Security and privacy

Where your records are, and who can see them

The records are stored in Canada and encrypted. Views, prints, exports and downloads of a person’s record on KeepCount’s screens are logged with who did it and when.

Where the records are, and what leaves Canada.

The records are stored in Canada. They are handled outside Canada only by the providers the privacy notice lists, for their tasks, and by the browsers’ push services for alerts on a device that its user switched on.

Stored in Canada: The database, the files and the database provider’s backups are stored in Canada (Canada Central region). KeepCount’s own encrypted backup copy of the database and of uploaded files is made and stored in Canada (Canada Central region), and used only to restore the service.
The database provider’s logs: The database provider’s service logs are stored in its data centres in the European Union, and they, its telemetry and its service metadata are processed outside Canada: each request’s address (which can include email addresses being looked up, for example when staff are imported, and the names of uploaded files) and each sign-in with its email and IP address; never the contents of the records. Its support staff outside Canada may see these logs when helping with a problem. KeepCount’s own billing and support correspondence with the provider is handled outside Canada.
Email: KeepCount’s emails are sent by an email service in the United States, which reports whether each was delivered. It receives recipients’ names and addresses, the organization’s name and the content of each message, including the weekly summary’s names and due items; never a child’s name or health information. Email you send to our support mailbox, and our replies, are handled by our mailbox provider outside Canada.
Delivering the website: The website and the app are delivered through a global network, which also runs the check on the public forms and may count visits to the public pages. It receives your browser’s requests, including your IP address and browser details; on the public pages, the page’s address, the page before it and its load times; no account records are stored there.
Alerts on devices: Alerts on a device are sent only with its user’s permission in their browser (in the KeepCount app, the phone’s own permission). In a browser, alerts are delivered by the push service of that browser, outside Canada, under the terms of the company that runs it with the person who uses the browser. The push service receives the device’s push address and each alert encrypted for that device, which it cannot read; it is not given the person’s name. A family member can switch on alerts on their own device in the same way. Alerts and notifications name rooms, sites, homes and times, or say “a new message” (to a family member: “You have a new message from” and the organization’s name, with a link to sign in and read it), or say that a message or a photo was reported; they never carry a child’s name, a message’s subject or text, or a photo. Staff devices are told of a family’s message only during the site’s hours. When the KeepCount app for phones is released (it is not available yet), its notifications, where the person switched them on, go through Apple’s or Google’s phone alert service, in the United States (Google’s also elsewhere). Those services receive the phone’s token (Google also an identifier of the app on that phone, made only once notifications are switched on), each notification’s words (rooms, sites, homes and times, the organization’s name, or that there is a new message, something to read or sign, or a report; a home left unnamed is called by its provider’s first name and initial, and that name is in its alerts; never any other person’s name, a phone number, a child’s name, a message’s text or a photo) and the KeepCount page a tap opens (an address that names the organization, site, room or conversation by an internal number, never a child), and unlike a browser’s push service they can read those words.
Training videos: Where an organization has added a training video, or a video from the same service to a collection in Resources, that one video service plays it under its own terms: when a page with a training video opens or that video plays, and when Play is pressed on that service’s video in a collection, your device’s IP address and browser details, not your name, go to that service outside Canada. A collection’s links to videos on other sites open in a new tab, under the terms of the site that holds the video. Fonts and the app’s scripts are served by KeepCount itself; the only outside scripts are the website network’s form check, its visit counter on the public pages (once that counter is switched on), the video player, and Zūm Rails’s Connect script, loaded from Zūm Rails only when someone opens its window to set up a pre-authorized debit.
The help assistant, only if your owner turns it on: Where an organization’s owner turns on “Ask the assistant” (it is off unless they do), a question a person types is answered from KeepCount’s guide for their role by Anthropic’s service, in the United States. KeepCount sends Anthropic the question (at most 500 characters, with any email address or phone number in it removed), the text of the guide, the person’s role and whether the organization is a centre or an agency; never their name, the organization’s name or any record. Anthropic keeps what it receives only as its commercial terms allow and may not use it to train its models. The box asks people not to type names or details; if someone does, it is sent with the question. A question about self-harm or a child at risk is not sent: KeepCount shows crisis lines instead (9-8-8, 911 and a children’s aid society). KeepCount keeps no copy of the question or the answer. The owner can turn it off at any time in Settings.
Payments through Zūm Rails: Zūm Rails, in Canada, handles payments for family billing when an organization turns them on (none has yet): pre-authorized debits from families and payouts to the organization. It receives the family member’s name and email address, which KeepCount sends; their bank account details, which they give to Zūm Rails directly in its own window (KeepCount keeps only the bank’s name and the last four digits of the account); and the organization’s payout details. When a centre or agency turns on payments through Zūm Rails, KeepCount gives Zūm Rails the centre’s or office’s business details (its legal and display names, the name on bank statements, its Interac email and its address), the totals Zūm Rails sets its first limits from (how many families and payers it bills and what it invoices a month, without names) and the name and email of the owner who agrees, so Zūm Rails can send its application. Everything else Zūm Rails asks for (an identity check, the owners and directors, documents, the bank) the owner gives Zūm Rails directly; KeepCount does not receive or keep it.
The law outside Canada: Information handled outside Canada is subject to the laws of the country where it is handled and may be accessible to that country’s courts, law enforcement and national security authorities. Several of these providers are United States companies, so United States law can also reach information they hold in Canada. These include the database provider and the provider of KeepCount’s own backup copy. KeepCount does not sell personal information, does not use it for advertising, and does not use organizations’ records to train AI models. KeepCount has no advertising or tracking cookies.

