Staff App Privacy Notice

This notice explains how the Beenest staff app handles information. The parent app has its own notice (Parent App Privacy Notice). How we handle data on our website and as a company is described in our Privacy Policy.

1. Who provides the app and who is responsible

The app is provided by Triple Peak Software Systems, [legal form, e.g. LLC], [registered address] ("Beenest", "we"). Email: hello@beenest.co.

Your employer is responsible for your data. Your child care center (or the organization that operates it) is your employer, chose Beenest and decides what staff and operational information is used, for what purpose, how long it is kept and when it is deleted. Everything you send through the app, and everything the app shows you, belongs to your center. Beenest provides the app and processes the data only on your center's behalf and under its instructions, as a "service provider" or "processor" under applicable US state privacy laws (see our Data Processing Addendum with centers). We do not use the data for our own purposes, for advertising or to train AI models. We do not sell or share personal information (as those terms are used in the California Consumer Privacy Act) and do not use it for targeted or cross-context behavioral advertising.

Questions about your rights go to your center (see section 10).

2. What data the app collects

The app is for the center's staff. You sign in with the center ID, your personal QR code (the same one you use at the terminal) and a personal password. The camera is used only to scan that code. The app does not create a public user account. Your sign-in stays on the device for up to 30 days.

Through the app you can send or receive:

• your own working hours and overtime balance; if your center has turned on clocking in and out in the app (on by default): remote or off-site check-in with a work category (without location) and time corrections (as a request to the director, not in the team chat)
• absence and sick notices (reason and optional note; a sick notice may contain health information)
• internal team chat messages (content, time, sender's name or initials), pinboard, polls, calls, @mentions and messages to parents
• inbox: messages from the director to you personally, answers to your working-time requests and your upcoming staff appointments (section 3)
• a wallet staff badge (name, badge ID, group, center name and address), only if you add it

If your center uses staff planning (off by default), the app shows the day plan and the team week: names, shifts, breaks and current attendance of your colleagues. You see absence reasons only for yourself. What the app shows about children depends on your center's privacy mode (section 4). In "Personal phones" mode (the default) it shows no children's records and no child codes, only counts. It shows child codes in no mode. Free text from colleagues or the director, and the topic parents give for a conference, can contain information about children in either mode.

Other features

Depending on your center's settings, the app also shows:

• the center's calendar and your own staff appointments; for a parent conference the description can contain the parents' concern
• rooms to book (the name of the person who booked is visible)
• hazard topics with notes, warning triangles and thumbs-up (the author's name is visible)
• handbooks to read

Directors can record and delete hazard notes.

What your center sets

Your center decides in its settings which features you see in the app; you cannot change this yourself. Defaults:

• staff app, team chat, clocking in and out (remote check-in, time correction), messages to parents: on; the center can turn each one off
• day plan and team week: only with staff planning (off by default)
• privacy mode: "Personal phones"; the center can choose "Work devices" (section 4)
• AI data guard in the team chat: off; only the center can turn it on (section 4)
• team chat retention: 1 day; 1 to 7 days can be chosen
• automatic notices: required break off, "daily working time reached" on, "scheduled but not here" on; the center can switch each rule. The "not checked out" notice is always on (section 3)
• AI helper: off; only the center can turn it on (section 7)
• push notifications: only if you allow them on your device

Your center can tell you what it has set.

Data minimization. The app collects no location data, does not access photos, contacts or microphone, and contains no analytics or tracking tools. It does not collect biometric identifiers such as face geometry or fingerprints [OPEN: confirm]. Content is not stored on the device; it is loaded each time you open it.

Not in this app: check-in and check-out of children (only at the terminal at the center). No child codes, no parent password. The parent app is separate.

3. Internal team chat

The team chat is one shared chat for all staff at your center; the director reads and writes along on a computer. There are no one-to-one chats between staff. Your center can turn the team chat off in the app (on by default). Messages can be tagged with @Staff, @Pinboard, a group or a person's name. The chat can also be reached on personal devices. It is not meant for sensitive information: no health information, no social services information and no personnel file content. Whether and how children may be named in the chat depends on the privacy mode (section 4).

Inbox. The director can send you a message from a computer that only you read in the app. It appears in your inbox, together with answers to your working-time requests and your upcoming staff appointments. You cannot reply in the inbox, and no email is sent. Messages from the director stay stored until the center deletes them; there is no automatic deletion. If the center has turned on the AI data guard, it checks the message before it is sent (section 4).

Free text in the app. For a sick notice, the notice itself is enough; you do not need to, and should not, give a diagnosis. Hazard notes are seen by the whole team; describe the hazard, not the behavior of individual colleagues. Messages to parents reach all parents of the center or of the chosen group and can appear as push notifications on lock screens; do not name individual children in them.

