Privacy Policy

1. Who we are and our role

Linkids ("we", "our", "us") is a kindergarten communication and management platform available at linkids.co and app.linkids.co. It is operated by A.L. WEB LIMITED, a company registered in the Republic of Cyprus.

For the children's and families' personal data held in the platform, the kindergarten that uses Linkids is the data controller — it decides what data is entered and how it is used. Linkids acts as a data processor, processing that data only on the kindergarten's documented instructions. If you are a parent or guardian, your kindergarten is your first point of contact for any question about your data or to exercise your rights (see section 7).

Linkids is the controller only for the limited data needed to run the platform itself — the account you log in with, billing details, and security logs.

Platform contact: privacy@linkids.co

2. What data we collect

We collect only the data necessary to operate the platform:

• Account data: name, email address, role (admin, teacher, parent).
• Child data: first name, last name, date of birth, class, emergency contact, dietary notes, GDPR media consent flag. Entered by authorised kindergarten staff.
• Daily log data: sleep times, meal portions, toilet events, activity records. Entered by teachers.
• Security and audit logs: records of security-relevant actions — for example creating, editing or erasing a child record, changing a biometric-consent flag, or exporting data. Each entry identifies the account that performed the action, the record affected, what changed, and the originating IP address.
• Media (when enabled): photos and videos uploaded by staff, subject to individual child consent flags.

3. Legal basis for processing

We process personal data under the following GDPR lawful bases:

• Contract: to provide the service to kindergartens and their staff.
• Legitimate interests: security and fraud prevention; and restricted, time-bounded retention of shared kindergarten media so one child's withdrawal or departure does not erase the other children's shared record.
• Consent: media sharing of children's images (opt-in per child).

4. How we use your data

• Providing and maintaining the Linkids platform.
• Sending transactional emails (invitations, notifications) via Amazon SES.
• Error tracking and performance monitoring via Sentry.
• Parsing free-text food menus into structured menus via Google Gemini, when staff use that optional feature.
• We do not sell, rent, or share your data with third parties for marketing.

5. Data storage and transfers

Application data is stored in the European Union (Frankfurt, Germany) using Supabase (PostgreSQL). We use the following sub-processors: Supabase (hosting/database, EU), Vercel (application hosting), Amazon SES (transactional email, including sign-in and invitation emails — receives the recipient email address and message content; EU / Frankfurt), Upstash (Redis cache for rate-limiting and abuse prevention, EU / Frankfurt; stores request identifiers such as IP address), Sentry (error monitoring, EU region), and Polar (subscription billing — processes the kindergarten's billing details, not children's data). Where you enable push notifications, they are delivered through your browser or device vendor's push service (Mozilla, Google or Apple); only the notification content and an anonymous device endpoint are sent. The optional facial-recognition feature downloads its detection model from the jsDelivr open-source CDN, which receives your browser's IP address and user-agent when the model loads (no child data is sent). We also use Google services that operate in the United States: Gemini (the optional AI feature that parses free-text food menus) and reCAPTCHA (spam prevention on our public marketing pages); both are subject to Google's privacy policy. Where a sub-processor operates outside the EEA — including Google and jsDelivr where it is not EU-resident — transfers rely on the recipient's EU-US Data Privacy Framework certification or standard contractual clauses (Article 46) with a transfer impact assessment.

6. Data retention

Account and child data is generally retained for the duration of the kindergarten's active subscription plus 30 days after cancellation or departure. A child-only original is one the platform associates with exactly one child through an individual tag or recorded face match. Shared/class originals are associated with several children or have not yet been associated with an individual child. After withdrawal they are available only to authorised kindergarten staff and remain until the end of their September–August upload school year. Deletion runs hourly throughout September in bounded oldest-first batches, alerts the operator if completion by 30 September is at risk, and retries failed batches. Invoices may be retained for up to six years from issue, then a bounded daily job permanently deletes them and their line items. Security logs may be retained for up to twelve months. You may request earlier deletion or object to legitimate-interest processing; the kindergarten assesses shared-media requests against the rights of every child shown.

7. Your rights

Under GDPR you have the right to:

• Access your personal data.
• Correct inaccurate data.
• Request deletion ("right to be forgotten").
• Restrict or object to processing.
• Data portability.
• Withdraw consent (for media sharing).

Because your kindergarten is the data controller, please send requests about children's and family data — access, correction, deletion, restriction, portability, or withdrawing consent — to your kindergarten directly. They fulfil these using Linkids' tools and we assist them as processor. For data Linkids controls as the platform operator (your login account, billing, security logs), you can contact privacy@linkids.co. Requests are answered within one month (30 days).

8. Cookies

We use only essential session cookies required for authentication. We do not use advertising or analytics cookies.

9. Google Sign-In

We offer "Sign in with Google" as an authentication option. When you use this, Google shares your name and email address with us. We do not request access to any other Google account data. Google's privacy policy applies to their services: policies.google.com/privacy.

10. Changes to this policy

We may update this policy to reflect changes in the service or legal requirements. We will notify administrators by email of material changes. Continued use of the platform after changes constitutes acceptance.

11. Complaints

If you believe we have not handled your data appropriately, you have the right to lodge a complaint with the Cyprus Commissioner for Personal Data Protection (dataprotection.gov.cy) or your local EU supervisory authority.