Privacy policy
Last updated:
Draft for legal review. This text is not binding until it is approved and published.
This policy explains what information is collected on bagan.co.il, in the BaGan dashboard and in the app, why it is collected and how it is protected. Items in square brackets are still to be completed.
Who we are
BaGan is operated by [operating company name, company number and address] ("we"). For any privacy question, contact us at [privacy contact email].
The gan and us: who is responsible for what
The gan that uses BaGan owns the information about its children, families and staff. We process that information on the gan's behalf and according to its instructions, to provide the service. Requests about a child's or a family's information go to the gan first, and the gan contacts us when needed.
[For legal review: a data processing agreement between BaGan and each gan, and the roles under the Israeli Privacy Protection Law and Amendment 13.]
What information is collected
On the website. When you fill in the demo request form: name, gan name, city, phone, email if given, and a message if written. The website uses no tracking cookies, no advertising pixels and no third-party analytics.
In the service. User details (name and phone number, used to sign in with a one-time code), details of children and families entered by the gan or completed by parents, including medical information such as allergies if entered, attendance, the daily care log, messages, posts, photos and videos.
Technical data. IP address, device type and error logs, for security, abuse prevention and operations.
Why the information is used
- To provide the service to the gan and to parents.
- To secure the service and prevent abuse.
- To give support when the gan contacts us.
- To get back to people who leave their details in the demo form.
We do not sell information, do not use it for advertising and do not show ads in the service.
Photos and videos
- Kept in private storage, and opened only through signed links that expire after a few days.
- Location, device and camera details are removed from the files shown in the service.
- Parents see only photos tagged with their own children, or albums the gan has set as shared with the class.
Face suggestions
- A feature the gan owner can switch on and off at any time.
- It relies on consent given in the gan's and the parents' joining agreements. [For legal review: the consent wording and the explanation to parents.]
- Matching runs on our own servers only. No photo or face data is sent to an external recognition service.
- Face data is a sequence of numbers, not an image. It is encrypted with a separate key for each gan, used only for matching within the same gan, and never exported.
- A parent can ask to stop face suggestions for their child, and the child's face data is then deleted. It is also deleted when a child leaves the gan or when the gan switches the feature off.
Where the information is kept
- The service runs on servers we operate. [To confirm: the hosting provider and server location in production.]
- Photos and videos are kept with a cloud storage provider in Europe (Wasabi, Frankfurt region) and served through Cloudflare.
- Other providers that help us run the service: SMS delivery for sign-in codes, Expo's notification service for the app, and email delivery. [To confirm: the full list of sub-processors.]
Security
All connections are encrypted. Each gan's information is separated from other gans at the database level. Sign-in uses a one-time code sent to the phone. Only authorized members of our team can access information, for support, and every such access is logged. [To confirm: the support access procedure and the security incident procedure.]
How long information is kept
[For legal review: retention periods for each kind of information, including records a gan must keep under the daycare supervision regulations.] When a gan stops using the service, it receives a full export of its information, which we delete after [number] days.
Your rights
Under the Privacy Protection Law you may access your information, ask to correct it and ask to delete it. Requests about a child or a family go to the gan. Any other request: [email address].
Children
The service is meant for gans and adults: owners, staff and parents. Children do not use the service themselves.
Changes to this policy
When we update this policy, we update the date at the top of the page. We notify gans in advance of any material change.
Contact
[Full contact details, and the data protection officer's details if one is required.]