Privacy Policy

1. Information we collect

We collect the following categories of information:

• Daycare account information. The daycare's name, location/state, billing contact, plan, and configuration (rooms, ratios, operating hours).
• Staff information. Name, email, phone, role, schedule, time-off requests, attendance, certifications and credentials the center tracks (for example a TB test, a physical or a background check, with their dates), and other employment-related notes the center chooses to record.
• Children's information. Name, date of birth, room assignment, schedule, attendance (including who checked the child in and out, and how, and a signature drawn at check-in or check-out if the center asks for one), allergies and dietary notes, medications and the doses given, immunization records (including any exemption), health documents, incident reports, daily reports, emergency contacts, authorized pickups, photos that the center uploads, forms the family signs, and notes about transitions or moves. A child's photo goes in a center newsletter to other families only when that child's family has said yes in the app. If the center takes part in the Child and Adult Care Food Program (CACFP), it may also record each child's meal eligibility category (free, reduced-price or paid), and it may ask the family to fill in the CACFP income eligibility form in the app: everyone in the household with each person's income and how often it is paid, or a SNAP, TANF or FDPIR case number instead, whether the child is a foster child or in Head Start, and the name the adult typed to sign it. We store those answers encrypted, show them only to the parent who sent the form and the center staff who set meal categories, and delete a form three years after the end of the program year (July to June) in which it last changed, except the form behind the child's current meal category, which is kept while that category is set. If an agency, an employer or a grant pays part of a child's tuition, the center may record who pays, the child's case number, the amount or percentage it covers and the family's share, and, for an employer, which of the child's parents works there. If a center in Pennsylvania takes children on the state's Child Care Works subsidy, it may record that a child is enrolled in it; the subsidy authorization (the days and hours authorized, its dates, the family's eligibility end date, the child's care level, the family's weekly copay and whether it is funded through SNAP), including the earlier terms it replaced, and how many paid absences the child used at other providers that year; the case ID the state assigns, which we store encrypted; which weeks the family paid its copay; when the center told its Early Learning Resource Center about the child's absences, return or an unpaid copay; and, when a parent signs a month of the child's attendance in the parent app, the name they typed, when they signed and the days and times they confirmed. Photos added through the app's photo tools (the photo gallery, quick capture and daily reports) are resized and re-saved on the uploading device before they reach us, which removes embedded camera data such as location; an animated GIF, and a file uploaded as a document or a health record, is stored as it was uploaded. We treat children's information as sensitive personal information (see Section 6).
• Parent/guardian information. Name, email, phone number, relationship to the child, and login credentials for the family portal. When a parent views or signs a form, we record when, the IP address and the browser, as the record of that signature.
• Families answering a seat offer. A family answering a seat offer from the link in the center's email gives only their answer, which we record with when it was given and the IP address it came from, and a deposit if the center asks for one (paid through Stripe).
• Sign-in and preferences. For every account: a password (stored only as a salted hash), any passkeys you add (we keep the passkey's public key and the name you give it, never your fingerprint, face or device PIN, which stay on your device), the one-time sign-in codes we email you, and preferences such as the language you read the app in.
• Billing information. Plan, invoices, payments, and the fees each payment carried. Card and bank account details are collected and stored by Stripe, not by Limmia; we receive only a token reference, the card brand or bank name, the last four digits, a card's expiry date, and whether a card is credit or debit.
• Usage and device information. IP address, browser/user agent, pages visited, actions taken, error logs, and approximate timestamps. We use this to keep the Service secure and reliable.
• Communications. Messages between families and the center's staff and the center's announcements, which the center and the people in the conversation can read; messages you send us (e.g. support email); and metadata about the emails sent to you through the Service.
• Push notifications. If you turn on notifications on a phone or computer, we keep that device's push address and its browser's user agent. Each notification travels through the push service your browser or phone uses (Apple, Google, Mozilla or Microsoft), encrypted so that service can't read it.

2. How we use information

We use personal information to:

• Provide, operate, and maintain the Service;
• Authenticate users and protect accounts from unauthorized access;
• Send transactional emails (account verification, password resets, sign-in codes, invitations, billing receipts, leave decisions, forms to sign and their reminders, and notices that year-end tax paperwork is ready); urgent alerts from the center, such as a closure, which reach every family and the center's staff by email and push whatever their settings, and a family not on the app at the contact email the center keeps for them; and the family updates each parent can turn off: messages, announcements, newsletters and incident reports as they happen, and one daily summary of their child's photos, daily reports and invoices;
• Process payments through Stripe;
• Provide customer support;
• Monitor for security incidents, abuse, and bugs, and to debug issues;
• Improve and develop new features (using aggregated and de-identified data wherever practical);
• Comply with legal obligations and enforce our Terms.

