Privacy Policy

KinderHive is made by Purple Hive Group Limited (“Purple Hive”, “we”, “us”), a UK technology company.

We hold personal information in two different roles under the UK GDPR and the Data Protection Act 2018:

• On behalf of nurseries (processor). Each nursery that uses KinderHive decides what it records about children, families and staff, and why. The nursery is the data controller for those records, and we process them only on its instructions. Records are kept separately for each nursery.
• For ourselves (controller). We are responsible for the information needed to run the service itself: user accounts and sign-in, nursery registration and account administration, security logs, support emails, and visits to this website.

If you have a question about what a nursery records about you or your child, please contact that nursery first. We will help them respond.

Depending on how a nursery uses KinderHive, its records may include:

• Children: name, date of birth, photo, room, attendance and collection times, daily care records (meals, sleep, nappy changes, activities), learning observations against the EYFS, photos taken at nursery, and documents the nursery stores.
• Health and safeguarding information: allergies, dietary and medical needs, accident and incident reports (including body-map notes and photos), and records that families have acknowledged an incident. This is special category data, so access to it is restricted to nursery staff.
• Parents, carers and authorised collectors: names, contact details, relationship to the child, the people allowed to collect a child, messages with the nursery, invoices and payment records.
• Staff: name, contact details, role and room, shifts, clock-in and clock-out times, leave requests, and compliance documents such as DBS checks and qualifications.
• Nursery devices: the classroom tablets and front-desk kiosks a nursery pairs to its account.

The nursery decides the lawful basis for these records, for example its legal duties under the Early Years Foundation Stage and safeguarding law, its contract with families, or consent for things like sharing photos.

• Account details: your name, email address, phone number (if you give it) and password. Passwords are handled by our authentication provider and stored only in hashed form.
• Google or Apple sign-in: if you choose it, we receive your name, email address and profile picture from Google or Apple. We don’t receive your Google or Apple password.
• Nursery registration: organisation details, the manager’s contact details, insurance and policy information, and data protection contacts supplied when a nursery applies to use KinderHive.
• Passkeys and two-step sign-in: if you set up a passkey, fingerprint or face sign-in, your device checks it and only a public key is shared with us. We never receive your fingerprint, face or device PIN.
• Location when clocking in by phone: if your nursery uses phone clock-in, the app checks your device’s position once, at the moment you clock in or out, to confirm you are at the nursery. We record whether you were on site and how far away, not where you are at other times. You can refuse location access and clock in on the nursery’s tablet instead.
• Push notifications: if you allow notifications, we keep your device’s notification address so we can send them. You can switch them off in the app or your device settings at any time.
• Subscription billing (nursery managers): the nursery’s billing contact, plan and payment status. Card and bank details are entered on Stripe’s pages; we never see or store them in full.
• Technical and security information: IP address, browser and device type, and records of important actions (such as sign-ins, approvals and changes to records) kept in audit logs.
• Messages to us: anything you send when you contact us for support.

• To provide KinderHive: creating accounts, signing you in, showing each person the records they are allowed to see, sending invitations and notifications, and keeping data in sync across devices. Lawful basis: performance of a contract, or our legitimate interest in providing the service a nursery has asked for.
• To keep the service secure: preventing misuse, investigating problems and keeping audit trails. Lawful basis: legitimate interests, and legal obligations where they apply.
• To support nurseries and users: answering questions and fixing issues. Lawful basis: legitimate interests.
• To meet legal obligations, for example responding to lawful requests from authorities.

We do not sell personal information, use it for advertising, or use children’s information for any purpose other than providing the service to their nursery.

• Access is limited by role and by nursery. People at one nursery cannot see another nursery’s records.
• Managers see their own nursery’s records. Staff see what they need for their work, including on the classroom tablet for their room.
• Parents and carers see only their own children. A photo is shared with a family only when their child is tagged in it and the nursery has chosen to share it. Incident photos are visible to nursery staff only.
• A small number of Purple Hive staff can access the service to approve nurseries, run and support it, and keep it secure. Our platform tools show aggregate counts rather than individual children’s records.

We use trusted providers to run KinderHive. They act on our instructions and must protect the information:

• Supabase: database and user sign-in.
• Cloudflare: private storage for photos and documents, and the services that send files to authorised users.
• Resend: delivering emails such as invitations and announcements.
• Vercel: hosting this website and app.
• Google and Apple: only if you choose to sign in with them.
• Stripe: payments for nurseries’ subscriptions to KinderHive. Card and bank details are entered on Stripe’s own pages; we never see or store them in full.
• Paying nursery fees online: if your nursery takes fees by card or Direct Debit, it connects its own Stripe account. Your name, email and the amount of each invoice are shared with the nursery’s Stripe account so it can collect them; your card or bank details go only to Stripe. Stripe also uses your information for its own legal duties, such as preventing fraud, under its privacy notice.
• Payment providers: if your nursery takes payments through KinderHive, the provider it uses processes those payments under its own terms.
• Google Fonts and Unsplash: fonts and some website images are loaded from them, which shares your IP address with them.

Some providers may process information outside the UK. Where they do, we rely on UK adequacy regulations or approved safeguards such as the UK International Data Transfer Agreement or Addendum.

• All connections to KinderHive are encrypted (HTTPS).
• Database rules check every request so that each user can only reach their own nursery’s records, and only the parts their role allows.
• Photos, videos and documents are kept in private storage and opened through links that expire after 15 minutes.
• Location data (such as GPS) is removed from photos before they are uploaded.
• Classroom tablets and kiosks are paired with one-time codes. Staff PINs are stored only in hashed form and lock after repeated wrong attempts.
• Important actions are recorded in audit logs.

Nursery records are kept for as long as the nursery needs them and the law requires. Nurseries must keep some records, such as safeguarding, accident and attendance records, for many years, so when a child leaves their record is archived rather than deleted. The nursery decides how long its records are kept.

If a nursery stops using KinderHive, we return or delete its records as agreed with the nursery, unless the law requires us to keep something. We keep account information while your account is active, and security logs for as long as needed to keep the service safe.

You have the right to ask for a copy of your personal information, and to ask for it to be corrected, deleted, restricted or transferred, or to object to how it is used. Where we rely on consent, you can withdraw it at any time. Some rights have limits; for example, a nursery may need to keep certain records by law.

For records a nursery keeps, contact the nursery, which will normally reply within one month. For information we hold as controller, email info@kinderhive.app.

If you are unhappy with how your information is handled, you can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113. We would appreciate the chance to help first.

KinderHive is used by nursery staff, parents and carers. It is not designed for children to use. Children’s information is added by their nursery and their parents or carers.

We do not use advertising or analytics cookies, and we don’t track you across other websites.

KinderHive stores a small amount of information in your browser so it works properly: keeping you signed in, remembering a paired classroom tablet or kiosk, your settings, and a copy of the app so it can open quickly and work when the connection drops. These are essential to the service, so they don’t need your consent. Signing out clears your sign-in.

We will update this policy when our service or the law changes. The date at the top shows the latest version. If a change is significant, we will tell nurseries and users in the app or by email.