The privacy notice names every provider we use, where it is, and what it handles.

Children’s names and sensitive notes, encrypted a second time.

Everything travels encrypted (TLS) and is encrypted at rest. The following are also encrypted inside the database with a key the application holds, so a copy of the database alone does not reveal them. They include children’s names, emergency contacts, the names of allergens and medications, and what happened in an incident.

See everything that is encrypted

Children: names, pick-up notes, absence notes, safe-arrival follow-up notes, a sleep check’s note, a close-out’s explanations and note and the notes added to a day after it, which child a menu substitution for one child is for and why, the name and note of a parent’s word at drop-off of who picks the child up, and the addresses of children in home child care.
Contacts: emergency contacts; the names, phone numbers and notes of the people on a child’s pick-up list; the names of family members who sign in and the phone numbers of those who sign in by phone.
Health: the names of allergens and restrictions, notes on an allergy, where epinephrine is kept, the allergy notes brought in from another app to confirm; the names and amounts of medication, who signed a medication authorization and, for medication given on symptoms, when to give it; the products, instructions and signer of an authorization for sunscreen or a similar product; dose amounts and observations, the reasons a dose was recorded late, and the medications on site noted in a home visit checklist.
Incidents: what happened, the action taken, witnesses, who notified the parent, the follow-up notes and corrective actions, and the accident report copies shared with family members.
Families: the authorizations shared with family members and the names and statements they sign with; the name of who gave a written consent and its note; families’ requests to change a child’s lists and the organization’s answers; the subjects and texts of messages with families; the notes on photos shared with families.
Staff and homes: the subjects and texts of messages to staff, the addresses of homes, the names of the people in a provider’s household, the notes of the measures in place while a household member’s check is applied for, and the notes made before placing a child in a home.

Some other notes are not encrypted (for example a note on a playground or water-flushing check, or the reason given for a correction), nor are the facts around encrypted ones (whether an allergy is anaphylactic, the times of doses, an absence’s reason); all of these are read only through the application’s own checks.

Each organization sees only its own records.

Each organization sees only its own records, and the database enforces this on every table. Staff and office staff see a child’s first name and initial; owners, administrators and supervisors see the full name.

Allergies, medication, doses, emergency contacts and absence reasons are shown only to the organization’s owners, administrators and supervisors (a supervisor: children of their sites) and to employees who work at the child’s site (in an organization with one site, every employee); in home child care, to the provider of the home the child is placed in, never to another home’s provider or to an agency’s employees who are not administrators. Volunteers and students see no child’s records in KeepCount; they work beside a staff member who does.

