Data processing schedules
Last updated: November 2, 2026
Section 14 of the terms of use is KeepCount Inc.'s data processing addendum with each organization that uses KeepCount. These four schedules form part of it.
Schedule 1. Service providers
KeepCount uses these providers. Each provider in use is bound by written terms that protect the information; a provider marked "from its release" is used only once that feature is released. The list here and in the privacy notice is always current.
| Provider | What it does | What it handles | Where |
|---|---|---|---|
| Supabase | Database, sign-in, file storage and server functions | Everything in KeepCount | Stored in Canada (Canada Central region): the database, the files and Supabase's backups. Supabase's service logs are stored in its data centres in the European Union, and they, its telemetry and its service metadata are processed outside Canada: each request's address (which can include email addresses being looked up, for example when staff are imported, and the names of uploaded files) and each sign-in with its email and IP address; never the contents of the records. Its support staff outside Canada may see these logs when helping with a problem. KeepCount's own billing and support correspondence with Supabase is handled outside Canada |
| Amazon Web Services | Makes and keeps KeepCount's encrypted backup copy of the database, and keeps the copy of uploaded files, used only to restore the service | Everything in KeepCount, as encrypted copies | Made and stored in Canada (Canada Central region) |
| Cloudflare | Delivers the website and the app; the Turnstile check on the public forms; may count visits to the public pages (Web Analytics) | Your browser's requests, including your IP address and browser details; on the public pages, the page's address, the page before it and its load times; no account records are stored there | Global network |
| Resend | Sends KeepCount's emails and reports whether each was delivered | Recipients' names and addresses, the organization's name and the content of each message, including the weekly summary's names and due items; never a child's name or health information | United States |
| Zūm Rails | Payments for family billing, when an organization turns them on (none has yet): pre-authorized debits from families and payouts to the organization | The family member's name and email address, which KeepCount sends; their bank account details, which they give to Zūm Rails directly in its own window (KeepCount keeps only the bank's name and the last four digits of the account); and the organization's payout details | Canada |
| Apple (Apple Push Notification service) | When the KeepCount app for phones is released (it is not available yet): delivers notifications to the KeepCount app on iPhones and iPads, where the person switched them on | The phone's token for the app, each notification's title and words (rooms, sites, homes and times, the organization's name, or that there is a new message, something to read or sign, or a report; a home left unnamed is called by its provider's first name and initial, and that name is in its alerts; never any other person's name, a phone number, a child's name, a message's text or a photo) and the KeepCount page a tap opens | United States |
| Google (Firebase Cloud Messaging) | When the KeepCount app for phones is released (it is not available yet): delivers notifications to the KeepCount app on Android phones and tablets, where the person switched them on | The phone's token and app-instance identifier for the app (made once the person switches notifications on), each notification's title and words and the page a tap opens (as for Apple) | United States and elsewhere |
| Anthropic | Answers the "Ask the assistant" help questions, only for organizations whose owner turns it on (it is off unless they do) | The question a person types (at most 500 characters, an email address or phone number in it removed), the text of KeepCount's guide for their role, their role and whether the organization is a centre or an agency. KeepCount adds no name, organization name or record; a name or detail a person types into the question is sent with it, which is why the box asks them to leave names and details out | United States. Anthropic keeps them only as its commercial terms allow and may not use them to train its models. |
- Notice of changes. Before adding or replacing a provider that would handle an organization's records, we email its administrators at least 15 days ahead. An organization that objects on reasonable privacy grounds may end its plan before the change, and we refund fees paid for the time after that date (terms, 14.4).
- Outside Canada. The records are stored in Canada. Section 14.5 of the terms says when they are handled outside Canada, and the privacy notice says under "Service providers and where information is kept" which laws then apply.
- Alerts on devices. A safety alert on a device whose user switched alerts on is delivered by the push service of that device's browser (Google, Apple, Mozilla or Microsoft), outside Canada, under its own terms. It receives the device's push address and the alert encrypted for that device, which it cannot read. What alerts and the app's notifications carry is as the privacy notice says under "Service providers and where information is kept".
- Email. KeepCount's emails are written so that none names a child or carries a child's health information. What each email carries, and the settings that pause them, are as the privacy notice says under "Emails".
Schedule 2. Safeguards
KeepCount keeps the safeguards the privacy notice describes: encryption, sign-in, private files and backups under "How information is protected", family members' sign-in codes under "Families: parents and guardians who sign in", notices of a new passkey or sign-in email under "Emails", and the activity log under "Who can see the information". Sections 14.3 (confidentiality and support sessions), 14.6 (changes to the safeguards), 14.7 (breach notice and the breach record) and 14.11 (the yearly questionnaire) of the terms also apply, and section 13 governs retention and deletion. In addition:
- Each organization's records are separated in the database itself, on every table. A test that tries every table and every function from an administrator and a staff member of a second organization runs before every release.
