What this policy covers

This policy describes how WeBlossom Platforms Inc. ("WeBlossom," "we," "us") handles information within the WeBlossom app.

WeBlossom is used by a child care center's own staff and by the families that center enrolls. The center decides who it enrolls, what it records, and who on its staff can see what — it is responsible for the accuracy of that information and for having the right to collect it. WeBlossom provides the software and stores the information on the center's behalf.

If you are a parent with a question about your own child's records, your center is the right place to start; we can only act on a center's instructions about its own data.

Information about children

WeBlossom holds the following about a child, entered by the center's staff or by the child's own guardian:

Identity and enrollment: name, preferred name, date of birth, gender, home address, classroom, enrollment status and dates, and scheduled hours.
Daily records: check-in and check-out times, who picked the child up, meals and fluids, naps, diapering and toileting (including potty-training plans and accident records), outdoor play, sunscreen and topical care, observations, and free-text notes staff write.
Photos of the child, taken by staff or shared in messages.
Health information: allergies and allergy plans, medications and medication consents, doses actually administered, immunization records, medical statements and exam dates, physician/dentist/preferred-hospital details, special needs and early-intervention/therapy indicators, and emergency-treatment consents.
Incident reports: what happened, injuries, treatment given, which caregivers and witnesses were involved, when parents were notified, and whether the state licensing office was notified.
Billing records: rates, attendance-derived charges, invoices, payments, and subsidy status.
Documents uploaded to the child's file, and text extracted from them.

This also applies to a child a center has placed on its waitlist but has not yet enrolled — a waitlisted child's name, date of birth, and requested classroom are held for the same purposes until the family is enrolled or the center removes them.

A child never uses WeBlossom directly and never has an account. Everything above is entered by an adult — their guardian or the center's staff — as part of enrolling in and attending that center.

Information about parents and guardians

Name, email address, phone number, relationship to the child, which children you're linked to, your notification and location preferences, the messages you send and receive in the app, and your payment activity.

Card details are entered directly into our payment processor, Stripe, and are handled under Stripe's own terms — WeBlossom never receives or stores a full card number.

If your center uses the front-desk Kiosk for check-in/check-out, you can set a PIN there to verify it's you. We store it the same way we'd store a password — as a one-way hash, not as plain text.

If a center offers tours, we also hold the name, phone number, email address, and any scheduling notes for a family that books one — whether or not they go on to enroll. This is used only to schedule and confirm the tour and to let the center follow up.

Information about staff and admins

Beyond the obvious (name, email, phone, role, classroom assignment, hire and departure dates, work schedule), WeBlossom holds what New York's child care licensing forms actually require a center to collect about the people it employs. Depending on which forms a center uses, that can include:

Social Security number, or Alien Registration number if you don't have one — encrypted before it's ever stored, and held to a stricter standard than everything else in this section (see below).
Date of birth and gender.
Home address and previous addresses.
Any other names you've been known by, including maiden, alias, or married names.
Criminal history questions — specifically, whether you have been convicted of a crime in New York or any other jurisdiction.
Education, training, and prior employment history, and your professional references' names, titles, and contact details.
For home-based programs, the names and ages of household members, including those under 18.
Background-check status, training records and certificates, and completed state onboarding forms with your signature on them.
Time-clock records: clock-in and clock-out times, and the GPS coordinates and distance-from-center captured at each of those moments, which are stored on the time entry itself.

This is among the most sensitive information in the app. Everything above is restricted to admins at your own center. Your Social Security/Alien Registration number specifically gets an extra layer: it's encrypted rather than stored as plain text, only an admin or you yourself can view it (a colleague at your own level cannot), and viewing an already-saved one requires re-entering your own password first. The saved copy of that form is itself password-protected too, so even the underlying file can't be opened without a password known only to our systems.

Information about other people

Some records necessarily name people who don't have a WeBlossom account and never signed up for one — emergency contacts and authorized pickup persons (name, relationship, address, phone, email), a staff member's professional references and household members, and witnesses named in an incident report.

Whoever enters this information — the center or the family — is responsible for having the right to provide it. We use it only for the purpose it was given for: reaching the right person in an emergency, verifying a pickup, or completing a state-required form.

