Parent App Privacy Notice

This notice explains how the Beenest parent app handles personal data. The staff app has its own notice (Staff App Privacy Notice). How we handle data on our website and as a company is described in our Privacy Policy.

1. Who provides the app and who is responsible

The app is provided by Triple Peak Software Systems, [legal form, e.g. LLC], [registered address] ("Beenest", "we"). Email: hello@beenest.co.

Your setting is the controller. Your nursery or childcare setting (or the organisation that runs it) chose Beenest and is the controller under the UK GDPR: it decides what personal data is used, for what purpose, how long it is kept and when it is deleted. Everything you send through the app, and everything the app shows you, belongs to your setting. Your setting can give you its contact details and, if it has one, those of its data protection officer.

Beenest is the processor. Beenest provides the app and processes the data only on your setting's behalf and on its instructions (Article 28 UK GDPR; see our Data Processing Agreement with settings). We do not use the data for our own purposes, for advertising or to train AI models.

Questions about your rights go to your setting (see section 11).

AI in the parent app. The only AI feature in the parent app is AI translation (section 9), and only if your setting uses it and has chosen the highest AI privacy level, "All" [OPEN: confirm the English label of this AI level in the UK app]. Messages from your setting may have been drafted with AI help; they are sent only after the setting has reviewed them.

2. What data the app collects

The app works without a user account; you do not enter your own name or contact details. You sign in with your setting's access and your child's code. The camera is used only to scan that code. The app does not create a new record; it uses the child ID that already exists at the setting. Through the app you can send:

• absence notices (child and date; the app does not ask for a reason), meal cancellations, pickup notices with an optional note, and poll votes
• yes or no replies to the setting's events
• if your setting offers payments through the app: confirmation that your child will take part in an activity and the notice "paid by transfer" [OPEN: are in-app parent payments available in the UK?]
• if your setting has turned the feature on (off by default): the person collecting your child on a given day, including a new person with their name and relationship to the child. A new person is saved only after you confirm the collection authorisation by email (see below). Please tell that person; they must show ID at collection. Whether a child is handed over is decided by the setting's staff. The names of authorised collectors are visible on every device where your child's code is stored.
• if your setting has turned the feature on (off by default): requests for a parent meeting with a topic, and your choice of a suggested time. The topic is read by the manager or the group's team. Write only what is needed to arrange the meeting, and discuss health matters in the meeting itself.

The app shows you the setting's messages and events, blog posts, and the permissions on file for your child (without the option to change them). Depending on the setting's choices it also shows your child's authorised collectors and open payments with the recipient account and a payment QR code [OPEN: available in the UK? The DE app uses GiroCode, a euro transfer format.]. Journal entries and group reports are written by staff. You see them only if the setting has turned on display in the app (off by default) and releases the individual entry. An entry about your child is visible to everyone who has stored your child's code in the app.

Confirmation by email. For a new authorised collector, for permissions and for recording a parent meeting, the setting asks for your consent by email. The email goes to the one address the setting has on file for your child and is sent in the setting's name ("[Setting name] via Beenest"). Your consent is saved only if you open the link within one hour and confirm on the page, together with the text and the time as a record. Your name, IP address and device are not saved. The confirmation page is a Beenest web page (hosted by Vercel in Frankfurt, Germany). The request keeps your email address only until you confirm, and at most about one hour after the link expires. For permissions and recordings, the setting also keeps a log of what was sent.

Please note: anyone with access to that mailbox can confirm. Protect it, and tell your setting if your address changes. If you share parental responsibility, talk to each other; the setting may also ask for the other parent's consent. To withdraw a consent, contact your setting; the withdrawal takes effect once the setting has recorded it.

This content is linked to the child ID, not to your name, so it is pseudonymised. Pseudonymised data is still personal data.

Data minimisation. No location data, no access to photos, contacts or microphone, and no analytics or tracking tools. The web view shows only the capacity light, the setting's messages and the setting's status; you sign in with the setting's parent password. Child codes, notices and wallet passes are not available there. The web view is served by the Beenest application itself (Vercel, Frankfurt).

Your own programs and AI services. You may use what the app shows you freely, including with your own programs or AI services (for example an AI assistant that summarises messages for you). You are responsible for that use. The service you choose has its own terms and privacy notice; it is not a processor of your setting or of Beenest. Messages from the setting may contain information about other people; please pass it on only where you are allowed to. Never enter your setting's parent password in another service.

