Privacy policy

1. Who we are

Dayboo is provided by Dinein group, LLC. Email [email protected] or call +995 599 89 06 74. This policy is for parents, other authorized adults, kindergarten staff, owners and website visitors.

2. Who is responsible

The kindergarten decides why it enters data about children, families and staff and who has access. For this data, the kindergarten is the controller and Dinein group, LLC is its processor, acting on its behalf.

For Dayboo account, legal-acceptance and subscription data, website visitor data, and the sign-in and security data needed to protect the service, Dinein group, LLC is the controller. Our processing agreement with the kindergarten is the DPA.

Data processing agreement

3. Data we process

Data comes from the kindergarten and app users. Some records arise from use of the service. Not every field below is filled in for every person.

• Legal acceptance evidence: exact bilingual document text and fingerprint, app and version, accepting person and kindergarten when applicable, time, language, explicit acceptance method, personal/shared PIN session and device identifiers, request IP, and client-reported platform/version/browser details.
• Children: name, birth date, sex if recorded, photo, address, personal ID number and its lookup hash; enrollment, group, schedule, departure information and staff notes.
• The child’s day: attendance, drop-off and pickup, absence reasons and notices; meals, naps, activities, toilet records and notes; posts, photos and child tags.
• Health: allergies, severity, reactions and action plans, EpiPen information, dietary restrictions, blood type, conditions, medication information and doctor’s name/phone. Incident reports may include injury photos, body-map marks, first aid and records of informing parents.
• Parents and other adults: name, phone, address, personal ID number and lookup hash, pickup identification photo, relationship to the child, contact and pickup permissions, invitations and app-use records, consents, parent notes, hearts and read receipts.
• Accounts and staff: name, phone, email if recorded, language, notification choices, push token, role, position, branches, groups, employment dates, PIN hash and history of actions.
• Family billing: prices, discounts and reasons, extra classes, invoices, payments, allocations and family payment code. From the kindergarten’s connected TBC account: every incoming GEL transfer, including ones unrelated to fees — amount, date, payer name, account, bank, payment purpose and the rest of the bank’s record — and payer accounts learned from confirmed matches. The personal number supplied in the bank’s dedicated field is kept only as a hash; personal information typed into free text can remain in the payment purpose. Dayboo matches transfers to families automatically and, unless the kindergarten turns this off, records certain matches as payments.
• The kindergarten and its Dayboo subscription: organization name, legal/tax details, branch contacts, price, child count, payment dates/results and terms acceptance version, time and IP address. We retain a masked card number, brand, payment token, its expiry if supplied and saving details; we do not store the full card number or security code.
• Technical data: IP addresses for sign-in limits and action/acceptance records, sessions, code requests and attempts, device type and name, last activity, shared-tablet token hash, cookies, action times/authors, and server request and error logs.
• Uploaded documents: child and family-member files, including medical certificates, vaccination records, birth certificates, identity documents and contracts; file name, type, validity date if supplied, uploading staff member and file-read history. Files can contain additional personal or health information supplied by the kindergarten.
• Live cameras, where enabled: live video of children and staff relayed from the kindergarten’s recorder; recorder/camera settings and encrypted connection password, group/hours, live-camera consents and viewing logs with viewer identity, linked child, IP address, browser details and viewing times. Dayboo’s relay does not make permanent video recordings; the kindergarten’s own recorder may record separately.
• Subscription payment evidence: cardholder name, billing address and phone; explicit recurring authorization, the displayed price/count/trial/date/debt and policy versions, owner and kindergarten identity, time, language and IP; cancellation receipt and access end date. Cardholder contact details are private, not published on the website.

4. Purposes and legal grounds

The kindergarten uses data to care for children, record their day, share updates with families and manage fees. It determines the applicable lawful basis, including the grounds and consents needed for health information and photos. Dayboo follows the kindergarten’s instructions for this processing.

We process owner account and subscription data to perform our contract; records required by law to meet legal obligations; and sign-in/security data for the legitimate interest of protecting the service and accounts, taking people’s rights into account. The language cookie saves your choice. Dayboo’s website and apps have no built-in advertising or behavioral analytics tools.

5. Who can see data

Staff access depends on role, branch and group. For example, a teacher sees only children in their assigned groups. Personal ID numbers are available to owners and appropriately scoped directors, and each reveal is logged. Opening full health profiles, incident details and injury photos is logged. Routine allergy summaries in lists and menus do not generate separate reveal logs.

Teachers also see the adults allowed to collect a child, with their pickup photos, and the phone numbers of primary and emergency contacts. Parents see the first name and role of staff who post, send announcements or mark their notes as seen; staff see which families have read an announcement.

Authorized Dinein group, LLC personnel can access stored records, including through an internal administration tool and the server, to run the service, provide support and fix problems. These views are not logged in the kindergarten’s history.

A parent or other adult sees a child’s records only when the kindergarten has granted them updates for that child. Shared group posts and announcements may appear in that child’s feed. A family invoice may include amounts for another child without that child’s identifying details.

Only a linked mother or father can give photo-sharing consent. A tagged child’s own consent never blocks their family’s view: a photo of one child reaches that child’s family. Other tagged children need counted consent, except a child whose parents are all also parents of the receiving child. Other families in a post’s groups receive a photo if all tagged children had counted consent when it was shared; a photo marked “no children” reaches all those families. Current consent for other children is checked again when photos are viewed. A separate internal-photography consent record does not currently prevent uploads.

Kindergartens and staff must keep other children’s personal information out of shared text: names in free text are not automatically hidden.