Location

WeBlossom uses location in two specific ways, both optional and both controllable in your device's settings:

Staff clock-in/out: when a center turns on its clock-in boundary, your location is checked at the moment you clock in or out to confirm you're on-site. The coordinates and your distance from the center are saved on that time entry.
Smart pickup alerts: only if a parent turns this on, WeBlossom watches for your device arriving near the center so it can remind you to sign your child in or out. This one runs in the background — meaning it can wake the app when you arrive even if you don't have WeBlossom open — and requires "Always" location permission. Turning it off in Settings stops it.

WeBlossom does not build a location history or track anyone's movements outside these two moments.

Voice dictation and speech recognition

Staff can dictate activity notes and attendance actions instead of typing. Please read this section carefully, because more than one system may be involved:

The first pass uses your device's own built-in speech recognition (Apple's on iOS, Google's on Android). Depending on your device, its settings, and the language, that system may process the audio on the device or send it to Apple's or Google's servers — that choice belongs to the operating system, not to WeBlossom, and is governed by Apple's or Google's own privacy policy.
To improve accuracy, WeBlossom supplies a short list of hint words to that recognizer, which includes the first names of children enrolled at your center.
If you allow it and your center hasn't turned it off, your voice is also streamed to ElevenLabs (Scribe v2 speech-to-text) as you speak, for a faster, more accurate transcript, and that transcript is the one used. Enrolled children's first names and classroom names are sent along as context so those names transcribe correctly. ElevenLabs processes, and may store, the audio and transcript under its own privacy policy and retention terms. If ElevenLabs can't be reached, your device's own transcript is used.
The resulting text is shown to the staff member to review before anything is saved. For activity notes and attendance, WeBlossom does not retain the audio recording after transcription finishes. Voice messages retain the audio and shared language transcripts in the conversation. After sending, recordings are processed by Google (Gemini) to generate transcripts and translations — only if the sender has allowed cloud transcription and the center has not turned it off. Both participants can reveal the same saved language versions; only people who can access that conversation can play its recordings or read its transcripts.
Searching your activity log by voice works the same way at first — your device tries to understand the request on its own. If it can't confidently work out what you're asking for, the spoken text (not audio) is sent to Google's Gemini along with your center's roster of first names, so it can correctly match a name in your request to a child. This is text, not audio, and only when the on-device parser can't resolve the request itself.

Nothing in this section is sent to Google or ElevenLabs until you allow it. WeBlossom asks the first time one of these features would use the cloud, and you can change your answer anytime in Settings under "Cloud transcription." A center can also turn cloud transcription off for everyone.

If a center would rather not have voice audio leave the device at all, staff can simply type instead — every voice feature has a manual equivalent.

On-device intelligence features

A few features analyze content directly on the device using Google's ML Kit, without sending that content to WeBlossom or to Google:

Scanning a document (an immunization record, medical statement, or training certificate) reads the text off the image so fields can be pre-filled.
Message translation and suggested quick replies read message text on the device to produce a translation or a suggestion.
Photo face detection finds face shapes in a picture so staff can blur other children before sharing it. It detects that a face is present — it cannot recognize whose face it is.

These features may download a language or model file from Google the first time they're used.

Photos, documents, and signatures

WeBlossom uses your camera and photo library only when you choose to take or attach a photo or scan a document. Digital signatures you draw — on enrollment, consent, and state forms, medication administration and safety-inspection records, or a kiosk check-in/check-out — are stored as images and, where the form is generated as a PDF, embedded into it as part of the child's or staff member's file.

Messages, edits, and read receipts

Messages between staff and families are stored so both sides keep a record of the conversation. Two things are worth knowing:

Editing or deleting a message keeps a copy of the previous version. This is deliberate — it's what makes a billing or medical conversation trustworthy after the fact, and admins at your center can view it. A deleted message disappears from the thread but is not erased from the record.
WeBlossom tracks when each person last read a conversation, which is what "seen" indicators are based on.

Calendar integrations

WeBlossom can put your center's dates into the calendar app you already use. There are five ways this can happen, and each one shares only what is described here.

Calendar subscription links. If your center has turned this on (it is off unless the center chooses it), you can create a private link in Settings → Calendar sync and add it to Apple Calendar, Google Calendar, Outlook, or another calendar app. Your calendar app then fetches the link from WeBlossom's servers on its own schedule to stay current.

