Privacy Policy

1. Who we are

RoundUp Early Childhood ("RoundUp," "we," "us") is operated by Swift Start LLC, an Oregon-based company providing software for child-care centers. This policy covers our website (roundupece.com) and the RoundUp mobile and web applications.

2. What we collect

Center accounts (directors, staff)

• Name, email, phone, role, employment dates
• Authentication credentials (hashed)
• Background check status (yes/no flag — we do not store the underlying record)

Family accounts (parents, guardians)

• Name, email, phone, address
• Authorized pickup contacts
• Payment method (tokenized via Stripe — we do not store card numbers)

Child records

• Name, date of birth, photo (optional, parent-controlled)
• Allergies, dietary needs, medical notes the family provides
• Daily activity (check-in/out times, naps, meals, photos shared by staff)

Operational data

• Attendance, ratios, billing transactions, audit logs
• App diagnostics (crash reports, performance metrics — no personal data linked)

3. How we use information

We use the data above only to:

• Operate the RoundUp service for the center that subscribes to us
• Process tuition and fee payments (via Stripe)
• Send required notifications (check-in/out confirmations, emergency alerts, billing receipts)
• Generate reports the center is legally required to submit (Oregon OCC, Spark QRIS, ERDC subsidy reporting)
• Improve our software (bug fixes, performance, new features)

We do not sell, rent, or trade personal data. We do not use child data or family data for advertising, profiling, or any third-party marketing.

4. Child data

We treat child records with the highest care:

• Photos of children are visible only to the family and authorized staff at the child's center
• Daily reports are visible only to the family of that child and the staff caring for that child
• We do not use any child information to train AI models, generate analytics for third parties, or send marketing communications
• Children under 13 do not interact with RoundUp directly. Parents and authorized caregivers act on their behalf
• FERPA is generally not applicable to private child-care centers, but we follow FERPA-aligned practices on access and parental consent

5. Sharing & processors

We share data only with vendors who help us operate the service:

• Stripe — payment processing
• AWS (us-west-2) — hosting and storage
• Microsoft 365 — email and document services
• Sentry — error monitoring (no PII is sent to Sentry)

All processors are bound by data processing agreements and are not permitted to use the data for any other purpose.

We may share information when legally required (subpoena, court order, mandated reporting). We will notify the affected center where legally permitted.

6. Security

• All data is encrypted in transit (TLS 1.2+) and at rest (AES-256)
• Authentication is enforced with strong-password requirements; SSO available on Multi-Site plans
• Access to production systems is logged and limited to a small set of authorized engineers
• We perform regular vulnerability scanning and patch promptly

7. Retention & deletion

We retain data while a center is an active customer. Upon cancellation:

• Centers can export all their data within 90 days
• Active records are deleted from production within 90 days of cancellation
• Backups are retained for an additional 90 days, then permanently deleted
• Some operational records (billing, audit logs) may be retained longer where law requires (typically 7 years for tax records)

8. Your rights

Depending on your jurisdiction, you may have rights to access, correct, delete, or export the personal data we hold about you. To exercise any right, contact us using the details below. We will respond within 30 days.

If you are an Oregon resident: you can request a copy of the personal data we hold and ask that it be corrected or deleted at any time.

9. Changes

If we make material changes, we will notify center directors by email at least 30 days before the change takes effect. The "Last updated" date at the top of this page always reflects the current version.

10. Contact

Questions, concerns, or rights requests: privacy@roundupece.com or write to:

RoundUp Early Childhood
c/o Swift Start LLC
[Mailing address pending]
Oregon, United States