3. Push notifications

Push notifications are opt-in. You only receive them if you allow notifications in your phone's operating system. If you decline, no device token is created or sent.

If you turn on push, the operating system (iOS) or the Firebase SDK (Android) creates a pseudonymous device token. It is stored in Cloudflare KV (EU) together with the groups you chose and the IDs of the children stored in the app (at most 20), so that notifications about a particular child reach only that child's devices. The token is not linked to a name. It is deleted when you turn off push in the app (Settings, Push notifications) or sign out. You can also withdraw the permission in your phone's settings.

Tokens at the push services

To deliver notifications, the device token is also processed and stored by these services for as long as the token is valid:

• Apple Push Notification service (APNs): Apple keeps the device token in its routing infrastructure to deliver messages to iOS devices.
• Google Firebase Cloud Messaging (FCM): Google creates and manages the FCM registration token to deliver messages to Android devices.
• Expo (650 Industries, Inc., United States): Expo stores the device token, as described in its own privacy notice, to pass messages on to APNs or FCM.

This token storage is part of the platform infrastructure provided by Apple and Google. It cannot be configured or switched off at the app level, and no EU-only or provider-independent push infrastructure exists; there is no push delivery on iOS or Android without it. Transfers to Google (FCM) and Expo in the United States are protected by the UK Extension to the EU-US Data Privacy Framework where the provider is certified, and otherwise by the UK Addendum to the EU standard contractual clauses or the UK International Data Transfer Agreement. [OPEN: confirm the UK mechanism per provider (DPA Section 10, paragraph 4).] For APNs, Apple offers no data processing agreement and no APNs-specific standard contractual clauses; the Apple Developer Program License Agreement, Attachment 1, applies, and Apple Inc. is certified under the EU-US Data Privacy Framework [OPEN: Apple Inc.'s UK Extension participation].

What notifications contain

Which notifications you receive depends on the features your setting uses and on whether you allow notifications. Possible notifications:

• Group messages: title and text as written by staff; the setting's name is placed before the title.
• Messages to your family: a fixed title with the setting's name and no text; you see the content only in the app. If you answer with one of the offered actions (for example OK, Accept, Appointment, Join), the setting stores the action you chose and the time.
• Capacity light changes: only when it turns yellow (the setting is close to its limit) or red (the setting is full), with fixed texts [OPEN: English push texts in the UK build]. No notification for green, on closure days or outside opening hours. The setting can turn yellow and red off separately (on by default).
• Event reminders: title and time of the event, no names of children or groups.
• Meeting times and new journal entries: fixed texts without names, only to devices where that child is stored.
• Payments received, if your setting offers payments through the app: amount and purpose, without the child's name, only to devices where that child is stored.

Reminders about open payments are created by the app on your device (local notification); nothing is sent to push services for them. Staff must take care not to include sensitive information about children in free text; there is no technical filtering. The push services only pass message content through for delivery and do not store it permanently. The setting's data stays in the EU database (Supabase, Frankfurt). Notifications can appear on your lock screen; you can turn off previews in your phone's settings.

4. Wallet passes

You can create a digital collection card for Apple Wallet or Google Wallet. To do so, the child code, group name, setting name, setting address and, if stored, the child's name are sent to our push service at Cloudflare. The finished pass is kept in Cloudflare KV (EU data residency) for up to 5 minutes. For Apple Wallet the card is created as a file. For Google Wallet a signed link is created through Google services, and Google receives the content of the card.

If you give a child a nickname in the settings, it appears on the wallet pass. The nickname is stored only on your device and is sent to the card service once, only when you create the pass.

5. Where data is stored

Information sent through the app is stored in databases in Germany (Supabase, Frankfurt) and is protected under the UK GDPR and the EU General Data Protection Regulation. Transfers from the United Kingdom to the EU are covered by the UK's adequacy regulations for the EEA.

Exception: for push notifications and wallet passes, device tokens go to the services named in section 6. Cloudflare KV (EU) permanently holds, per setting: the setting's parent password, the setting's name, push tokens and device IDs with their group assignment and stored child IDs. Wallet passes with the child's name stay there for up to 5 minutes.