- A passkey does not replace the second sign-in step that KeepCount support always uses. Family members' sign-in codes are also behind a verification check and a limit of 10 tries an hour per connection.
- The database is in the Canada (Central) region, and the server functions run in the Canadian region. KeepCount's own encrypted copy of the database and files is kept in Canada (Amazon Web Services, Canada Central), separate from the live service, for 30 days.
Schedule 3. Public bodies
This schedule applies when the organization is an institution under the Municipal Freedom of Information and Protection of Privacy Act or the Freedom of Information and Protection of Privacy Act (for example, a child care centre operated by a municipality). Where it differs from the rest of section 14, it prevails.
- 3.1 Control. The records in the organization's account are in its custody or under its control for the purposes of the Act. KeepCount holds them as the institution's service provider and claims no right to them.
- 3.2 Use and disclosure. KeepCount collects, uses and discloses the records only to provide KeepCount to the institution, on its instructions, or as Canadian law requires.
- 3.3 Requests under the Act. If KeepCount receives a request for access to or correction of the records, it sends it to the institution within two business days and does not answer it itself. When the institution asks for records to answer a request, KeepCount helps it produce them within ten business days, or sooner where the institution's deadline requires.
- 3.4 Demands from outside Canada. If a court or authority outside Canada demands the records, KeepCount tells the institution at once, unless the law forbids it, and discloses nothing unless a Canadian court requires it.
- 3.5 Breaches. KeepCount tells the institution without undue delay, and within 72 hours after KeepCount determines that a breach involving the records has occurred, with what it knows then, and updates it as it learns more. It helps the institution notify the people affected and the Information and Privacy Commissioner of Ontario as the Act and the Commissioner's guidance call for.
- 3.6 Retention. KeepCount keeps the records for at least three years (O. Reg. 137/15 s. 82(1); for a child, three years after the child leaves, s. 72(5)). Where the institution's records retention by-law requires a longer period, it tells us in writing and we set the account's retention period to match, or it exports the records first.
- 3.7 Return and deletion. At the end of the agreement the institution exports the records and asks us to delete them; sections 13 and 14.10 of the terms then apply.
- 3.8 Disclosure of these terms. KeepCount accepts that the institution may disclose these terms under the Act. Security details we give in confidence (for example, in a questionnaire) are marked as such.
- 3.9 A signed copy. On request, KeepCount signs these schedules as a separate agreement with the institution.
- 3.10 Assessments and breaches under the Act. On request, KeepCount gives the institution the information about the service that it needs for a privacy impact assessment, and, after a breach, the facts it needs to decide whether the breach creates a real risk of significant harm and to report it to the Information and Privacy Commissioner of Ontario.
Schedule 4. A notice for families, staff and volunteers
A notice the organization can adapt for its parent handbook, enrolment forms and staff orientation, to tell people that a service provider keeps their records (terms, 7(a)). Remove the parts it does not use, and fill in the brackets.
How [organization name] keeps its records
[Organization name] keeps the records that Ontario's child care licensing rules require (the Child Care and Early Years Act, 2014 and O. Reg. 137/15) in KeepCount, a record-keeping service provided by KeepCount Inc. of Mississauga, Ontario. KeepCount stores and handles these records only on our behalf and on our instructions. We remain responsible for them.
What we record about children: name, date of birth, room, enrolment and withdrawal dates, arrival and departure times and who the child was released to and how a parent approved someone not on our list, a parent's word at drop-off of who picks the child up that day, a menu substitution we note for one child (which child and why), the people who may pick the child up (name, relationship, phone, the date we checked their photo ID and a short note) and anyone who may not, for example under a court order (families who sign in never see those), sleep checks, and incidents and serious occurrences. If we use these parts of KeepCount, also: the items on file in the child's record, allergies and food restrictions, medication authorizations and the doses given, authorizations for sunscreen and creams, absences, two emergency contacts, supplies a child is running low on (deleted 30 days after we mark it done), and daily counts of children away or sent home ill, by room and symptom, without names. For home child care, also the child's home address and the home the child is placed in, with the notes we make before placing the child.
What we record about staff, students and volunteers: contact details, date of birth, position and dates, College of Early Childhood Educators registration number, work schedules, the times you clock in and out, screening and training records (vulnerable sector check, offence declaration, first aid, policy sign-offs), notes about compliance with our policies, the messages the office sends you, the messages you write to the office, and your replies, with when you read them, daily counts of staff away or sent home ill (without names), and the other records the regulation requires. For home child care, also each home's address, the provider's agreement with us, and the people who live in the home or are regularly there while children are in care (name, date of birth and the dates of their screening, and, while a vulnerable sector check is applied for, a note of the measures in place).