Uploaded child and family-member documents are available to owners and appropriately scoped directors; each file read is logged. Parents can watch an enabled group camera only while their child is checked in and the current camera rules permit it, including counted live-camera consents for every child present. Authorized owners/directors can preview the cameras in their scope. The kindergarten is responsible for informing staff and families about its cameras and any separate recordings.

When someone reports a post, announcement or note, the kindergarten’s owners and directors see the report, the reporter’s name and the item. Dinein group, LLC sees it too; when we open reported content or photos in our administration tool, each view is recorded in the kindergarten’s history.

6. Service providers

These providers participate in the relevant functions. Banks and payment providers may also act under their own legal obligations.

• Hetzner — servers that store and process Dayboo data.
• Cloudflare — network delivery, HTTPS and security; it can see traffic, including IP addresses and request contents.
• UBill — SMS delivery; receives the phone number and message text.
• Expo, Apple and Google — push delivery; receive device addresses, notification text and identifiers used to open the relevant record in the app.
• Flitt — card payments for the kindergarten’s Dayboo subscription; receives card details on its own page, the payment amount, order identifier and token for later payments. The full card number does not reach Dayboo’s code.
• TBC Bank — only when a kindergarten connects its own account: a read-only connection. Dayboo reads the account balance and all movements for the period, including outgoing ones, and keeps only incoming transfers; the bank receives credentials and requests identifying the account and time period.
• Brevo — when email delivery is configured, sends Dayboo subscription receipts and notices; receives the billing email, kindergarten name and subscription/payment facts in the message. These emails do not include children’s personal or health records or photos.

7. Storage and international transfers

Dayboo’s primary data is stored on servers in the European Union. This is a transfer outside Georgia. Network, SMS, push and payment providers may also process data in other countries. We do not claim that all data stays only in the EU. Contact [email protected] for information about transfers.

8. Protection

External connections to the service use HTTPS. Personal ID numbers, bank connection secrets and saved-card tokens are encrypted at field level using Fernet. PINs are hashed. Roles and child relationships restrict access; record changes have an audit history. We do not claim that all data is encrypted on disk.

Push notifications never include photos, incident descriptions, injuries, first aid, health-profile details or parent-note text. They can show a child’s first name and initial, the adult who brought or collected the child and the time, a group name, that an incident report exists (for owners and directors also its severity), and an announcement’s title. Announcement titles must therefore not contain health or other sensitive details.

Apps also keep sign-in information on the device. The staff app keeps local data and queued records/photos for offline work. The parent app keeps viewed photos in the phone’s cache (injury photos only in memory); a photo a parent saves goes to the phone’s photo library. Protect devices with a screen lock and lock the session when finishing work on a shared device.

9. Cookies

The website uses dayboo-locale to remember language (up to one year when set by the language switch). The admin web also uses necessary sign-in cookies: db_session, db_access_<session>, db_refresh_<session> and db_org_<session>. Older sessions may use db_access, db_refresh and db_org. Token and organization-choice cookies last 60 days; refreshing restarts that period. db_session lasts 400 days from sign-in and grants no access by itself. Session expiry does not mean server records are erased.

Dayboo sets no advertising or analytics cookies. Cloudflare and separately opened provider pages may use their own technical cookies.

10. Retention and account deletion

There is currently no general automatic erasure schedule. Many in-app deletions mark records as deleted while retaining history, and stored photo/document files can remain until final deletion is handled separately. Audit history, consent receipts, camera-view logs and subscription charge records are retained; we do not promise an automatic final-erasure deadline. This technical behavior does not authorize indefinite retention. When the kindergarten’s service ends, the DPA requires termination of processing, full data return and deletion of copies, except legally required retention. Requests are handled through [email protected]. The audit history keeps earlier and new values of changed fields (personal ID numbers, card tokens and bank secrets only as “changed”), so an ordinary correction does not remove the earlier value from history.

To delete your account, open Account → Delete my account in the parent app, or More → Delete my account in the staff app (signed in with your own phone number, not on a shared tablet). This signs you out on every device, switches off notifications to your phones and erases the phone number and email on the account; a parent’s account also loses its name. A staff member’s role at the kindergarten ends that day, and the records they made keep their name. The account’s audit row notes that these details changed, not the erased values; earlier audit entries keep what they recorded (see above). The kindergarten keeps its own records of children, families, staff, health, photos, payments, consents and history; ask the kindergarten to change or remove them. Signing in again with the same number makes a new account, and the kindergarten’s records can give it access again.

A kindergarten owner’s account is not deleted in the app: contact us to close the kindergarten or hand it over. If you can’t use the app, email [email protected] or call +995 599 89 06 74; we check that the number is yours and delete the account the same way.

Delete your account

DPA — return and deletion

11. Your rights

Georgia’s 2023 Law on Personal Data Protection, as amended, provides rights to information, access and a copy, correction, stopping processing or erasure, and blocking; where applicable, portability and withdrawal of consent. These rights have legal conditions and exceptions.

For child, family or staff records, contact the kindergarten first, as controller. You can also email [email protected]; we will help route the request to the responsible party. There is no complete self-service export: request a copy or export by email.

You may complain to the supervisory authority or seek a court remedy. Since 2 March 2026 the State Audit Office is the successor to the Personal Data Protection Service of Georgia.

State Audit Office — personal data protection portal

12. Children and changes

Dayboo accounts are for adults. Children are the subjects of records, not app users.

When this policy changes, a new version and effective date will be published here. Use the contact details above for questions.