Privacy Policy

The Kidy platform is operated by 2Lines Sistem SRL, a company registered in Romania, tax ID RO16807695, trade register number J2004001481239, with its registered office at Str. Fizicienilor nr. 19/1, 077125 Măgurele, Ilfov County, Romania.

For any question regarding this policy or to exercise your rights, you can contact us at contact@kidy.pro.

For children's data and for data generated within the activity of an educational institution, that institution is the data controller and 2Lines Sistem SRL acts as a data processor. See section 4.

We collect the following categories of personal data:

a) Data provided directly by users

• Account data: first name, last name, email address, phone number, role within the institution (administrator, educator, parent)
• Institution data: institution name, address, billing information
• Payment data: payment information is processed by authorized payment processors (PayU, Stripe) and is not stored on our servers
• Communications: messages sent through the integrated messaging platform
• Bank statements: account statements uploaded by the institution to reconcile incoming payments (account holder, IBANs, payer names, amounts and transaction descriptions)
• Contracts with the institution: enrollment contracts and addenda signed by parents or guardians, kept by the institution on the platform as a PDF file, exactly as signed (including electronically). They may contain the signing parent's or guardian's name, personal identification number (CNP), identity card series and number, home address, contact details, the data of the children covered by the contract and the contract terms.

b) Children's data

• First and last name
• Date of birth
• Personal identification number (CNP) – only if the institution enters it (for example for contracts or tax documents)
• Attendance and absence records
• Enrollment data and class/group assignments
• Relevant medical information (allergies, special conditions) – only if provided by parents or the institution

c) Automatically collected data

• IP address
• Browser and device type
• Pages visited and session duration
• Cookie data (see our Cookie Policy)
• Push notification tokens (Firebase Cloud Messaging)

d) Data collected by the mobile app

• Staff clock-in (no location) – when a staff member taps the clock-in/clock-out button, the app sends only the identifier of the work location chosen from the institution's list and, optionally, a note they write; the time is recorded by the server. The app does not request location permission and does not collect geographic coordinates (GPS) — not from staff, parents or children.
• Camera – the app does not scan QR codes and does not use the camera in the background. The camera is used only if you choose "Take photo" for a profile photo: on Android, the app opens the phone's camera app through the operating system's standard mechanism and does not request camera permission; on iOS, the system asks for your consent the first time. Kidy only receives the photo you confirm and crop (see section e) below).
• Biometric authentication – if you enable fingerprint or face unlock, the verification is performed entirely by the device's operating system. Kidy only receives the result (success/failure). Biometric data never leaves the device and is not accessible to us.
• Push notification token – a device identifier generated by Firebase Cloud Messaging, used solely to deliver notifications. It is deleted when you sign out of the app, deactivated automatically when Firebase reports it as invalid (for example after the app is uninstalled), and deleted together with the account.
• Android app permissions – the app declares only: internet and network-state access; showing notifications and receiving them through Firebase Cloud Messaging, keeping the device awake and vibrating on delivery; biometric authentication (fingerprint or face). On Android 12 and older, the legacy storage-read permission (READ_EXTERNAL_STORAGE) also appears, added by the library used to open documents; the app does not request it, because downloaded documents (for example payslips) are kept in the app's private storage. The app does not request access to location, camera, microphone, contacts or the photo gallery.

e) Profile photos (optional)

• What we collect: users may optionally upload a profile photo for their own account and for the children in their care. Uploading a photo is never required.
• How photos are selected: choose "Choose from gallery" or "Take photo". The gallery opens through the operating system's photo picker, and a new photo is taken with the phone's camera app. The app does not request or receive access to the device's photo gallery; it only receives the photo you choose or take.
• How we process them: on upload, EXIF metadata (including GPS coordinates) is stripped server-side, and the image is resized and converted to WebP format.
• How we store them: storage is private; images are served exclusively through expiring signed URLs, visible only to authorized users within the same organization (institution).
• What we do NOT do: photos are not shared with third parties, are not used for advertising, and are not used to train artificial-intelligence models.
• Control: the photo can be replaced or deleted at any time, directly from the app.
• Purpose: app functionality only — visual identification of users and children in the interface.

We use your data for the following purposes:

• Service delivery: managing accounts, authentication, administering institutions and student/child data
• Communication: sending push notifications, transactional emails, and in-platform messages
• Billing: processing payments and issuing invoices
• Platform improvement: statistical analysis and technical issue diagnostics
• Legal compliance: fulfilling applicable legal obligations
• Security: fraud prevention and platform protection

We process your data based on the following legal grounds:

• Performance of a contract (Art. 6(1)(b)): processing is necessary for providing the Kidy service under contractual terms
• Consent (Art. 6(1)(a)): for analytics and marketing cookies, push notifications, and marketing communications
• Legitimate interest (Art. 6(1)(f)): for platform improvement, fraud prevention, and IT security
• Legal obligation (Art. 6(1)(c)): for compliance with tax and reporting requirements

Kidy processes children's data exclusively as a data processor, under the instructions of educational institutions (data controllers). Institutions are responsible for obtaining the necessary consent from parents/legal guardians.