[If we let families sign in to KeepCount:] Parents and guardians we add to a child's file sign in with a one-time code that KeepCount emails or we give by phone or in person (there is no password). They see their own child's arrivals and departures, naps, outdoor time and menu, allergies, the names of the emergency contacts and the pick-up list, the child's other family members who have access, our calendar for families, that an incident report was made once we have told them[, the times medication was given] and, if we set them to receive photos, the last month's photos. Each family member also sees the absences another family member reports, with the reason, and when one is changed or cancelled, and whether another family member withdrew photo consent; never who. If we ask, they can sign medication and cream authorizations, read an accident report copy and record that they read it, give, refuse or withdraw the consents we ask for in KeepCount, and ask us to change the allergies, emergency contacts or pick-up list (nothing changes until we do). Those who receive messages get our messages about their child and our notes to the child's room or site, and can write to us about their child; each sees our messages to them and their own, never another family member's. The staff who work with the child and our administrators read them, as can KeepCount's support in a support session recorded in our activity log. Messages are not for emergencies: phone us. A photo is shown only while every child in it has photo consent, which a family member gives for each child, in KeepCount or on our form. Consent is never a condition of enrolment and can be withdrawn at any time; shared photos are then no longer shown. A photo of several children is seen by the families of each. Photos are kept privately in Canada, never emailed, and deleted after [90] days. Please do not post or share photos of other children. [If we let families sign a child in at the door:] A family member can sign their child in, and ask to take the child home, with a personal code on a room tablet; we keep the code only as a one-way hash, a staff member always confirms a departure against the pick-up list, and each entry says who made it. [If we use Billing:] A family member who signs in sees their own family account's invoices, payments and receipts. We keep the family's payers' names and email addresses, the invoices, payments, refunds and receipts and, if a funder subsidizes the child's fees, the funder's approval (case number and the family's share); an emailed invoice link works for 14 days and names no child. We keep each family member's name, the email address or phone number they sign in with, and the children they see. Their access ends when we remove it, or 30 days after the child's last day; these records are deleted with the child's emergency contacts, three years after the child leaves. Tell us if someone should not have access, for example under a court order.
Who can see it: the people we authorize, each for their role. Health information about a child is visible only to our administrators and to staff of the child's location[, and the child's allergies and the names of the emergency contacts to the child's own family members who sign in]. The records are stored in Canada. Emails KeepCount sends for us are delivered by an email provider in the United States and never name a child.
How long: at least as long as the regulation requires: three years from the date each record is made and, for a child's records, three years after the child leaves. A child's health information, emergency contacts, pick-up list, drop-off notes of who picks the child up, absences and safe-arrival follow-ups are then deleted[, or after the longer period we keep them for]. The child's other records (name, attendance, sleep checks and incidents) are kept while we use KeepCount, and deleted after we stop, once those three years have passed.
Questions, or to see or correct the records about you or your child: [name or title], [email], [phone]. If we cannot resolve a concern, you may contact the Office of the Privacy Commissioner of Canada (priv.gc.ca)[, or for a program operated by a municipality, the Information and Privacy Commissioner of Ontario (ipc.on.ca)].
Where the organization shares photos with families, it can record a child's photo consent in KeepCount from a form the family signed. This model form can be printed or adapted; keep the signed form in the child's file.
Photo consent for [child's first and last name]
[Organization name] can share photos of your child's day with your family in KeepCount, only if you agree. This consent is for this child only, and saying no does not affect your child's place or care with us.
If you agree:
- The staff who care for your child may take photos of your child, alone or with other children, and share them in KeepCount with the family members we set to receive photos. Families see the first name of the staff member who took a photo.
- A photo of several children is shared only if every child in it has photo consent, and it is seen by the families of each of those children. KeepCount does not tell families the names of the other children in it.
- Photos are kept privately in Canada, open through links that expire, and are never emailed or made public. Families see the last month's photos. We keep each photo [90] days from the day it is shared, then it is deleted.
- KeepCount does not use photos for facial recognition or to train any model.
- No one can stop a screenshot. Please do not post or share photos of other children.
You can withdraw this consent at any time, in KeepCount or by telling us. From then on no photo with your child in it is shared, and the photos already shared with your child in them are no longer shown to families (a link opened in the last few minutes keeps working until it expires). Any family member of your child can give or withdraw this consent in KeepCount. If we record your withdrawal for you, only we can record consent again, with a new form.
[ ] I agree to photos of my child being shared with families as described above.
[ ] I do not agree.
Parent or guardian's name: ______________________ Relationship to the child: ______________________
Signature: ______________________ Date: ______________________
For our use: recorded in KeepCount on ____________ by ______________________
Contact
Huphy S. Ghayur, Privacy Officer, KeepCount Inc., Suite 200, 51 Village Centre Place, Mississauga, Ontario L4Z 1V9, hello@keepcount.ca (put "privacy" in the subject).