Privacy policy

1. Information We Collect

We collect information to provide, improve, bill for, and secure the Service.

• Account and Profile Information: We collect names, email addresses, phone numbers, and physical addresses when Centers register, Parents are enrolled by a Center, or adults create and use a hearth household.
• Child and Family Data: Centers and Parents upload information needed for childcare operations, including child names, enrollment dates, attendance, schedules, and daily activity logs.
• hearth Household Records: Adults may enter household membership and contact information, learner names and birth years, lessons, subjects, attendance and instructional hours, photos, PDFs, notes, links, education expenses and receipt images, budgets, meals, groceries, and calendar information. Uploaded evidence may contain personal information chosen by the household.
• Biometric Authentication Metadata (Passkeys): If you choose to enable Biometric Check-in, our system utilizes the WebAuthn standard. The Service never sees, accesses, or stores your actual biometric data (such as Face ID or fingerprint scans). Your device processes biometrics locally and only transmits a secure cryptographic public key and signature to our database to verify your identity.
• Payment and Transaction Information: Payment processing is securely handled by Stripe. Depending on your role, we collect transaction history, tuition invoice data, and the information necessary to facilitate bank transfers (ACH) or credit card processing. For Centers, this includes Stripe Connect account identifiers.
• Mobile Phone Number and SMS Consent: When you opt in, we collect your mobile phone number and text-messaging consent so we can send the account, billing, customer-care, and login-verification (2FA) messages described in Section 4. We do not share this information with third parties for their own marketing purposes.

2. Information Related to Children

The privacy of children is of paramount importance.

The Service is directed to adult childcare professionals, parents, guardians, and invited adult household members. We do not knowingly collect personal information directly from children under the age of 13. Child and learner information is entered by authorized adults.

We use row-level database controls to separate Center and household records and limit access to authorized accounts associated with that Center, family, or household.

3. How We Use Your Information

We use the collected data for the following operational purposes:

• To facilitate child check-ins, attendance tracking, and staff scheduling.
• To process tuition payments, calculate transaction fees, and route funds securely via Stripe Connect.
• To generate operational logs, attendance records, and automation reports required for state childcare assistance and subsidy programs.
• To provide hearth household planning, family-maintained records, expense tracking, evidence storage, meal planning, and printable exports.
• To maintain, secure, and debug the infrastructure of the Service.

4. Sharing and Disclosure of Information

We do not sell your personal data. We only share information in the following circumstances:

• Between Parents and Centers: Attendance records, daily logs, and billing details are shared directly between the Center and the associated family accounts.
• Within a hearth Household: Household records are available to the owner and invited members according to their assigned role. Household owners control invitations and should invite only people they authorize to view the household.
• With Service Providers: We share data with vendors that provide cloud hosting and storage, databases, payment processing, email delivery, and SMS delivery, only as needed to operate the Service. These include Vercel and AWS for hosting and storage, Stripe for payments, and Twilio for SMS.
• Mobile Information and SMS Consent: We collect mobile phone numbers and text-messaging consent in order to send account, billing, customer-care, and login-verification (2FA) messages that you have requested or consented to receive. No mobile information or SMS opt-in consent will be shared with third parties or affiliates for their marketing or promotional purposes. Mobile phone numbers are shared only with our SMS delivery provider (Twilio) for the sole purpose of transmitting the messages you have consented to receive, and are not used for any other purpose. You may opt out of text messages at any time by replying STOP.
• Compliance and Legal Obligations: We may disclose information if required to do so by law, or to comply with state childcare assistance audit and verification procedures.

5. Data Security

We implement strong, modern security measures to safeguard sensitive childcare and financial data. This includes encryption of data in transit and at rest, alongside strict row-level database access controls. However, no internet transmission is entirely secure, and we cannot guarantee absolute security.

6. Data Retention and Your Choices

We retain personal information for as long as an account is active and as needed to provide the Service. When a Parent requests deletion for a family at a Center, we revoke access to that family immediately and invalidate sessions whose active family is the one being deleted. Other Center memberships under the same sign-in are not deleted. The request then enters a short grace period (approximately 30 days). After that period, eligible data may be deleted when account purging is enabled. Deletion requests for child records are coordinated through the child's Center, which acts as the controller of that data.

Some records are retained longer where a Center is legally required to keep them, for example, attendance and subsidy records needed for state childcare-assistance audits, and financial records needed for tax and accounting purposes. Security and access audit logs are retained for approximately one year and then moved to tamper-evident cold archival storage.

hearth retention: We retain hearth household records and uploaded evidence while the account is active and as needed to provide and secure the Service. Removing evidence from an active portfolio stops displaying it there, but encrypted object versions, backups, security logs, financial records, or legally required records may remain for recovery, fraud prevention, accounting, dispute resolution, or legal obligations. Contact us to request access, correction, or deletion. A deletion request does not override records we must retain or data that has already been de-identified.

Access and portability: Parents can download the data the Center holds about their family and children at any time from the family settings screen ("Download my data"). If you would like to access, correct, or delete information and cannot do so in the app, contact your Center or us at the address below.

Account deletion: See our account deletion page to submit a request in the hayway family app or contact us if you cannot sign in.

7. Contact Information

If you have any questions regarding this Privacy Policy, please contact us at:

MU Works LLC

jalil@haywayapp.com