Privacy Policy

This Privacy Policy explains how PineThom ("PineThom", "we", "us") collects, uses, shares, protects and deletes information when schools, daycares, their staff and the families they invite use the PineThom platform (the "Service"). It applies to the website, the school portal and the family portal.

Because the Service stores information about children, we apply heightened care to that data. This Policy describes the rights of parents and legal guardians under the Children's Online Privacy Protection Act (COPPA) and applicable state laws.

• The School (the preschool or daycare) decides what information is entered into the Service and why. In legal terms, the School acts as the data controller (or "business") for its School Data.
• PineThom processes that data only to operate the Service on the School's behalf, acting as a service provider (or "processor"). We do not use School Data for our own marketing, and we do not decide how long a school must keep its regulatory records.
• For information PineThom collects directly about account holders (such as login and billing data), PineThom acts as the controller.
• If you are a parent or guardian, the fastest way to exercise most rights is through your school; you may also contact us directly at any time.

a) Account information. Name, email address, password (stored only as a secure hash), role (director, staff or family), preferred language, and the school the account belongs to.

b) Child information (entered by the School or family). Name, date of birth, optional photo, classroom and enrollment type, allergies, health and care notes (such as feeding and toileting routines), and authorized pickup persons.

c) Attendance and check-in data. Date and time of each drop-off and pickup, the person identified as dropping off or picking up, the method used (drawn on-screen signature or rotating PIN code), the signature image when drawn, and — only when the device user grants permission — the approximate geographic location at the moment of the event.

d) Documents. Files uploaded by the School or by families, such as immunization forms, physical examination forms and enrollment paperwork, along with their review status and expiration dates.

e) Requests and communications. Change requests submitted by families (for example, a suggested pickup person or updated allergy information), approvals and rejections by the School, and messages exchanged through the Service.

f) Billing information. Subscription status, plan and transaction references. Payment card data is collected and stored by our payment processor (currently Stripe); PineThom never sees or stores full card numbers.

g) Usage and device data. Log data such as IP address, browser type, pages visited and error diagnostics, used to secure and improve the Service.

• We do not knowingly collect personal information directly from children under 13. Children do not have accounts, logins or profiles they operate themselves.
• We do not build advertising profiles, we do not show third-party advertising, and we do not sell or rent personal information to anyone.
• We do not track families or children across other websites or apps.
• Location is captured only at the moment of a check-in event and only with the device user's permission; we do not track location continuously.

• To provide the Service: attendance records, child profiles, ratio indicators, document tracking, requests and communication between Schools and families;
• To keep auditable, tamper-evident logs of check-in and check-out events, as required for childcare record-keeping;
• To secure the Service: authentication, access control, abuse prevention and debugging;
• To send service communications: invitations, trial reminders, expiration alerts and account notices;
• To process subscriptions and prevent fraud;
• To improve the Service, using aggregated and de-identified data only;
• To comply with legal obligations and respond to lawful requests.

• The Service is directed to schools and adults, not to children. Child Data is provided by the School or by the child's parent or legal guardian.
• Before a School enters information about a child, it must obtain the consent of the child's parent or legal guardian and inform them that the data will be processed in PineThom. Schools act as the consent point for families, consistent with COPPA's school-exception and consent framework.
• Parents and legal guardians have the right to: review the personal information we hold about their child; request corrections; request deletion; and refuse further collection or use of their child's information.
• To exercise these rights, contact your school, or email us at privacy@pinethom.com with enough information for us to verify your relationship to the child. We will respond within a reasonable time and in any event within the periods required by law.
• If a parent refuses or withdraws consent, some features (such as digital check-in or document tracking) may no longer be available for that child, and the School may need to keep certain records on paper to satisfy its own regulatory obligations.
• We keep Child Data only for as long as the School's account is active or as needed to meet the School's regulatory retention duties, and we delete it afterwards as described in Section 9.

Some Schools may receive federal funds that subject certain records to the Family Educational Rights and Privacy Act (FERPA). Where FERPA applies, PineThom acts as a "school official" with a legitimate educational interest, processing records only under the School's direction and not disclosing them except as the School instructs or the law requires. Florida residents may also have rights under the Florida Digital Bill of Rights; nothing in this Policy limits rights that cannot be waived.

We share information only in these cases:

• With the School and its Authorized Users, according to the role-based permissions of the platform (families only see their own children's data; staff only see their school's data);
• With service providers that help us operate the platform — cloud hosting and database infrastructure, email delivery, error monitoring and payment processing — each bound by contractual confidentiality and data-protection obligations;
• When required by law, subpoena, court order or a lawful request from child-protection or licensing authorities;
• To protect the safety of a child, a person, or the security of the Service;
• In connection with a merger, acquisition or sale of assets, with notice and subject to the commitments of this Policy.

We do not sell personal information, and we do not share it with third parties for their own marketing.

Security. We apply industry-standard safeguards, including: encryption in transit (TLS) and at rest; database-level isolation that restricts each account to its own school's data; role-based access (director, staff, family); immutable audit logs for attendance events; private, access-controlled storage for uploaded documents; and least-privilege access for our own operations. No method of transmission or storage is 100% secure, but we work to protect the information entrusted to us.

Breach notification. If we become aware of a breach of security affecting personal information, we will notify affected Schools without undue delay and within the timelines required by applicable law (including the Florida Information Protection Act), and we will cooperate so Schools can meet their own notification duties to families and regulators.

Retention. We keep School Data while the School's account is active. After an account is closed or a trial expires, data remains available in read-only mode for a 30-day export grace period and is deleted within 90 days afterwards, except where a longer retention is required by law, by the School's regulatory obligations communicated to us, or by an ongoing legal hold. Backup copies cycle out on their normal schedule. Attendance and enrollment records may be retained longer when the School instructs us to meet childcare record-keeping rules.

• Access and correction: account holders can review and update their own profile information in the portal; families can request corrections to their children's information through the school or the request feature;
• Deletion: you may request deletion of your account or of your child's information, subject to the School's legal retention duties;
• Export: Schools may request an export of their School Data at any time while the account is active and during the 30-day grace period;
• Communications: you can opt out of non-essential emails; service and safety notices (such as pickup confirmations) cannot be disabled while the account is active;
• State rights: depending on your state of residence (including Florida and California), you may have additional rights of access, correction, deletion and portability. We honor verifiable requests regardless of state, and we will not discriminate against you for exercising them.

To exercise any right, contact your school or email privacy@pinethom.com. We may need to verify your identity and, for child data, your relationship to the child.

The Service is operated from the United States and data is stored on servers located in the United States. The interface is available in English, Spanish and Portuguese for the convenience of multilingual families; use of the Service is governed by U.S. and Florida law.

We use only the cookies and local storage strictly necessary to operate the Service (for example, keeping you signed in). We do not use advertising or cross-site tracking cookies.

We may update this Policy from time to time. For material changes — especially any change affecting Child Data — we will notify Schools at least 30 days in advance by email or through the Service, so they can inform families where required. The "Last updated" date above always shows the current version.

• Privacy questions and parent rights requests: privacy@pinethom.com
• General questions: contact@pinethom.com

PineThom · Grow your school, keep your family.