow the retention timelines described in our Privacy Policy, except where retention is required by law or for a legitimate, limited business purpose such as routine backups that roll off on a defined schedule. You can also export or delete much of your data directly within the Service while your account is active.

10. Order of precedence and changes

This DPA forms part of the Terms. If there is a conflict between this DPA and the rest of the Terms regarding the processing of Customer Data, this DPA controls. We may update this DPA from time to time consistent with the Terms; for material changes we will update the "Last updated" date above and provide notice as described in the Terms.

11. Contact

Questions about this DPA or our data practices? Email us at support@limmia.co.