See who can see what

Your organization: owners and administrators see their organization’s records; a supervisor or an office staff member sees only their sites. Office staff manage people and their screening documents; they see no children’s health information (see “Health information” in the privacy notice) and no incident records. Staff and office staff see a child’s first name and initial; owners, administrators and supervisors see the full name. Volunteers and students see only their own records, the messages the office sends them and the conversations they start with the office. Only an owner deactivates or removes an owner’s or an administrator’s login. Each organization sees only its own records, and the database enforces this on every table.
On the room screen, a site’s staff and office staff see who is not cleared to work with children or to count in ratio today, never why; supervisors, owners and administrators also see why; volunteers, and students on placement who are not also employed, see none of it.
A site’s daily checks (other than the drinking-water records below) are read by its room staff, supervisors and office staff, and its play-material notes by its room staff and supervisors, with the owners and administrators in both cases; volunteers and students on placement see neither. The drinking-water and public health records are read and changed by the site’s supervisors and the owners and administrators, with the room staff recording illness counts (which they also read), flushing, filter changes and checks of automatic flushing devices; office staff, volunteers and students do not see them. Only owners and administrators see the licensee’s police record check lines.
The people who sign a child out (staff of the child’s site, or the provider of the child’s home) see the names, relationships and notes of the child’s pick-up list and whether photo ID was checked. The list’s phone numbers, and the child’s family members who sign in with their email addresses, are seen by the owners, administrators and supervisors of the child’s site; these phone numbers, and those kept for signing in, are in the organization’s export.
In a home child care agency, a provider sees the children of their own home (first name and initial), their home’s day with who recorded each entry, and those children’s allergies, medication, emergency contacts and sleep checks, which the regulation requires to be kept at the home or readily accessible to the provider. The agency’s owners and administrators and the supervisors of the home’s office see the provider’s day as it is made, and the people in a provider’s household, the agreement and the placement notes, which the provider’s colleagues do not see.
One sign-in for several organizations: an owner or administrator of one organization can also administer another with the same sign-in, when invited by an owner of the other organization (or by KeepCount support, for it) or when they set up a new one with the same email. They see an organization’s records only while they have it open, after two-step verification, and receive the emails and alerts it sends its administrators. The other organization sees their name, sign-in email and access level, and in its activity log what they did there; it sees nothing of their own organization, where their own training and screening stay. An owner of the other organization can remove that access at any time.
When someone views, prints, exports or downloads a person’s record on KeepCount’s screens, the organization’s activity log records who did it and when; for a child, this includes their file (opened by staff, or by a family member, shown as a family member’s view), the allergy list and the room screen’s allergy details, the medication record, the arrivals and evacuation lists and the close-out. Exports, and a family member opening a child’s file, are recorded by the database itself; other views by the screen, so a view made offline, or outside KeepCount’s screens with a person’s own sign-in, may not be recorded.
For a licensing visit, an owner, an administrator or a supervisor can download a visit pack: the inspection binder, the period’s records as spreadsheets (they name the children and the staff) and the files the binder links to. Medication doses and the allergy list go in only when an owner or administrator makes it. Making a pack is written to the activity log with what it held, and the pack is in the organization’s hands from then on.
KeepCount support can open an organization’s records only through a support session, after a two-step sign-in, for eight hours at a time; the session is recorded in the organization’s own activity log. Support is given by people acting for KeepCount Inc. who are bound to confidentiality. Outside a support session, support sees for each organization only its account and billing details (which can name a person, and include any reason for cancelling), its sites, set-up progress and readiness score, counts of its people, sign-ins, use and emails, support’s own notes and, on the updates list, who receives updates, with their organization and role; never a record about a person or a child. Help with setting up, where an organization asks KeepCount support for it, is given in a support session in the same way.
KeepCount Inc. and Ghayur Accounts and Tax Services (GATS), the accounting firm of KeepCount’s founder, are separate companies. GATS has no access to the records organizations keep in KeepCount unless an organization gives it access itself; KeepCount shares none of them with GATS and does not use them for GATS’s accounting, bookkeeping or tax services, or to market them, unless the organization asks. An organization that hires GATS decides itself what to give it. The “From GATS” card on an administrator’s dashboard opens ghayurtax.com without telling GATS where the visit came from or which organization the person belongs to.
KeepCount stopped issuing training certificates in October 2026: a person’s completion is on their record. Certificates issued until then stay on the person’s record, read-only, and in the organization’s export until their retention period ends (the person sees their completion, not the certificate, in KeepCount; the organization can give them a copy from their record’s export); keepcount.ca/verify no longer checks them.
The organization shows its records to licensing inspectors and program advisors. KeepCount discloses information to anyone else only where the law requires it, for example a court order; we tell the organization first unless the law forbids it.

Who opened a person’s record, and when.

Views, prints, exports and downloads of a person’s record on KeepCount’s screens are logged with who did it and when. KeepCount support can open an organization’s records only through a support session, after a two-step sign-in, for eight hours at a time; the session is recorded in the organization’s own activity log.

Exports, and a family member opening a child’s file, are recorded by the database itself; other views by the screen, so a view made offline, or outside KeepCount’s screens with a person’s own sign-in, may not be recorded.