We do not sell personal information, and we do not share personal information for cross-context behavioral advertising or "targeted advertising" as those terms are defined under U.S. state privacy laws. We do not use information about children for behavioral advertising or to build advertising profiles. We do not use artificial intelligence or machine learning to process personal information, and we never use it to train AI models.

3. How we share information

We share personal information only as needed to run the Service, and only with the following categories of recipients:

• Within your daycare. Information you enter is visible to other authorized users of the same daycare tenant (e.g. admins, staff, invited parents) according to their role.
• With people the center chooses. A center can share records outside Limmia itself, for example by printing or downloading them. A center in CACFP can also send its sponsor a link to chosen months of its meal claim: the sponsor sees the center's name, the children on the claim with their meal category, and which meals each child had each day, until the link expires (at most 60 days) or the center stops sharing. Each time the link is opened we record when and the kind of browser (for example "Chrome on Windows"), not the IP address. A center an employer pays part of a child's tuition for can send that employer invoices and receipts that show the parent who works there, the child's first name, the dates of care and the amounts.
• Sub-processors. We use a small set of vetted vendors who process information on our behalf:
  • Stripe, Inc. — payment processing for Limmia subscriptions, and for tuition families pay their center, on the center's own Stripe account. Stripe applies its own automated fraud screening to the payments it handles.
  • Resend (Plus Five Five, Inc.) — delivery of email (account, billing, leave, invitations, and family updates such as the daily summary).
  • Fly.io, Inc. — application hosting.
  • Neon, Inc. — managed PostgreSQL database hosting for the application's data.
  • Google LLC (Google Cloud Storage) — storage of uploaded files such as photos and documents.
  • Functional Software, Inc. (Sentry) — error reports when something in the app fails, so we can fix it. Before a report leaves the app, what was typed or sent (form contents, request bodies, cookies and the values in a search) is removed and email addresses in error messages are replaced; a report identifies a person only by an account number, and IP addresses are not stored.

  These sub-processors are bound by contract to use the information only to provide their services to us. We will keep this list current as we add or change vendors; our current sub-processors are also referenced in our Data Processing Agreement.

• Legal and safety. We may disclose information if required by valid legal process, or if we reasonably believe disclosure is necessary to protect the rights, property, or safety of Limmia, our customers, or others.
• Corporate transactions. If Limmia is involved in a merger, acquisition, or asset sale, personal information may be transferred subject to a recipient that agrees to honor commitments at least as protective as this Policy.

4. Data retention

We retain Customer Data for as long as the daycare's account exists. Specifically:

• Active records (children, staff, parents, attendance, billing) are retained for the life of the account.
• When a daycare's trial ends or it cancels its plan, its account locks (a center that was on another center's shared bill moves to the Starter plan instead) but its records are kept, so nothing is lost if it picks a plan again.
• When a daycare's owner deletes the daycare in the app, its Customer Data, including the photos and documents it uploaded, is deleted right away. A daycare can also ask us to delete it by emailing support; we do so within 30 days of confirming the request. Either way we may keep records we must keep longer to meet a legal, tax, or accounting obligation.
• A parent can delete their own family portal account in the app; the daycare keeps its records about their child.
• A CACFP income eligibility form is deleted three years after the end of the program year in which it last changed (see Section 1), while the daycare's account exists; the form behind a child's current meal category is kept while that category is set.
• Audit logs and security records are retained for up to 24 months. The record of when someone accepted our Terms or signed a form, with its IP address and browser, is kept as long as their account or the signed record exists.
• Backups containing data may persist for up to 35 days after deletion before they roll off.
• Error reports are deleted after at most 90 days.
• De-identified, aggregated data may be retained indefinitely for analytics and product improvement.

5. Children's data and COPPA

Limmia is sold to, and used by, licensed daycare centers and the parents/guardians they invite — not directly to children. We do not knowingly collect personal information directly from children, we do not market the Service to children, and we do not allow children to create their own accounts. All information about a child is entered into the Service by the daycare or by an authorized parent/guardian.

The Children's Online Privacy Protection Act ("COPPA") governs the online collection of personal information from children under 13. In the daycare context, Limmia acts as a service provider that processes children's information on the daycare's documented instructions. The daycare (the controller) is responsible for obtaining any parental consent or authorization required before entering a child's information into the Service, and for ensuring it has a lawful basis to do so. Limmia uses children's information only to provide the Service to the daycare and the child's authorized family — never to market to children or to build advertising profiles.

As a parent or guardian, you can:

• Review the information your child's daycare has stored about your child by signing in to the family portal;
• Ask your daycare to correct inaccurate information;
• Ask your daycare to delete your child's information when your child is no longer enrolled;
• Withdraw your authorization for the daycare to use the Service for your child going forward.

Please contact your daycare first. If they need help fulfilling a request, or if you cannot reach them, email us at support@limmia.co and we will assist.