What a link includes depends on your role and the categories you pick: center closures, conferences, fire drills and inspections, tours, approved time off, your child's scheduled attendance days and approved vacations, bill due dates (optional, and only the date — never an amount), custody days (only if your center turns this on for your child, and only your own household's days), your own published shifts, and compliance deadlines such as an expiring form or training certificate.
Event titles use a child's full name by default (for example, "Ava Martinez · Daycare"), and some staff and admin events name a staff member. Turn on "Private titles" for a link and its events leave names out. Notes, health details, the reason for someone's time off, and a touring family's phone number or email are never included.
The link works like a password: anyone who has it can see those events without signing in. Keep it to yourself. If it may have been shared, tap Reset link (this makes a new link and stops the old one working) or Delete in Settings → Calendar sync. A link also stops working if you lose access to the center or the child, or if the center turns the feature off.
WeBlossom stores each link's settings, a one-way hash of its secret part (not the link itself), and when and how often it was last fetched. Our hosting provider's server logs record the full link each time a calendar app fetches it; those logs are kept only for the provider's standard log-retention period, and only the WeBlossom personnel who operate the service can see them.
Once events reach your calendar app, that copy is held by Apple, Google, Microsoft, or whichever calendar provider you use, under its own privacy policy. Deleting a link stops updates but may not remove events already copied; remove the subscribed calendar in your calendar app to clear them.

"Add to Calendar" button. This adds one event — a conference, tour, or closure — to your phone's calendar through your phone's own add-event screen, or as a calendar file you save or share if that screen isn't available. It only adds: WeBlossom never reads, changes, or deletes anything in your calendar, and nothing about your calendar is sent to WeBlossom. On older versions of iOS, your phone may ask for wider calendar permission before showing that screen; WeBlossom still only adds the one event.

Tour confirmation invites. If a center turns this on, a tour confirmation or reschedule email can include a calendar invite (an .ics file) so the tour can be added in one tap. The invite carries only what the email itself already shows, and is delivered by Resend with the email.

Holiday import (admins). An admin can have WeBlossom suggest closures from a standard New York and federal holiday list, or from a school district's calendar link that the admin provides. WeBlossom's servers fetch that link only to read event names and dates and propose closures; nothing is closed until the admin approves it, and no personal information is sent to the district's site. WeBlossom keeps the saved link until an admin clears it, but does not store the downloaded calendar.

Connecting a Google or Microsoft account. Where this is turned on for your center, staff and admins — and, once it is also turned on for families, parents — can connect their own Google or Microsoft account so their WeBlossom events appear in that calendar directly. Connecting is always optional.

Google: WeBlossom asks for two permissions. "calendar.app.created" lets WeBlossom create its own calendar named "WeBlossom" in your account and add, change, and remove events in that calendar only; it gives no access to your other calendars or events. "calendar.freebusy" lets WeBlossom see only when you are free or busy — start and end times, with no event titles, attendees, or details — so it can offer tour times that don't clash with your schedule.
Microsoft: WeBlossom asks for "Calendars.ReadWrite" (to create the "WeBlossom" calendar and manage the events in it), "Calendars.ReadBasic" (to check when you are free or busy for tour booking), "offline_access" (so the connection keeps working without signing in again), and "User.Read" (your name and email address, so the app can show which account is connected). Microsoft doesn't offer a permission limited to one calendar, so these technically allow more than WeBlossom does: WeBlossom only writes to the calendar it created, and uses your availability only for tour booking.
What goes into the WeBlossom calendar: the same events, titles and choices as a calendar link with the same settings (see "Calendar subscription links" above). For a parent that can include your child's full name, scheduled attendance days, approved vacations, conferences, center closures, and — only if you choose them — bill due dates (the date only, never an amount) and custody days (only if your center turns this on for your child, and only your own household's days). Turn on "Private titles" to leave names out. Once written, that copy is stored by Google or Microsoft under their own privacy policies, and anyone you share that calendar with in Google or Outlook can see it.
For a parent, if you lose access to a child or to the center, or a category is no longer allowed (for example, your center stops sharing custody days), WeBlossom removes the events it added on its next update, usually within a few minutes. If the feature itself is turned off for your center, WeBlossom stops updating the calendar but does not remove what is already there. To remove everything, disconnect in the app and choose to remove the WeBlossom calendar; if you delete the WeBlossom calendar yourself while still connected, WeBlossom creates it again on its next update.
Free/busy is used only for staff members who choose to share it for tour booking and whom an admin includes. A parent's availability is never checked.
WeBlossom never reads the content of your own events — their titles, descriptions, attendees, or attachments — and doesn't keep a copy of your free/busy information beyond working out which tour times to offer.
Information WeBlossom receives from Google or Microsoft is used only to provide these calendar features. It is never used for advertising, never sold, never used to train AI or machine-learning models (ours or anyone else's), and never transferred to anyone else except as needed to provide these features or as required by law. No one at WeBlossom reads it unless you ask us to (for example, in a support request), it is needed for security (such as investigating abuse), or the law requires it.
The access tokens Google or Microsoft issue to WeBlossom are stored encrypted on WeBlossom's servers. Disconnecting in the app deletes them and offers to remove the WeBlossom calendar from your account. You can also revoke WeBlossom's access at any time from your Google Account or Microsoft account settings, after which WeBlossom can no longer reach your calendar.