Sign-in, files and devices

Sign-in: Passwords must be at least twelve characters and are checked against lists of leaked passwords. A person can also sign in with a passkey, whose fingerprint, face or PIN never leaves their device. Owners and administrators of the whole organization use a second sign-in step (KeepCount asks for it from 14 days after their first sign-in), other administrators can be required to by their organization, and KeepCount support always uses one; sign-in attempts are rate-limited.
Files: Uploaded files, photos included, are private: only the people allowed to see a file can get a link to it, and KeepCount’s screens make links that expire after ten minutes (a link cannot be cancelled once made, and someone allowed to see a file could make a longer-lasting one by going around KeepCount’s screens); the one exception is organizations’ logos, which are public.
The browser, and what stays on a device: KeepCount uses your browser’s storage to keep you signed in. On the room tablet, or any other device the daily records are made on, it holds them until they can be sent (see what a device keeps); records waiting to be sent stay on the device after signing out, and are sent the next time the same person signs in on it. If KeepCount refuses a record, the device keeps a short list of what was not saved (what each record was, when and why, which can name a person), at most 50, until the person dismisses each one, after signing out too. A home visit typed in Log a visit and not yet saved is kept on that device as a draft (with the household members present and what was found, with the date to put it right; never a child or the medications on site) until it is saved or discarded; a draft older than seven days is discarded the next time Log a visit is opened on that device. So that KeepCount opens without a connection, the browser keeps a small KeepCount script (a service worker, which also shows alerts if you switch them on) and a copy of the app’s own files, and the browser of each device you sign in on also keeps your name, email, role, sites and rooms, your preferences, the organization’s name, plan state and settings, and the site’s rooms and ratio rules; never a child’s name, health information or any other record. Signing out removes them (the app’s own files stay) and switches alerts off for that device. Sign out of a shared device when you finish.
See what a device keeps
KeepCount uses your browser’s storage to keep you signed in. On the room tablet, or any other device the daily records are made on, it holds them until they can be sent (head counts and checks with their notes, sleep checks, what was done about a check’s issue, attendance, which can include the name of the person a child was released to and how a parent approved someone not on the pick-up list, a parent’s word at drop-off of who picks the child up, with that person’s name, who said so and the note; outdoor times with their reason and note, notes of play materials, illness counts, roll-calls with whether each was a drill or an evacuation, when each started and finished, the counts of children and adults and which children were not yet found, kept as a code and never a name; catered food’s temperatures with the caterer, a note and the reason for a correction; when a room tablet was handed back; staff clock-ins and outs (when, in or out, the room or kind of time, and who the screen showed); and medication doses; never a dose’s observations, or a sleep check’s note or what was seen); records waiting to be sent stay on the device after signing out, and are sent the next time the same person signs in on it. If KeepCount refuses a record, the device keeps a short list of what was not saved (what each record was, when and why, which can name a person), at most 50, until the person dismisses each one, after signing out too. A home visit typed in Log a visit and not yet saved is kept on that device as a draft (with the household members present and what was found, with the date to put it right; never a child or the medications on site) until it is saved or discarded; a draft older than seven days is discarded the next time Log a visit is opened on that device. The browser also keeps whether you asked for notifications on the To do strip; which person an administrator previews the staff pages as, until the tab is closed; which site or office you chose to work in, and which organization you opened last; that you chose an organization for this sign-in, until you sign out; which organization another tab of the same browser just opened; which columns you chose to show in a list; the name matches you make in the attendance import, each name kept only as a code with the child it matches; your ticks on the checklists in Learn; whether the tour was offered; and whether the page was just reloaded after an update. Unless this paragraph says otherwise, these stay until the browser’s storage for KeepCount is cleared. So that KeepCount opens without a connection, the browser keeps a small KeepCount script (a service worker, which also shows alerts if you switch them on) and a copy of the app’s own files, and the browser of each device you sign in on also keeps your name, email, role, sites and rooms, your preferences, the organization’s name, plan state and settings, and the site’s rooms and ratio rules; never a child’s name, health information or any other record. Signing out removes them (the app’s own files stay) and switches alerts off for that device. KeepCount itself sets no cookies: what it keeps in the browser is what this paragraph lists. The network that delivers the site and runs the check on the public forms may set a cookie it needs to tell people from automated traffic; a video’s player, once a page with a video opens or a video is played, may store information on the device under its service’s terms; and pages of other services that KeepCount opens keep their own under their terms. KeepCount has no advertising or tracking cookies, so there is no cookie banner. For a family member, the browser keeps the sign-in, the language chosen for the family pages until the tab is closed, and, if they switch alerts on, the KeepCount script and the app’s own files; nothing about a child is kept on the device. Photos shared with families are never kept on a device to be shared later: without a connection, KeepCount’s screens do not start sharing one, and a family’s Photos page opens photos only while connected (photos already on the screen stay until the page is closed). Sign out of a shared device when you finish.

