Privacy

LarkDay is operated by Nexavas Inc., a company based in Québec, Canada. Nexavas Inc. is the enterprise responsible for the personal information described in this policy. For any privacy question, or to exercise your rights, contact our privacy officer at privacy@larkday.ca.

By category: parent identity + contact (name, email, phone, optional address); child profile (name, date of birth, allergies, intolerances, dietary restrictions and medical conditions, emergency contacts); daily logs (feeds, naps, meals, diapers, mood, notes); photos/videos of your child; attendance and pickup records; billing metadata (Stripe holds card/bank data — we never do); and privacy-free audit + error-monitoring context.

Solely to run the service for your daycare, to bill the daycare's subscription, and to enable daycare↔parent communication. No marketing. No advertising or ad tracking. We never sell your data.

We process this information with consent and as necessary to provide the service (Act respecting the protection of personal information in the private sector, incl. art. 12). Photo/video sharing is separately consent-gated, per child, and revocable at any time.

Supabase (database + auth, Canada region); Cloudflare R2 (media bytes, North America); Stripe (subscription billing, US/Canada); Resend (transactional email, US). Error monitoring stays in-house in our own Canadian Postgres — no third-party monitoring SDK.

Our database is hosted in Canada. Some processors store or process data outside Québec: Cloudflare R2 (North America, not Canada-guaranteed) for media, and Stripe + Resend (United States). We have completed a privacy assessment of these transfers; mitigations include private buckets, short-lived presigned URLs after an authorization check, EXIF/GPS stripping, encryption in transit and at rest, and minimization. You can request a summary of the assessment.

Primary storage: Supabase Canada region. Retention: a child's records for 1 year after departure (per RSGEE); media the same; billing records 7 years (tax); error logs 90 days (adjustable per organization).

Under Law 25 you may access, correct, delete, and obtain a portable copy of your personal information, and withdraw consent. You may also complain to the Commission d'accès à l'information du Québec (CAI): https://www.cai.gouv.qc.ca.

Children's information receives special care: photos are consent-gated per child, staff access is scoped to the rooms a child is in, and parents see only their own children's data that staff intend to share.

Minimal session cookies only — no advertising cookies, no fingerprinting, no third-party trackers near child or guardian data.

Privacy officer: the founder (until a dedicated officer is named) — contact via the address below. We will give notice of material changes in-app and by email, with a new effective date.

Contact: privacy@larkday.ca