Email. Emails sent by the software, such as the consent and collection confirmation emails in section 2, are sent through Brevo (Sendinblue SAS), hosted in France and Germany with storage in Belgium. If you email us, your message is stored in our mailbox at Zoho Corporation B.V. in the Netherlands.

6. Third-party services

The app relies on these services:

• Apple Push Notification service (APNs): delivery on iOS; message content is not stored permanently (section 3)
• Google Firebase Cloud Messaging (FCM): delivery on Android; message content is not stored permanently (section 3)
• Expo (650 Industries, Inc.): relay between the app and APNs or FCM; message content is not stored permanently (section 3)
• Cloudflare, Inc.: API relay (Workers) and Cloudflare KV storage with EU data residency (Frankfurt, Cloudflare Regional Services), with no access to the database (section 7)
• Google Wallet: creating wallet passes on Android
• Supabase (database) and Vercel (application, confirmation pages and web view), both in Frankfurt, Germany
• Google Cloud Vertex AI: AI translation on the EU multi-region endpoint, only if your setting uses it (section 9)

APNs, FCM and Expo receive push tokens and the title and text of each notification (section 3). The full list of sub-processors that process the setting's data is in our Data Processing Agreement.

No analytics, tracking or advertising tools are used in the app.

7. Cloudflare (API relay and storage)

Cloudflare Workers carry data between the app and the setting's database (Supabase). API requests are forwarded to the database in the EU (Frankfurt). Cloudflare has no access to the Supabase database. In addition, our push service stores in Cloudflare KV (EU data residency), per setting, the items listed in section 5. Wallet passes, which may contain the child's name, stay in KV for up to 5 minutes.

Data passed through Cloudflare Workers

• meal cancellations
• absence notices (without a reason)
• collection notices (with an optional note)
• the setting's messages, journal entries about your own child and group reports (display only, not stored at Cloudflare)
• setting status (open, closed and so on)
• poll answers (one vote per device; the device ID is used only to prevent duplicate votes)
• collectors, meeting requests, event replies, participation and payment notices; display of events, permissions, open payments and blog posts (not stored at Cloudflare)
• pseudonymous child ID and setting ID

Not passed through Cloudflare: children's check-in and check-out times. These are recorded only at the terminal at the setting and stored directly in the EU database. Staff time records do not go through the parent app but through the staff app, directly to the Beenest application in Frankfurt.

Cloudflare Workers routing and KV storage are restricted to the EU (Cloudflare Regional Services, Frankfurt). Cloudflare, Inc. is based in the United States; possible access by the US parent company is covered by the safeguards in section 3 (UK Extension where certified, otherwise the UK Addendum or IDTA).

8. Lawful basis

Your setting, as controller, decides the lawful basis for each use of your data. As a rule: push notifications and wallet passes rely on your choice to switch them on (permission on your device) and on your setting's agreement with Beenest; technically necessary steps (such as relaying requests and preventing duplicate votes) rely on legitimate interests; the attendance record kept at the terminal relies on the setting's legal obligations (section 10). Your setting can tell you which basis it uses. [OPEN: the DE notice names Article 6(1)(a) for push and wallet and Article 6(1)(f) for technically necessary steps; confirm whether the UK notice should state Article numbers or leave the basis to the setting.]

9. Storage on your device

On your device the app stores only the access to your setting (in the device's protected storage), the child codes, nicknames, settings and your own replies. The setting's content is not stored on the device; it is loaded each time you open it. Exceptions: for offline display of the calendar, the setting's closure days and closures and its dated messages from the current month onwards (title, text, group) stay on the device.

If you use the app in another language, your device translates messages, blog posts, journal entries and the meal plan itself (Apple Translation or Google ML Kit, without sending anything to third parties) and stores the translations on the device (at most 500 entries). If your setting uses AI translation, AI translates the full content instead, on a server in the EU (Google Cloud Vertex AI, EU multi-region), into the language the setting has on file for you or, as long as none is on file, the language you choose in the app. That language choice is sent to the setting. Only the translation is stored by Beenest, for at most 30 days. Push notifications are not translated.

The access is sent only when you sign in and when you register for push. The nickname is sent only when you choose to create a wallet pass (section 4).