How long each kind of record is kept.

Records the regulation requires (people, children, incidents, drills, inspections and the rest). While the organization’s account is open, and never less than the regulation requires: three years from the date a record is made (O. Reg. 137/15 s. 82(1)) and, for a child’s records, three years after the child leaves (s. 72(5)); or a longer period set for the organization at its request, for example under a public body’s records by-law (the “retention period” in this table). KeepCount refuses to delete them earlier, except a record deleted within a day of being made, to correct a mistake.

Information	How long
Someone who leaves the organization	Their access is removed, and their phone number and address are deleted; their name, email address and records stay as above. If the person closes their own account, the login and records are deleted automatically once the retention period has passed.
An organization that leaves KeepCount	It exports its records and asks KeepCount support to delete them. The account is closed, and the records are kept (except what this table says is deleted sooner) until the later of 30 days after the request and the end of the retention period; support provides an export on request until then. On that date its records, files and activity log are deleted automatically, and the deletion is recorded.
Children’s allergies, medication and doses, emergency contacts, absences (and the earlier versions of these, of pick-up people and of the child’s name, date of birth, site, room and dates, kept when someone changes or removes them), safe-arrival follow-ups and file checklist	Deleted automatically three years after the child leaves, counted from the later of the date the child left and the last record made about the child (or after the longer retention period).

See every other kind of record (37)

