Privacy Policy

Childcare Marketing Group Ltd. provides Childcare OS, a cloud platform for nurseries, childcare groups, and related education providers. In this policy, "CMG", "Childcare OS", "we", "us", and "our" refer to Childcare Marketing Group Ltd.

For account administration, billing, marketing, security, and support data, we generally act as an independent controller. For nursery operational data that customers upload or connect to the platform, we generally act as a processor or service provider acting on the customer's instructions.

Account and user information, such as names, email addresses, roles, organisation details, authentication identifiers, and support communications.

Customer content and nursery operational data that authorised users enter, import, or connect, including child, parent, staff, attendance, billing, CRM, compliance, learning, and communication records.

Connected account data from third-party integrations when a customer chooses to connect them, including accounting provider tenant IDs, contacts, invoices, payments, accounts, bank transactions, and related metadata returned by providers such as QuickBooks Online or Xero.

Technical and usage data, such as device information, browser type, IP address, timestamps, log data, feature usage, diagnostics, and security events.

Payment, subscription, and commercial information needed to operate customer accounts and manage billing.

To provide, maintain, secure, and improve Childcare OS and related services.

To authenticate users, manage permissions, support customer organisations, and prevent unauthorised access.

To operate customer-requested integrations, including syncing data to and from third-party services that customers connect.

To provide support, investigate issues, communicate service updates, and respond to customer requests.

To comply with legal, regulatory, tax, accounting, security, and contractual obligations.

We do not sell customer personal data. We do not use customer accounting data from connected providers to train public foundation AI models. Where AI features are used, they operate to provide the requested service under customer direction and applicable agreements.

Where UK GDPR or EU GDPR applies, we rely on legal bases including performance of a contract, legitimate interests, consent, compliance with legal obligations, and processing on documented customer instructions where we act as a processor.

Customers are responsible for ensuring they have an appropriate legal basis for the personal data they add to Childcare OS or connect through integrations.

With authorised users in a customer's organisation according to their configured roles and permissions.

With subprocessors and service providers that help us host, secure, authenticate, communicate, analyse, support, and operate the platform.

With third-party integration providers, such as accounting or communications platforms, only where an authorised customer connects or directs that integration.

With professional advisers, regulators, law enforcement, or courts where required by law or necessary to protect rights, safety, and security.

In connection with a business transaction, such as a merger, acquisition, financing, or sale of assets, subject to appropriate confidentiality and data protection obligations.

Childcare OS may process children's personal data because nurseries and childcare providers use the platform to operate their settings. We process this data for the customer and according to the customer's instructions.

Parents, guardians, staff, and other individuals should contact the relevant nursery or childcare provider first for requests about records held by that provider. We will support our customers in responding to valid data protection requests where required.

We use administrative, technical, and organisational safeguards designed to protect personal data, including access controls, encryption in transit, authentication controls, audit logging, and security monitoring.

We retain personal data for as long as needed to provide the service, comply with legal obligations, resolve disputes, enforce agreements, maintain security, and follow customer instructions. Customers may configure or request deletion of customer-controlled data subject to legal and contractual limits.

We use cloud infrastructure and service providers that may process data in the United Kingdom, United States, European Economic Area, and other locations. Where required, we use appropriate safeguards for international transfers, such as contractual protections and transfer mechanisms recognised by applicable law.

Depending on where you are located, you may have rights to access, correct, delete, restrict, object to, or receive a copy of your personal data, and to withdraw consent where processing is based on consent.

If your data is held by a nursery or childcare provider using Childcare OS, please contact that organisation first. If your request relates to your CMG account or our own processing, contact us using the details below.

You may also have the right to lodge a complaint with a data protection authority, including the UK Information Commissioner's Office where applicable.

We use cookies and similar technologies to keep users signed in, remember preferences, secure the service, understand usage, and improve performance. Some cookies are essential for the platform to work. Others may support analytics, support, or marketing where permitted.

You can control cookies through your browser settings, but disabling essential cookies may prevent parts of the service from working correctly.

Customers may connect Childcare OS to third-party services such as Meta Ads, QuickBooks Online, Xero, payment providers, messaging tools, calendar services, and other applications. Those services are governed by their own terms and privacy policies.

When you authorise an integration, Childcare OS receives and stores the tokens and data needed to operate that integration. You can disconnect integrations through the app or the third-party provider's account controls.

When a customer connects Meta Ads, Childcare OS may receive the authorised ad-account identifier, account name, campaign configuration, delivery status, spend, impressions, clicks, conversions, and related performance metrics. Childcare OS uses this information only to provide the customer-requested advertising management, reporting, and optimisation features.

Instructions for disconnecting Meta Ads and requesting deletion of Meta integration data are available on our Meta Data Deletion page.

We may update this policy from time to time. If changes are material, we will take reasonable steps to notify customers through the service, by email, or through another appropriate channel.