Retention. Your center sets how long chat messages are kept: 1 to 7 days, 1 day by default. After that they are deleted automatically at midnight (in your center's time zone). Pinboard posts, including team polls, are excluded from this deletion and stay until they are removed or the center's contract with Beenest ends.

Polls. Your vote is stored with your name so that each person has one vote; only the totals are shown.

Calls. Colleagues and the director can "call" you through the chat when you are checked in. You get a push notification with the caller's name and reason and can answer "Coming" or "Can't"; the call and the answer appear in the chat.

Automatic notices. Your center can let the system post working-time notices in the chat under the sender "Automatic notice". Posted notices name the person concerned and are visible to staff in the chat. The rules and their defaults:

• Required break (a notice about a required break): off, can be turned on; push only to you
• Daily working time reached (the time recorded for you today reaches your contract time for the day): on, can be turned off; push only to you
• Scheduled but not here (a scheduled shift has been running for an hour without a check-in; only with staff planning): on, can be turned off; push to the group's staff
• Not checked out (you are still checked in from an earlier day): always on and cannot be turned off, because attendance must be fully recorded; push only to you, no earlier than opening time

The notices state facts from the recorded times; they are not an assessment. "Scheduled but not here" only says that a check-in is missing, not why. Like all chat messages, they are deleted after the set retention period. Your center can tell you which notices are on.

4. Privacy mode: personal phones or work devices

Your center chooses one of two modes in its settings. The mode applies to the whole center and so to every device where the app is signed in. The features differ only a little. The main difference is what belongs in free text and how the AI data guard is used.

Personal phones (default)

• For centers where staff also use the app on their own phones.
• The app shows no children's data, only counts. Features that need children's names are locked, for example "Create appointment".
• Free text (team chat, pinboard, calls, notes): no names and no recognizable descriptions of children, no health information.
• AI data guard in the team chat: we strongly recommend it.

Work devices

• By choosing this mode, the center declares that the app runs on the center's devices. If the app is signed in on your personal phone in this mode, talk to your center.
• The app may show names of children in your own group where a feature needs them. As of this version, no feature shows names yet; the first one planned is the parent conference request. The app does not store these names on the device and does not pass them to AI features.
• Free text: in the team chat you may name children where the daily routine requires it, for example who is being picked up early. Health information, social services information, and information about child protection or custody do not belong in the chat here either.
• AI data guard in the team chat: recommended, especially against health information in quickly typed messages.

AI data guard in the team chat

The data guard is off by default. Only the center can turn it on, and it works the same in both modes. It runs only if the center's AI features are set to the level "All" [OPEN: confirm the English label of this AI level] and AI credits are available; without credits the team chat is not checked. Before a message is sent, AI on Google Cloud Vertex AI in the United States checks the text for sensitive information, such as health information. In the team chat it does not compare the text with children's names. If it finds something, the message is not sent and you see a notice; you can change the text or send it anyway. If the check is not possible, the message goes out unchecked. The data guard does not store texts; only the fact that a check happened is counted, without text and without the person. The check is not complete. It does not check other free text in the app, including calls and messages to parents.

5. Push notifications

Push notifications are opt-in. You grant the permission yourself in your phone's operating system and can withdraw it at any time in your phone's settings; the app has no separate switch for it. If you decline, no device token is created or sent.

If you allow push, the operating system (iOS) or the Firebase SDK (Android) creates a device token. It is stored in Cloudflare KV (United States) and linked to your staff ID so that personal notices reach only you. It is deleted when you sign out or leave the center. The center's data stays in the database in the United States.

Tokens at the push services

• Apple Push Notification service (APNs), Apple Inc.: Apple keeps the device token in its routing infrastructure to deliver messages to iOS devices.
• Firebase Cloud Messaging (FCM), Google LLC: Google creates and manages the FCM registration token to deliver messages to Android devices.
• Expo, 650 Industries, Inc. (United States): Expo stores the device token, as described in its own privacy notice, to pass messages on to APNs or FCM.

This token storage is part of the platform infrastructure provided by Apple and Google; there is no push delivery on iOS or Android without it. The push services only pass message content through for delivery and do not store it permanently.