Information	How long
A trial that ended without billing, or an account KeepCount closes	A trial stays read-only. After 180 days its records may be scheduled for deletion, with at least 30 days’ notice by email to its administrators; records the regulation requires wait for their retention date. Until the deletion date, its administrators can ask us for an export (terms, sections 9 and 18).
Activity and access log	While the account is open; deleted with the organization’s records. The lines about a child’s health records go with those records, three years after the child leaves.
Record of emails sent, with whether each was delivered, bounced or reported as spam	24 months.
Each organization’s daily readiness score (numbers only)	Two years; deleted with the organization’s records.
Support notes about an account, and signed copies of the inspection binder	While the account is open; deleted with the organization’s records. A signed binder copy keeps the names it showed when signed, including those of people who later leave or close their own account.
Drinking-water records	While the account is open, and never less than six years from the record’s date (O. Reg. 243/07 s. 9), even after the organization leaves and even if longer than its own period; the people named in them are kept as long; then deleted with the organization’s records.
Illness counts, calls to public health, pest control visits, a caterer’s food temperatures, immunization records sent to a health unit	While the account is open, then deleted with the organization’s records once its retention period has passed.
Messages to staff and providers, and messages with families	The retention period after the conversation’s last message, then deleted with who read it and its activity-log lines (for a conversation deleted on the day it was sent, those lines go after the same period from that day); deleted with the organization’s records.
Photos shared with families (the picture, its note, who took it, when and where, and which children are in it)	The period the organization sets (30 to 365 days from the day it was shared; 90 unless it chooses otherwise; a change applies to the photos already kept), then deleted with their activity-log lines, the file within a day. A photo the organization deletes, or of a site it deletes, goes the same way, its activity-log lines after its retention period. A photo never finished: one day.
Photo consent, written consents, authorizations and accident report copies shared with a family member (with what they signed or read and when), and families’ requests to change a child’s lists (with the organization’s answer)	Kept with the child’s record and deleted with it. A photo consent stays after the family member who gave it is deleted (with the child’s contacts, as below), without their name.
Calendar events and private calendar links	Events: until an owner, administrator or supervisor deletes them, or with the organization’s records; past closure days stay among the site’s closures. A private link: until it is replaced or turned off, when it is deleted; a person’s link stops working when their access is removed, and is deleted the next time a calendar app reads it, or with the login.
Resources collections and who opened them	A collection, its contents and its opens: until the organization deletes the collection. A person’s opens: until their account is deleted.
Notes of play materials brought out and put away	Three years from the day noted (or the longer retention period).
The licensee’s police record check dates	While the account is open; deleted with the organization’s records. The lines about a person who stopped being a director, officer or person with a controlling interest, with the activity-log lines that copied them: three years after the day they stopped (or the longer retention period).
Moves from another child care app and notes to confirm	A move’s record: the retention period. What it added, kept so it can be undone: two days. A note to confirm (the other app’s allergy note or photo permission): 30 days after it is entered, dismissed or settled by consent, and with the child’s records.
Shared room tablets	A person’s PIN for taking a shared room tablet is kept only as a fingerprint, until they remove or replace it or leave the organization. Who held a tablet and when: the retention period. Each request to make a device a shared tablet, with its answer: the retention period after it is refused or ended; one never ended stays with the organization’s records. Wrong PINs: 30 days.
Supplies a child is running low on	Deleted 30 days after it is marked done. A note nobody marks done is marked done automatically after 14 days.
A child’s pick-up list, the notes made at drop-off of who picks the child up, and the family members who sign in	Deleted with the child’s emergency contacts, three years after the child leaves (or the longer retention period). A family member removed from a child loses access at once; the record that they had access is kept until then. When the last of these records about a family member is deleted, their name, the phone number kept for signing in, any sign-in code’s fingerprint and their sign-in are deleted too.
Rooms people work in	Usual rooms: until an administrator removes them. The rooms a person said they were in on a given day: 12 months.
Wrong codes entered at a room tablet’s door sign-in	Seven days: the site, the tablet’s session and the time, never the code.
Staff clock-in and out times	Kept for at least the organization’s retention period (never less than three years), like the staffing schedule.
Safety alerts	Which alerts were due and how far each went (rooms and sites, never a child): 90 days. The record of each alert sent (who was told, how and when, and who answered “On it”): 12 months. A device registered for alerts: until its user switches alerts off or removes it, or 30 days after its push or notification service says it no longer exists (or after ten failed deliveries in a row); a family member’s device, also until they sign out there, or the day after their access to every child has ended.
Demo requests and trial links	Deleted 12 months after they were made, unless a trial was started from them; then kept with that organization’s account and deleted with its records.
Trial requests	Not confirmed: deleted after they expire. Confirmed: kept with the organization’s account, except the IP address, which is deleted after 30 days.
Updates list	While you are on it. Learn sign-ups never confirmed: 30 days. The record of an unsubscribe: three years after it. A customer contact whose organization stopped paying: five years after the end of the relationship (the two years in which KeepCount may still write to them, then three).
Security records	Addresses used to limit repeated requests, and the hourly counts of reads of each private calendar link: up to two days. Sign-in events: 12 months. The record that an organization was deleted, and of the deletions KeepCount support allowed or held (which names the support person): kept. Other operational records: 24 months.
Passkeys and sign-in emails	A passkey: until its owner removes it or the login is deleted; the record that one was removed: 24 months. Messages about a login (a passkey added, a sign-in email changed, two-step verification reset, a family member’s invitation) and requests to change a sign-in email: 24 months.
Questions to the help assistant	KeepCount keeps no copy of a question or its answer; the count of questions a person and an organization asked, for the daily limits (20 a person, 100 an organization): up to two days.
Waiting-list applications	While open. An application whose email link is never used is deleted after 48 hours. An open one closes if the family does not confirm it is still interested every 6 months (or 12, if the centre chose); KeepCount emails the family a month and a week before. It is deleted 12 months after it closes without the child starting. A record of the list’s order without names, contact or date of birth (the age group, the month applied, whether a priority applied, the outcome): 3 years. Codes to withdraw an application: a day. An application whose child started is kept with that child’s records, with any brother or sister on it who did not start (their name and date of birth stay as long as the started child’s records), and then follows the rule above. An offer is kept with its application and deleted with it; the record without names keeps only the month of the offer and the answer.
Visit bookings	Deleted 90 days after the visit. When the family also has an application on the same page, a line with the visit’s date and whether it happened, was cancelled or missed is added to that application’s history first.
Error reports	90 days.
Provider pay records	Kept for at least seven years after December 31 of the year they relate to.
Billing records	KeepCount Inc.’s billing of your organization, and family billing records (fees, invoices, payments, refunds, receipts and deposits): seven years after December 31 of the year they relate to. Family billing records are not deleted while the organization uses KeepCount.
Messages to hello@keepcount.ca	As long as needed to deal with them, and up to seven years when they concern a contract or billing.
Interface preferences (for example, whether you finished the tour)	Until the login is deleted.
Administrators who sign in from another organization (who, their access level, who invited them, when they accepted and last opened it)	While they administer it and the account is open; once their access is removed, three years; if the organization closes, kept with its records until those are deleted. Which organization a sign-in has open: until that sign-in ends, then at most two days.
Backups	Deleted information can remain in encrypted backups for up to 30 days: up to 7 days in the database provider’s daily backups, and up to 30 days in KeepCount’s own backup copy. Backups are used only to restore the service. If the service is ever restored from a backup, deletions that were already due are made again before anyone uses it.

