ChildLink Privacy Policy

ChildLink is a product of yHere, Inc., a Florida corporation (“yHere,” “we,” “us,” or “our”). This Privacy Policy explains how we collect, use, disclose, retain and protect information in connection with the ChildLink website at myChildLink.com, ChildLink accounts and applications, support services and ChildLink integrations (collectively, the “Service”). Separate yHere products, including HereNow and GovLink/SubsidyLink, may have their own privacy notices and terms.

1. Who is responsible for information

ChildLink is provided to childcare centers, schools and other childcare organizations (“Customer Organizations”). Customer Organizations decide what organization records they enter into ChildLink, which users may access those records and how the records are used for their childcare operations.

For information entered or maintained by a Customer Organization, that organization is generally the party responsible for the data under applicable law, and yHere generally processes the information to provide ChildLink on the Customer Organization’s instructions. Requests about a child, guardian, staff member, attendance, billing, subsidy, schedule or other organization record should normally be directed to the applicable Customer Organization first.

yHere is directly responsible for information it collects for its own purposes, such as website inquiries, demo requests, account and authentication information, service security information, billing relationships with Customer Organizations and certain shared yHere identity information described below.

2. Information we collect

Website and demo information

If you request a demo or otherwise contact us, we may collect your name, organization or center, email address, phone number, role, number of locations and the information you include in your message. We also may collect ordinary website and security logs, such as IP address, browser and device type, referring page, request identifiers and timestamps.

Account, authentication and shared identity information

We may collect name, email address, phone number, authentication identifiers, sign-in provider information, email-verification status, multi-factor authentication information, login timestamps, device registrations and security events.

ChildLink may use account and identity services operated by yHere. Where shared identity features are enabled, certain account profile information—such as name, email address, phone number, authentication information and security settings—may be associated with a common yHere person or account record so that a person can use one identity across participating yHere services. Organization-specific permissions and records remain separately controlled; one Customer Organization does not gain access to another organization’s records merely because the same person uses both.

Center, child, family and operational information

Depending on the Customer Organization and enabled features, ChildLink records may include names, dates of birth, addresses, phone numbers, guardian and family relationships, staff roles, child profiles, schedules, classrooms or rooms, attendance, check-in/check-out events, emergency contacts, authorized pickup information, subsidy and payer information, billing records, messages, notes, photos, documents and other attachments, and audit history.

Customer Organizations may also enter health-related information needed for childcare operations, such as allergies, medications, medical notes or immunization information. We do not use child, health, attendance, subsidy or financial information for targeted advertising.

Photos, audio, video and biometric information

ChildLink may allow authorized users to upload or capture photographs and attachments for authorized records and operational purposes. ChildLink does not perform facial recognition and is not designed to collect audio or video recordings. If a Customer Organization separately enables another yHere product such as HereNow, any biometric or facial-recognition processing performed by that separate product is governed by the notices and terms applicable to that product.

Location, device and technical information

ChildLink may process addresses and location information that an authorized user chooses to provide for operational purposes. If an optional feature requests device location, the user will be asked to grant the applicable device permission. ChildLink is not designed to continuously track the location of children. We may also collect app version, operating system, browser or device type, IP address, crash and performance information, request identifiers, security logs and similar diagnostic information.

Payments and financial connections

ChildLink uses or expects to use Stripe for credit-card and ACH payment workflows. Stripe may collect and store the payment-card or bank information it needs to process those transactions. ChildLink does not intentionally store full payment-card numbers or bank-account credentials in its application databases.

ChildLink may use Plaid for Customer Organization bank-account and credit-card connections used in authorized financial workflows. Plaid collects and processes the financial connection information it needs to provide those services. ChildLink does not intentionally store users’ online-banking passwords.

Information from integrations and service providers

ChildLink may receive information from Customer Organizations, authorized yHere integrations and service providers used to operate the Service, including Google Cloud, Firebase, Postmark, Stripe and Plaid. Our current infrastructure and service-provider list is available on our Subprocessor List.

3. How we use information

We may use information to:

• provide, operate, secure, maintain and support ChildLink;
• authenticate users and enforce organization, site, center and role-based permissions;
• provide childcare-center, child, family, staff, attendance, scheduling, billing, subsidy, messaging, reporting and related functionality;
• process payments and authorized financial connections through third-party providers;
• send service, security, operational, billing and support communications;
• respond to demo requests and other inquiries;
• detect fraud, abuse, unauthorized access and security incidents;
• troubleshoot errors, measure performance and improve reliability;
• comply with applicable law, lawful requests, contracts and accounting obligations; and
• enforce our Terms and protect users, organizations, systems, rights and property.