WeBlossom's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. This also covers the optional Google Drive backup listed below.

How long calendar information is kept. A calendar link's settings stay with your account like your other account records (see "How long we keep information"); resetting or deleting a link stops it working on the next fetch, and the link itself is never stored. A saved school-district link is kept until an admin clears it. Google or Microsoft tokens are kept only while your account is connected and are deleted when you disconnect.

Information collected automatically

A device token used to deliver push notifications to your phone, and, if the app crashes or hits an error while you're signed in, a report containing the error itself, a technical stack trace, and your app version and device platform — tied to your account so we can investigate it, and used for no other purpose. WeBlossom includes no third-party analytics, advertising, or tracking software.

How we use this information

Only to operate the features a center and its families actually use: attendance and daily-activity records, health and medication recordkeeping, billing and payments (including keeping a center's own QuickBooks books up to date, if its admin connects them), messaging, compliance and state-form generation, staff scheduling, time tracking, and safety notifications (including weather-based outdoor-play alerts).

We do not sell personal information. We do not share it with data brokers or advertisers. We do not use children's information for advertising, and we do not use your data to train our own machine-learning models.

Service providers we share with

We share information only with the providers that make the app work, each only for that purpose:

Supabase — database, file storage, sign-in, and password-reset emails.
Cloudflare — storage for activity photos.
Stripe — card payments and payouts to a center. WeBlossom never sees a full card number.
Resend — transactional email: registration invites, staff invites, tour confirmations, center onboarding, and billing emails (invoice ready, payment reminders, overdue notices, payment received/failed, dispute opened, and monthly statements).
Expo, Apple, and Google — delivery of push notifications.
Apple / Google — device speech recognition, as described above.
Google (Gemini) — voice message transcription and shared translations, plus activity-log searches.
ElevenLabs (Scribe v2) — live transcription of voice dictation for activity notes and attendance.
US National Weather Service and US EPA AirNow — current weather, snowfall forecasts and air quality for a center's configured location, so outdoor-play safety and closure alerts work. Only the center's location is sent; no personal information. A place name an admin types for that location is looked up with Google.
Google Drive or Dropbox — only if a center's admin explicitly connects one, to keep the center's own copy of files already stored in WeBlossom. WeBlossom never receives that account's password; the connection is authorized directly with Google or Dropbox.
Google Calendar or Microsoft Outlook — only if you connect your own account, to add your WeBlossom events to a calendar WeBlossom creates there, and for staff who opt in, to check free/busy times for tour booking (see "Calendar integrations" above). WeBlossom never receives that account's password; the connection is authorized directly with Google or Microsoft.
Intuit (QuickBooks Online) — only if a center's admin explicitly connects the center's own QuickBooks company, to keep the center's books in step with its WeBlossom billing. See "QuickBooks Online" below for exactly what is sent and read.

We may also disclose information if required by law, or where necessary to protect the safety of a child, a staff member, or the public — including reporting obligations a center may have to state licensing or child protective authorities.

QuickBooks Online

A center's admin can choose to connect the center to its own QuickBooks Online company (a product of Intuit Inc.), so that WeBlossom's billing records also appear in the center's books. Nothing is sent to QuickBooks unless an admin connects it, and only admins at that center can connect, change, or disconnect it.

