Privacy Policy

1. Scope and our role

This Privacy Policy describes how KhayrOS (“KhayrOS,” “we,” “us,” or “our”) collects and uses information when you use our websites, applications, and software services (the “Service”). It forms part of, and is subject to, our Terms of Service.

Your center is the controller of the records it enters.With respect to information about children, families, and staff that a center enters into the Service (“Customer Data”), the center decides what to collect and why, and KhayrOS acts only as a service provider and data processor that processes Customer Data on the center's behalf and under its instructions. The center is responsible for obtaining all required consents and for providing any privacy notices required by law. KhayrOS is a controller only for the limited account and operational data described below.

2. Information we collect

We collect:

• Account information you provide, such as name, email, center name, role, and login credentials.
• Customer Data that a center enters, which may include information about children, families, and staff, and, where the center chooses, sensitive information such as health, medical, allergy, or emergency-contact details.
• Billing information processed by our payment processor; we do not store full payment card numbers.
• Usage and device data, such as log data, IP address, browser type, pages viewed, and actions taken, collected automatically to operate and secure the Service.
• Support communications you send to us.

You control what Customer Data is entered. Please do not enter sensitive information beyond what your center needs for its legitimate operations.

3. Children's information

The Service is intended for use by childcare centers and their authorized adults, not by children. KhayrOS does not knowingly collect information directly from children and does not direct the Service to children. Any information about a child is provided by the center as Customer Data. The center is responsiblefor obtaining any parental or guardian consent and for meeting any legal requirements that apply to collecting and handling children's information. KhayrOS processes such information only to provide the Service to the center.

4. How we use information

We use information to:

• provide, maintain, secure, and support the Service;
• authenticate users and enforce access controls;
• process billing and subscriptions;
• detect, prevent, and respond to fraud, abuse, and security incidents;
• communicate with you about the Service; and
• comply with legal obligations and enforce our Terms.

We process Customer Data only to provide the Service and as instructed by the center, except where the law requires otherwise. We may create aggregated and de-identified data that does not identify you or any individual and use it to operate and improve the Service.

5. We do not sell data, run ads, or train on your records

We do not sell or rent personal information, we do not use it for advertising, and we do not use Customer Data to train machine-learning or AI models. We share information only as described in this policy.

6. Access, separation, and sharing

Every record belongs to the center that entered it. Other centers can never see it. Parent and family accounts are limited to their linked children and the records the center chooses to share. Access is enforced at the database level, and KhayrOS personnel reach center data only through limited, logged support actions.

We share information only with:

• Service providers (subprocessors) that host, process payments, or provide communications and infrastructure, under contracts that limit their use of the data to providing services to us;
• Authorities or others when required by law, legal process, or to protect the rights, safety, and security of users, the public, or KhayrOS; and
• A successor in connection with a merger, acquisition, financing, or sale of assets, subject to this policy.

We do not otherwise disclose Customer Data without the center's instruction.

7. Security

We use reasonable technical and organizational measures designed to protect information, including encryption in transit and at rest, access controls enforced at the database level, auditing of sensitive actions, and private file storage with expiring links. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for safeguarding your credentials and for configuring access within your center appropriately. You use the Service at your own risk, and KhayrOS is not liable for unauthorized access or loss beyond the limits set out in our Terms of Service.

8. Data retention

We retain information for as long as needed to provide the Service, comply with legal obligations, resolve disputes, and enforce our agreements. Centers control their own records and may export or delete Customer Data using the tools we provide. After an account is terminated, we may delete or de-identify Customer Data in the ordinary course after a reasonable period, subject to legal retention requirements and backups.

9. Your choices and rights

Depending on your location, you or the relevant individual may have rights to access, correct, delete, or restrict certain personal information, or to receive a copy of it. Because centers control Customer Data, requests from families or staff about a child's or employee's records should be directed to the center, which we will support as the center's processor. For account information that KhayrOS controls, or to ask a question, contact us at privacy@khayros.com. We will respond consistent with applicable law.

10. Cookies and analytics

We use cookies and similar technologies that are necessary to operate the Service, keep you signed in, remember preferences, and understand how the Service is used so we can maintain and improve it. You can control cookies through your browser settings; disabling some cookies may affect how the Service works.

11. International data and processing

The Service is operated in and processed on infrastructure that may be located in the United States. If you access the Service from outside the United States, you understand that your information may be transferred to, stored, and processed in the United States and other countries where our providers operate, which may have different data-protection laws than your jurisdiction.

12. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last updated” date and, where appropriate, provide additional notice. Your continued use of the Service after changes take effect constitutes acceptance of the updated policy.

Questions about privacy? Write to privacy@khayros.com.