We do not sell personal information. We do not use child, attendance, health, subsidy, financial or biometric information for targeted advertising. We may send product news or marketing communications when a recipient requests them or as otherwise permitted by applicable law, and recipients may opt out of promotional email.

4. How we disclose information

We may disclose information to:

• the Customer Organization that controls the applicable records and users authorized by that organization;
• service providers that host, authenticate, secure, maintain, message, process payments for or otherwise support ChildLink;
• Google Cloud and Firebase for hosting, Cloud SQL, authentication and related infrastructure;
• Postmark for transactional and service email;
• Stripe for payment and ACH processing;
• Plaid for authorized Customer Organization financial-account connections;
• integration partners or separate yHere services enabled by the Customer Organization;
• professional advisers, auditors, insurers or parties to a corporate transaction subject to appropriate confidentiality obligations; and
• regulators, courts, law enforcement or other parties when disclosure is legally required or reasonably necessary to protect people, systems or rights.

See our Subprocessor List for the current providers used to operate ChildLink.

5. Children and child records

ChildLink is an adult-operated childcare management service. Children do not create or use ChildLink login accounts. Customer Organizations and authorized adults enter and manage child records. Customer Organizations are responsible for determining the lawful basis for the information they collect, providing required notices and obtaining parent or guardian authorization where required.

We do not knowingly use children’s information for targeted advertising or sell it. If you believe information about a child was entered or handled improperly, contact the applicable Customer Organization or email privacy@mychildlink.com.

6. Data retention

We retain information for as long as reasonably necessary to provide the Service, follow Customer Organization instructions, maintain security and backups, satisfy legal or accounting obligations, resolve disputes and enforce agreements.

When a Customer Organization ends its ChildLink subscription, we intend to provide a reasonable opportunity to export its data. Organization data may remain recoverable for up to 90 days after termination. After that period, we delete the organization’s data from active production systems, subject to backups, legal holds, fraud and security records, and records yHere must retain for legal, tax or accounting purposes. Backup copies may persist for a limited additional period until overwritten or deleted through normal backup cycles.

Customer Organizations remain responsible for exporting and retaining records they are legally required to maintain after their ChildLink subscription ends. More information is available on our Data & Account Requests page.

7. Account deletion, correction and privacy requests

Where self-service controls are available, users may update certain account information or initiate account actions within ChildLink. You may also request access, correction or deletion by emailing privacy@mychildlink.com.

Deleting an individual login does not necessarily delete organization-owned child, guardian, staff, billing, attendance, subsidy, message or audit records. Those records belong to the Customer Organization’s operational record set and may need to remain for legal or business reasons. When a request concerns organization-controlled data, we may refer the request to or coordinate with the applicable Customer Organization.

Depending on applicable law, individuals may have rights to request access, correction, deletion, portability, restriction, objection or withdrawal of consent. We will verify and respond to requests as required by applicable law. See Data & Account Requests for additional details.

8. Security

We use administrative, technical and physical safeguards designed for the nature of the information we process, including authenticated APIs, role-based access controls, encrypted transport, secret management, backups, logging, monitoring and security review. No method of transmission, storage or system security can be guaranteed to be completely secure.

9. Cookies, analytics and advertising

The public ChildLink website may use technologies that are necessary for site operation, security and performance. We do not use ChildLink’s child, center operational, health, attendance, subsidy or financial records for targeted advertising. If we introduce non-essential analytics or advertising technologies that require additional notice or choice, we will update this Policy and provide controls as required by applicable law.

10. United States service and processing

ChildLink is currently offered to Customer Organizations in the United States, beginning in Florida. Our service providers may process information in locations permitted by their service terms. Where applicable law requires additional safeguards for a transfer or processing location, we will use appropriate contractual or legal mechanisms.

11. Changes to this Policy

We may update this Privacy Policy as ChildLink, our vendors or applicable requirements change. We will post the updated version on this page and revise the “Last updated” date. We will provide additional notice of material changes where required.

12. Contact us

Privacy questions and requests: privacy@mychildlink.com
Legal correspondence: legal@mychildlink.com

yHere, Inc.
141 West 4th Street
Chuluota, Florida 32766
United States