6. Sensitive personal information

Some information in the Service is "sensitive personal information" under U.S. state privacy laws — in particular, the personal information of children, health information such as allergies, dietary restrictions, medications, immunizations and incident reports, staff health and background check records, and a child's CACFP meal eligibility category and income eligibility form and a child's child care subsidy information (enrollment, authorization, copays and case ID), which reflect a household's income. We treat this information as sensitive and limit our use of it to what is reasonably necessary to provide the Service to the daycare and the child's authorized family, to keep the Service secure, and to comply with law. We do not use or disclose sensitive personal information to infer characteristics about a person, for advertising, or for any purpose other than those a consumer would reasonably expect for a daycare management platform.

7. Your U.S. state privacy rights

Depending on the state where you live, you may have rights regarding your personal information under laws such as the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA/CPRA"), and comparable laws in Virginia, Colorado, Connecticut, Utah, Texas, and other states. These rights may include:

• Right to know / access. Request the categories and specific pieces of personal information we have collected about you, and how we use and share it.
• Right to delete. Request that we delete personal information we have collected from you, subject to legal exceptions.
• Right to correct. Request that we correct inaccurate personal information.
• Right to opt out. Opt out of the "sale" or "sharing" of personal information and of "targeted advertising." As noted above, we do not sell or share personal information for cross-context behavioral / targeted advertising, so there is nothing to opt out of, but you may still submit a request.
• Right to limit use of sensitive information. Direct us to limit the use of sensitive personal information to what is necessary to provide the Service.
• Right to non-discrimination. We will not discriminate against you for exercising any of these rights.

How to submit a request. Most of the personal information we process about children, staff, and parents is held on behalf of a daycare (our customer). If your request concerns information held by a daycare, please contact that daycare directly; we will assist them as their service provider. For information Limmia controls about you as an account holder, you can use the in-app controls (for example, editing your profile or deleting your account) or email us at support@limmia.co with "Privacy Request" in the subject line. We will respond within the timeframe required by applicable law.

Identity verification. To protect your information, we will take reasonable steps to verify your identity before fulfilling a request, which may include confirming control of the email address on file and information about your account.

Authorized agents. You may use an authorized agent to submit a request on your behalf. We may ask the agent for proof that you gave them signed permission to act for you and, in some cases, may ask you to verify your own identity directly.

Appeals. If we decline your request and your state grants an appeal right, you may appeal our decision by replying to our response or emailing support@limmia.co with "Privacy Appeal" in the subject line. We will inform you of the outcome of the appeal in writing. If you remain unsatisfied, you may contact your state attorney general.

8. Your rights as an account holder

Beyond the state-specific rights above, you can access, correct, delete, or port much of the personal information we hold about you directly in the app (for example, by editing your profile or deleting your account). You can also email support@limmia.co and we will respond within the timeframe required by applicable law. We will not discriminate against you for exercising these rights.

9. Security practices

We take reasonable technical and organizational measures to protect personal information, including:

• Encryption of data in transit (HTTPS/TLS) and at rest;
• Tenant isolation, so each daycare's data is scoped to its own tenant;
• Role-based access controls inside the app;
• Hashed and salted password storage;
• Passkeys, with a second sign-in step (a passkey or an emailed code) for any account that has one, and an option for a center to require passkeys for its owners, managers and directors;
• Audit logging of sensitive admin actions;
• Restricted, need-to-know access for Limmia staff, with logging;
• Regular dependency updates and security review.

No system is 100% secure. If we become aware of a breach that affects your information, we will notify affected customers without undue delay as required by law.

10. Cookies and tracking

Limmia itself sets one cookie: a session cookie, after you sign in, to keep you signed in. We set no cookies on signed-out pages, and we do not use advertising or analytics cookies anywhere. Pages where you pay or add a card or bank account load Stripe's payment form, which may set Stripe's own cookies to prevent fraud. If the app hits an error, your browser may send an error report to Sentry (see Section 3); it sets no cookies and carries no advertising or analytics identifiers. Your browser may keep a private copy of a photo the app has shown, so it doesn't download again; each time the photo is opened, the app first checks with our servers that you can still see it. Signing out doesn't clear that copy, so on a shared device, clear the browser's history or use a private window. The family app also keeps a copy of your child's day on your device so its home screen opens quickly; signing out from Family clears it. Because we do not sell or share personal information or use it for targeted advertising, we do not need to honor "Global Privacy Control" or "Do Not Track" signals as an opt-out, but we describe our limited use of cookies here so you know what we do.

11. Where your information is processed

Limmia is operated from, and intended for customers and families in, the United States. Personal information is stored and processed in the United States by us and our sub-processors.

12. Changes to this Policy

We may update this Privacy Policy from time to time. We will update the "Last updated" date above and, for material changes, give reasonable advance notice in the app or by email to the account owner.

13. Contact

Questions or privacy requests? Email us at support@limmia.co.