The deletions in this table are made by scheduled jobs. The deletions of children’s records, people’s files and logins, the private details kept in the activity log and in sign-ins, and organizations wait the first time until KeepCount support has reviewed a trial run and confirmed it; until then those records are kept past their period. The other deletions in this table run on their schedule. An organization one of whose people also owns or administers another organization with the same sign-in is kept past its deletion date until that is resolved; KeepCount support sees how many are kept.

Export, at any time while the account is open: An administrator can export the records at any time, even when the account is read-only: an Excel workbook with a sheet for each kind of record, or a ZIP with a spreadsheet for each, a README and the complete data, with the uploaded files as a separate download; photos shared with families are not included. An export an administrator downloads is under the organization’s control and safeguards from then on.
Deletion, confirmed: On the deletion date the records, files and activity log are deleted automatically, and the deletion is recorded; backups roll off within the period the privacy notice states. On request, we confirm the deletion in writing.

Backups, getting records back, and the limits

Two backups, in Canada

The database is backed up daily by the database provider, and KeepCount keeps its own encrypted copy of the database and uploaded files in Canada, in a separate account that only KeepCount can sign in to.

How long deleted information stays in backups

Deleted information can remain in encrypted backups for up to 30 days: up to 7 days in the database provider’s daily backups, and up to 30 days in KeepCount’s own backup copy. Backups are used only to restore the service. If the service is ever restored from a backup, deletions that were already due are made again before anyone uses it.

Reminders, not supervision

The due list, the countdowns on the room screen, device notifications and safety alert emails are reminders worked out from what has been recorded. They can arrive late or not at all (a device that is off or offline, an email that is delayed or filtered). They do not replace the supervision of children, the sleep checks, head counts and procedures your policies and the regulation require.

What KeepCount is responsible for, and its limits

We aim to keep KeepCount available at all times but do not promise uninterrupted service; maintenance may interrupt it briefly.

Section 20 of the terms of use, in full:

(a) Neither of us is liable for indirect or consequential losses, or for lost profits, revenue, savings or goodwill, whether those losses are direct or indirect. KeepCount is not liable for administrative penalties, licensing decisions or funding decisions made by the Ministry, a service system manager or any other authority.
(b) Each party’s total liability under this agreement is limited to the fees the organization paid in the 12 months before the event that gave rise to the claim, or $1,000 if that is more. For a breach of section 14 or 15, the limit is three times that amount.
(c) These limits do not apply to the organization’s obligation to pay fees, to a party’s fraud or wilful misconduct, or to anything the law does not allow to be limited. Each party’s obligations under section 21 are subject to the higher limit in (b).
(d) If records are lost or damaged while in KeepCount’s care, we will use reasonable efforts to restore them from our most recent backup, at no charge. Beyond that, we are responsible for lost or damaged records only where our breach of section 14 or 15 caused the loss, and only within the higher limit in (b).
(e) These limits apply to all claims under or in connection with this agreement together, however they arise, including in negligence, and the 12 months are counted back from the first event that gave rise to liability. The fees reflect this allocation of risk.

If something goes wrong

A breach: If a breach of security safeguards involving an organization’s records happens at KeepCount or at one of its providers, KeepCount tells the organization without undue delay, and within 72 hours after KeepCount determines that a breach has occurred, with what it knows then: what happened, what information and which people are affected, what we have done and what the organization can do, and helps it notify the people affected as the law requires. For information KeepCount holds for its own business, KeepCount reports to the Privacy Commissioner of Canada and notifies the people affected where a breach creates a real risk of significant harm. We keep a record of every breach for at least 24 months.
Found a security problem?: Write to hello@keepcount.ca with “security” in the subject; security.txt says the same.

No system is perfectly secure. The breach notice is also in section 14.7 of the terms and, for public bodies, Schedule 3.5.