We do not collect data directly from children. All children's data is entered by authorized institution staff or by parents through the application.

Children's data is used exclusively for educational and administrative purposes: attendance, group management, parent communication, and reporting.

Family contracts. Enrollment contracts and addenda are uploaded by the institution or retrieved, at its request, from the institution's account with its electronic signature provider; the institution is the controller for them as well, and Kidy acts as processor. Only the institution's administrators and the active guardians of the family concerned can view and download them; every download is logged (who, when, from which IP address). The file is not altered and is not shared with third parties. A voided contract is no longer shown to parents but stays in the institution's archive.

We do not sell your personal data. We share data only with the following categories of providers:

• Amazon Web Services (AWS): infrastructure hosting – EU region (Frankfurt, Germany). Data processing agreement in place.
• Payment processors (PayU, Stripe): bank card payment processing. Payment processors act as independent controllers for payment data. PayU Privacy Statement, Stripe Privacy Policy.
• Firebase (Google): push notification delivery. Google processes only device tokens and notification content.
• Google Analytics / Google Tag Manager: traffic analysis exclusively on the public website kidy.pro (anonymized/pseudonymized data). The Kidy mobile app does not use Google Analytics and contains no analytics or advertising tools whatsoever.
• Email providers: transactional email delivery.
• Anthropic (Claude): automatic reading of bank statements the platform does not recognize, only for institutions that turn this option on in their settings. The statement's text is sent (for example the account holder, IBANs, payer names and amounts), not the file. Anthropic acts as a processor (sub-processor), does not use this data to train its models, and the processing takes place in the United States under Standard Contractual Clauses. Anthropic privacy policy.

All our providers are GDPR-compliant and have signed Data Processing Agreements (DPAs).

Your data is stored on AWS servers located within the European Union (Frankfurt, Germany). In cases where a service provider transfers data outside the EU/EEA, we ensure adequate safeguards are in place (Standard Contractual Clauses, adequacy decisions, or other approved mechanisms). AI reading of bank statements (Anthropic, only at institutions that turn it on) involves transferring the statement's text to the United States under Standard Contractual Clauses.

We retain your data according to the following rules:

• Account data: for the duration of the active account + 30 days after deletion
• Children's data: for the duration of enrollment + according to the institution's retention policy
• Billing data: 10 years as required by Romanian tax legislation
• Family contracts: according to the institution's retention policy for contractual documents; deleted, with every version of the file, together with the institution's data
• Security logs: 12 months
• Cookie data: according to the durations specified in the Cookie Policy

Upon termination of an institution's subscription, data is retained for a 30-day grace period, after which it is permanently deleted.

Under the GDPR, you have the following rights:

• Right of access (Art. 15): you can request a copy of your personal data
• Right to rectification (Art. 16): you can correct inaccurate data
• Right to erasure (Art. 17): you can request the deletion of your data ("right to be forgotten")
• Right to restriction of processing (Art. 18): you can limit data processing
• Right to data portability (Art. 20): you can receive your data in a structured, commonly used, and machine-readable format
• Right to object (Art. 21): you can object to processing in certain circumstances
• Right to withdraw consent: at any time, without affecting the lawfulness of prior processing

To exercise your rights, contact us at contact@kidy.pro. We will respond within 30 days.

You have the right to lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) – www.dataprotection.ro.

For detailed instructions on deleting your account and associated data — including what is deleted, what we are required to retain, and how long processing takes — see the Account and Data Deletion page.

We use cookies and similar technologies for platform functionality, analytics, and marketing. For full details, please refer to our Cookie Policy.

We implement appropriate technical and organizational measures to protect your data, including:

• Encryption in transit (TLS/SSL) and at rest (AES-256)
• Secure authentication with JWT tokens
• Multi-tenant database isolation
• Regular encrypted backups
• Continuous monitoring and access logging
• Role-based access control (RBAC)
• Sensitive documents (family contracts, medical certificates) are kept in separate private storage, encrypted with dedicated keys, with no public link; they are reachable only through the platform after a permission check, and access is logged

For any questions regarding this policy or your personal data:

• Email: contact@kidy.pro
• Platform: kidy.pro

We reserve the right to update this Privacy Policy. Significant changes will be communicated via email or in-platform notification. The date of the last update is indicated at the beginning of this document.

Continued use of the platform after changes are published constitutes acceptance of the new version of the policy.