No screenshots, no sharing. Screenshots, screen recordings and photographing the app's content are not permitted, nor is passing content on to others or into other apps such as messengers or social networks. This applies especially to messages, journal entries and information about other people.

Keep the QR code safe. The QR code is a key to your access. Keep it safe and do not show it to anyone who should not have it. If it is lost or in the wrong hands, tell your setting straight away; it will issue a new code.

10. Required and voluntary data

Drop-off and collection times

Drop-off and collection times are recorded only at the check-in terminal at the setting, not through this app. Childcare settings keep attendance records to show who is on the premises, to meet their staffing and capacity rules and to document when responsibility for a child passes between parents and the setting. In England, the EYFS statutory framework requires providers to keep a daily record of the names of the children being cared for on the premises, their hours of attendance and the names of each child's key person. Settings in Scotland, Wales and Northern Ireland follow the requirements of their own regulator (the Care Inspectorate, Care Inspectorate Wales or the HSC Trust). The terminal is the tool your setting uses for this; ask your setting whether it is part of your childcare agreement.

Choice of software

These rules require the record but do not say which software a setting must use. Your setting chooses its software, provided a processing agreement under Article 28 UK GDPR is in place, just as an employer chooses the office software for its staff. Your rights concern how your data is protected, not which technical system the setting uses.

Voluntary data (through this app)

Everything you send through this app, such as meal cancellations, collection notices and other messages, is voluntary. The app is an optional channel between parents and the setting. You do not have to use it.

11. Your rights

As a parent or carer, and on behalf of your child, you have these rights under the UK GDPR. Because your setting is the controller, send requests to your setting. If you send a request to us, we pass it to your setting and help the setting respond.

• Access (Article 15): you can ask which data about you or your child is held.
• Rectification (Article 16): you can ask for inaccurate or incomplete data to be corrected. Data stored only on your device (such as nicknames) you can change directly in the app.
• Erasure (Article 17): you can delete data stored on your device at any time with "Reset app" in the settings. Data you send through the app becomes part of the setting's records once the setting receives it. Where the setting must keep records (for example, records about individual children, which the EYFS requires to be kept for a reasonable period after the child leaves, a period the provider decides), it may keep them for that time instead of erasing them, and deletes them afterwards. Attendance times at the terminal fall under the same record-keeping rules.
• Restriction (Article 18): you can ask for processing to be restricted, for example while you contest the accuracy of data.
• Data portability (Article 20): you can receive the data you provided in a structured, commonly used and machine-readable format.
• Objection (Article 21): you can object to processing based on legitimate interests. Where the setting keeps records because the law requires it, there is no right to object to that record as such.
• Withdrawing consent: where processing relies on your consent (for example permissions, or push notifications on your device), you can withdraw it at any time; this does not affect processing before the withdrawal.

Complaints. You have the right to complain to the Information Commissioner's Office (ICO), the UK data protection regulator (ico.org.uk). We would appreciate the chance to help first: please contact your setting or us.

Children. Children are not users of Beenest; parents and staff use the apps. Information about children is entered by the setting or by parents, and children are data subjects whose rights parents usually exercise for them. The app is designed for adults and is not intended to be used by children; we therefore do not treat it as an online service likely to be accessed by children within the meaning of the ICO's Children's code (Age appropriate design code). [OPEN: confirm this assessment.]

12. Support via WhatsApp

[OPEN: is WhatsApp support available in the UK? If not, remove this section.] We offer optional support via WhatsApp, a service of Meta Platforms, Inc., based in the United States. If you use this channel:

• Do not share personal data: do not send personal or sensitive information over WhatsApp (for example children's names, dates of birth, health information, photos or documents with personal content). The channel is only for general questions and technical support.
• Storage outside the UK and the EU: WhatsApp messages are processed and stored on Meta's servers, which may be outside the UK and the EU (in particular in the United States), under Meta's own terms and privacy policy.

Using the channel is your choice. [OPEN: lawful basis; the DE notice relies on consent by actively using the channel.] For anything involving personal data, please email hello@beenest.co.

13. Changes

We may update this notice when needed. The current version is always available in the app and at beenest.co/uk/parent-app-privacy.

14. Contact

Questions about privacy: hello@beenest.co or [privacy contact email]. Questions about your own data or your child's data are best sent to your setting.