Who is accountable, and how to reach them

The Privacy Officer: Huphy S. Ghayur, Privacy Officer, KeepCount Inc., Suite 200, 51 Village Centre Place, Mississauga, Ontario L4Z 1V9, hello@keepcount.ca (put “privacy” in the subject), is responsible for how KeepCount handles personal information.
In the contract: Everyone who can reach the records for KeepCount is bound to confidentiality and reaches them only as needed. Each provider in use is bound by written terms that protect the information. Before adding or replacing a provider that would handle your records, we email administrators at least 15 days ahead. If you object on reasonable privacy grounds, you may end the plan before the change, and we refund fees paid for the time after that date. Once a year, on request, we answer a reasonable written security and privacy questionnaire. On-site audits only by agreement. KeepCount keeps the safeguards described in the privacy notice and reviews them. It may change them but will not make them materially weaker. Each organization’s records are separated in the database itself, on every table. A test that tries every table and every function from an administrator and a staff member of a second organization runs before every release. The database is in the Canada (Central) region, and the server functions run in the Canadian region.
Your organization decides: The organization decides what is recorded and why, and remains responsible for those records. KeepCount stores and processes them only on the organization’s behalf and on its instructions, under the data processing terms in section 14 of the terms of use and their schedules, and does not use them for any purpose of its own.
Questions and complaints: Write to the Privacy Officer about information KeepCount holds for its own business, or if your organization cannot help. We answer within 30 days, and tell you if we need more time, as the law allows. If someone asks KeepCount directly about records in your account, we refer them to you unless the law requires otherwise, and help you answer within the time the law allows. Complaints: write to the Privacy Officer first. You may also complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca) and, for a child care program operated by a municipality, to the Information and Privacy Commissioner of Ontario (ipc.on.ca).

For municipalities and other public bodies

The data processing terms: Section 14 of the terms of use is KeepCount Inc.’s data processing addendum with each organization that uses KeepCount. Its schedules form part of it.
Schedule 3: If the organization is an institution under the Municipal Freedom of Information and Protection of Privacy Act or the Freedom of Information and Protection of Privacy Act, Schedule 3 also applies: the records stay in its control for the purposes of that Act, and we help it answer access and correction requests within the time that Act sets.

Read Schedule 3 in full

This schedule applies when the organization is an institution under the Municipal Freedom of Information and Protection of Privacy Act or the Freedom of Information and Protection of Privacy Act (for example, a child care centre operated by a municipality). Where it differs from the rest of section 14, it prevails.

3.1 Control. The records in the organization’s account are in its custody or under its control for the purposes of the Act. KeepCount holds them as the institution’s service provider and claims no right to them.
3.2 Use and disclosure. KeepCount collects, uses and discloses the records only to provide KeepCount to the institution, on its instructions, or as Canadian law requires.
3.3 Requests under the Act. If KeepCount receives a request for access to or correction of the records, it sends it to the institution within two business days and does not answer it itself. When the institution asks for records to answer a request, KeepCount helps it produce them within ten business days, or sooner where the institution’s deadline requires.
3.4 Demands from outside Canada. If a court or authority outside Canada demands the records, KeepCount tells the institution at once, unless the law forbids it, and discloses nothing unless a Canadian court requires it.
3.5 Breaches. KeepCount tells the institution without undue delay, and within 72 hours after KeepCount determines that a breach involving the records has occurred, with what it knows then, and updates it as it learns more. It helps the institution notify the people affected and the Information and Privacy Commissioner of Ontario as the Act and the Commissioner’s guidance call for.
3.6 Retention. KeepCount keeps the records for at least three years (O. Reg. 137/15 s. 82(1); for a child, three years after the child leaves, s. 72(5)). Where the institution’s records retention by-law requires a longer period, it tells us in writing and we set the account’s retention period to match, or it exports the records first.
3.7 Return and deletion. At the end of the agreement the institution exports the records and asks us to delete them; sections 13 and 14.10 of the terms then apply.
3.8 Disclosure of these terms. KeepCount accepts that the institution may disclose these terms under the Act. Security details we give in confidence (for example, in a questionnaire) are marked as such.
3.9 A signed copy. On request, KeepCount signs these schedules as a separate agreement with the institution.
3.10 Assessments and breaches under the Act. On request, KeepCount gives the institution the information about the service that it needs for a privacy impact assessment, and, after a breach, the facts it needs to decide whether the breach creates a real risk of significant harm and to report it to the Information and Privacy Commissioner of Ontario.

Ask about a specific record or a specific risk.

A person answers.

Ask a person Read the privacy notice

The privacy notice, the terms of use and the data processing schedules are the binding versions of this page.