What notifications contain

You receive notifications only if you allow them on your device, and only for features your center has turned on:

• Traffic light: when it turns yellow (the center is close to its limit) or red (the center is at full capacity), with fixed texts. No notification for green, on closing days or outside opening hours.
• Team chat (on by default): title is the author's name, text is the start of the message. The tag decides who gets it: @Staff and @Pinboard the whole team, a group that group's staff, @Name that person; without a tag, no notification.
• Calls (part of the team chat): "[Name] is calling you" with the chosen reason, only to the person called and only if they are checked in. On iPhones a call is a time-sensitive notification and can break through a Focus mode.
• Automatic notices (each rule switchable by the center, see section 3): the notification names the person concerned and goes to them; for "scheduled but not here" it goes to the staff of the group concerned.
• Appointment reminders: for staff appointments you take part in, from 7:00 a.m. on the day and in the 30 minutes before the start, with only type, time and group.
• Inbox: "New message in your inbox" with a prompt to open the staff app, only to you; it names neither sender nor content.
• Working time: confirmation to you when you check in, check out or switch in the app, for example "Checked out at 4:30 p.m."; without names.
• End of care hours: starting November 1, 2026 [OPEN: same start date for the US app?], once a day shortly after closing time, to everyone still checked in to childcare (not to housekeeping staff): your time now counts as time not with children, but you still have to check out. Fixed text without names.

As intended, notification content is about organization and working time, not sensitive information about children. Team chat messages are checked before sending only by the AI data guard, if the center has turned it on (section 4); other free text is not technically filtered. Time corrections, sick notices and the chat history go over the encrypted connection to the application, not through push. Notifications can appear on your lock screen and stay in your phone's notification center until you delete them. You can turn off previews in your phone's settings.

6. Where data is stored

Information sent through the app is stored in databases in the United States (Supabase, Inc., hosted in [AWS region]). Requests from the staff app go encrypted directly to the Beenest application (Vercel, United States), not through Cloudflare.

For push notifications, device tokens go to the services named in section 7. Cloudflare KV (United States) can hold push tokens and device IDs with your staff ID.

Email is processed in the EU. The staff app itself sends no email. If you email us, your message is stored in our mailbox at Zoho Corporation B.V. in the Netherlands. Emails the software sends for other features go through Brevo (Sendinblue SAS), hosted in the EU [OPEN: confirm Brevo stays in EU as part of "mail"]. Email is the only part of the service that runs in the EU.

7. Third-party services

The app, and push and wallet if you use them, rely on these services:

• Apple Push Notification service (APNs): delivery on iOS, only with push turned on
• Google Firebase Cloud Messaging (FCM): delivery on Android, only with push turned on
• Expo (650 Industries, Inc.): relay between the app and APNs or FCM, only with push turned on
• Cloudflare, Inc.: sends push notifications and stores push tokens in Cloudflare KV in the United States; push title and text are only passed through for delivery. Cloudflare has no access to the Supabase database.
• Vercel, Inc. (United States): runs the application; the app sends its requests there, encrypted
• Supabase, Inc. (United States): database
• Apple Wallet or Google Wallet (Google LLC): only if you add the staff badge. On iPhone our Cloudflare service creates the pass and keeps it for at most 5 minutes for a single download; on Android the pass data goes to Google. If your center replaces your badge, the saved pass is no longer valid; delete it from your wallet.
• Google Cloud Vertex AI (Google LLC): for the AI helper if your center has turned it on (United States multi-region), for the AI data guard (section 4), and for the preview image of a hazard topic. For the preview image, AI in the United States describes the topic's title and description without people; only that description goes to image generation on Google's global endpoint, which may process it outside the United States. Your center's operator can turn this off.

Time records, absences and chat go encrypted directly to the application, not through Cloudflare. The full list of service providers that process center data is in our Data Processing Addendum.

No analytics, tracking or advertising tools are used in the app.

AI helper (optional). The app includes an AI helper that answers questions about the center's daily work. It is off until the center turns it on in its settings, and the operator can also block it. For teachers and caregivers the helper always works with identifiers instead of names. For directors it uses names only if the center has chosen the level "All"; then the AI sees staff names. Processing runs on Google Cloud Vertex AI in the United States; the data is not used for training. What you type into the helper goes to the AI. Do not enter health information there.

8. Storage on your device

On your device the app stores only your session sign-in (in the operating system's protected storage: Keychain or Keystore) and a random device ID for push. Working hours, schedules, chat and other content are not stored by the app; they are loaded each time and kept only in memory. Outside the app, content can remain on the device: push notifications in the notification center, an added wallet badge, text you copy, and screenshots. The sign-in can be included in a device backup; the server rejects a sign-in from an outdated backup. It is valid for at most 30 days from login and does not renew itself. "Sign out" or "Reset app" in the settings ends the session on this device.

No screenshots, no sharing. Screenshots, screen recordings and photographing the app's content are not permitted, nor is passing content on to others or into other apps such as messengers or social networks. This applies especially to messages, schedules, attendance and information about other people.