What WeBlossom sends to QuickBooks: a customer record for each paying family or subsidy agency (the payer's name, email address, phone number, and billing address, and the center's name); an invoice for each child's billing period (the child's name, the charges, amounts, and dates); and the payments, refunds, credits, chargebacks, and card-payment deposits and fees that go with them. Health records, attendance details, photos, messages, and staff records are never sent.
What WeBlossom reads from QuickBooks: the company's name and its accounts, products and services, classes, locations, and payment terms, so an admin can choose where each kind of charge is recorded; its existing customers, so a family already in the books is matched instead of duplicated; and the entries WeBlossom itself sent, to check they still match and report any difference.
How it's used: only to keep that center's books in step with WeBlossom and to show that center's admins the sync status and a reconciliation report. Information from QuickBooks is never sold, never used for advertising or to train machine-learning models, and never shown to anyone other than the admins of the center (or centers) connected to that QuickBooks company.
How the connection is protected: the admin signs in to Intuit directly, so WeBlossom never sees the QuickBooks password. The access tokens Intuit issues are kept only on our servers, encrypted at rest, and never sent to the app.
Disconnecting: an admin can disconnect at any time in Settings → Billing → Integrations, or by removing WeBlossom from the Apps page in QuickBooks. Disconnecting stops all syncing, revokes WeBlossom's access with Intuit, and erases the stored tokens. WeBlossom never deletes anything in QuickBooks: what was already sent stays in the center's QuickBooks company, under the center's own agreement with Intuit. WeBlossom keeps a record of which QuickBooks entry matches which WeBlossom record as part of the center's billing records; routine sync logs are deleted after 90 days.

Where information is stored

WeBlossom's database and files are hosted in the United States. Some providers listed above may process information outside the United States.

How long we keep information

A center's records are kept while its account is active, plus a period afterward to satisfy New York child care record-retention requirements, which for some records extend for years after a child leaves or a staff member departs.

An individual can deactivate or permanently delete their own account at any time from Settings, in the app (see "Your choices and rights" below). A center's admin can ask us to close the center's own account entirely by writing to support@weblossom.today. In every case we act on the request except where a record must be retained by law, or where removing it would destroy a record the center is separately required to keep.

Calendar links and connected calendar accounts have their own rules, described under "Calendar integrations" above.

Security

Access rules are enforced on our servers, not merely hidden in the app's screens: a parent can only reach their own child's records, and a staff member only their own center's. The most sensitive stored values — a Social Security/Alien Registration number, or a connected cloud-backup or QuickBooks account's access token — go further still: they're encrypted at rest, not just access-restricted, so even a direct look at the underlying data shows unreadable ciphertext rather than the real value. A Social Security number additionally requires re-entering your own password before it's ever shown on screen, and the saved government form that carries it is separately password-protected as its own file, so even that copy can't be opened without a password.

A small number of WeBlossom personnel can access stored data when necessary to operate the service, investigate a problem, or respond to a support request — encryption here protects against unauthorized access through the app itself (a colleague browsing, a leaked credential, a raw copy of the data), not against WeBlossom's own database administrators, who retain the technical means to operate the systems that hold the encryption key. No system is perfectly secure, but this is not an afterthought here.

Children’s privacy

WeBlossom is a tool for child care professionals and for a child's own parents or guardians. Children do not create accounts, sign in, or use the app, and we do not knowingly collect information directly from a child. Everything WeBlossom holds about a child is provided by that child's guardian or by the center's staff, in the course of the child attending that center.

Your choices and rights

Reviewing or correcting a child's records: contact your center, which controls what's on file.
Location and microphone access: change or revoke these at any time in your device's system settings; pickup alerts and activity-post notifications also have their own switches in the app's Settings.
Notifications: turn them off in Settings or at the system level.
Calendar links and connected calendars: reset or delete a calendar link anytime in Settings → Calendar sync. If you have connected a Google or Microsoft account, you can disconnect it in the app or revoke it from that account's own settings.
Deactivating your own account: Settings → "Deactivate my account" signs you out but keeps everything exactly as it was — sign back in anytime to pick up right where you left off. Nothing is removed.
Permanently deleting your own account: Settings → "Delete my account permanently." This removes your name and email from your account and signs you out for good — you won't be able to sign back in as yourself. It does not delete your center's own business and compliance records (activity logs, messages, billing, staff files); those stay, attributed to an anonymized account, for as long as the center is required to keep them. If you're the only admin keeping a center running, you'll need to add another admin first (Settings → Manage Center Access).
Anything else about your own information, or if you're outside the app and can't reach these controls: write to support@weblossom.today. Depending on where you live, you may have additional rights under your local law, and we'll honor those where they apply.

Changes to this policy

If this policy changes in a way that matters, we'll tell you in the app before the change takes effect, and update the effective date above.

Contact us

Questions, requests, or complaints about this policy can be sent to support@weblossom.today.

Privacy Policy