Keep your QR code safe. Your QR code is your staff badge at the terminal and your ID when you sign in to the app. Together with your own password it opens your access. Keep your badge and password safe and never give your password to anyone. If your badge is lost or in the wrong hands, tell your center right away; it will issue a new code.

9. Time records, devices and workplace monitoring

Staff attendance and time records

Attendance of staff and children at the entrance is recorded at the check-in terminal at the center. The center uses these records for licensing and supervision and to keep its staff-to-child ratios. The staff app adds remote check-in and shows you your recorded times and your overtime balance. Time records you send become your employer's records; the center keeps and deletes them according to its policies and the record-keeping rules that apply to it. Your employer decides whether and how it uses the app for this.

Chat and push

The team chat and push notifications are extra features. Push only after you opt in in the operating system. The chat is not required for attendance records at the entrance.

Work devices or personal phones

Who decides. Whether you use the app on a work device of your center or on your personal phone is decided by your employer; ask about the policy that applies. We recommend using the app only on the center's work devices. Under our agreement with centers, use on a personal phone is meant to be voluntary: your working time at the center is recorded at the terminal, and sick notices and requests are possible without the app [OPEN: does the US DPA require the employer to keep personal-phone use voluntary and free of disadvantage, as the DE AVV Anlage 2B §1(2) and §4(3) do?]. What the app shows on which devices, and what belongs in free text, is set by your center's privacy mode (section 4).

On your personal phone. The app uses only the camera (to scan your QR badge) and, if you agree, notifications. It does not access photos, contacts, location or microphone and contains no analytics or tracking tools. From your phone, only the push device ID, the device type (iOS or Android) and the time of last use are stored. We cannot manage your phone or wipe it remotely. Please:

• protect your phone with a screen lock and do not let anyone else use the signed-in app,
• turn off notification previews on the lock screen if others can see your phone,
• mute notifications in your phone's settings during your free time if you do not want to be reachable. The app itself creates no duty to read messages outside working hours; your employer's policies apply,
• sign out before you give away, sell or send your phone for repair.

On a work device. Your employer's rules also apply. A work device can be managed by your employer (for example through device management software). What your employer can see that way depends on those rules, not on this app.

On a shared device. The sign-in is personal and lasts up to 30 days; the app does not sign you out by itself. Sign out after each use (Settings, Sign out) and do not share your password.

Loss or theft. Report the loss to your center right away. It replaces your QR badge. This ends all your sign-ins (after 15 minutes at the latest), deletes your own password and removes your devices from push notifications. You then set up the app again with the new badge.

Leaving the center. When your center archives your record, all sign-ins end (after 15 minutes at the latest), your own password is deleted and your devices no longer receive push notifications. Please then delete the app and any saved wallet badge.

Electronic monitoring notice

Some features can show how and when staff work, in particular recorded working times and the hours balance, the day plan with current attendance, automatic notices that are turned on, calls with answers, polls with a vote linked to the person, and an AI helper that uses names for directors. Some states require employers to give employees notice of electronic monitoring (for example N.Y. Civ. Rights Law § 52-c, Conn. Gen. Stat. § 31-48d and Del. Code tit. 19, § 705). Giving any notice required by state law, and getting any acknowledgment it requires, is your employer's responsibility, not Beenest's. Ask your employer for its notice.

10. Your rights

Because your employer decides how your data is used, send requests about your data to your center, not to the app store. That includes requests to see, correct, delete or receive a copy of data. If you send such a request to us, we will pass it to your center or tell you to contact the center, and we help the center respond.

• Correct: your center can correct inaccurate information.
• Delete: you can delete data stored on your device by resetting or uninstalling the app. Time and attendance records you send become your employer's records and are kept as its policies and applicable law require. Chat messages are deleted after the retention period your center sets; pinboard posts as described in section 3.

Some US states, including California, give residents, including employees, rights over their personal information. A summary of these rights and how we handle them as a service provider is in our Privacy Policy.

Children. Parents and staff use Beenest apps; children do not. The app is not directed to children. We do not knowingly collect personal information directly from children under 13.

11. Support via WhatsApp

[OPEN: is WhatsApp support available in the US? If not, remove this section.] We offer optional support via WhatsApp, a service of Meta Platforms, Inc. If you use this channel:

• Do not share personal information: do not send names of children or staff, health information, photos or documents with personal content.
• Storage by Meta: messages are processed on Meta's servers under Meta's own terms and privacy policy.

For anything involving personal information, please email hello@beenest.co.

12. Changes

We may update this notice when needed. The current version is always available in the app and at beenest.co/staff-app-privacy.

13. Contact

Questions about privacy: hello@beenest.co or [privacy contact email]. Questions about your own data are best sent to your center.