Privacy Policy

Journey Childhood Learning (“we,” “us,” or “our”) operates the childcare center known as Journey Childhood Learning and the associated website and parent portal. This Privacy Policy explains what information we collect, how we use and share it, how long we keep it, and the rights you have. It applies to families, prospective families, staff, and visitors to our site.

1. Information We Collect

We collect information you provide to enroll in and receive childcare services, including:

• Guardian/parent information: name, email, phone, mailing address, and account credentials.
• Child information: name, date of birth, emergency and authorized-pickup contacts, health, allergy, dietary, and care notes, attendance, program/enrollment records, and any documents or photos uploaded to your child’s records — all provided by a parent/guardian or authorized staff.
• Payment information: tuition, deposits, and fees are processed by our payment processor (Stripe). Card details are entered directly into Stripe’s secure fields and are not stored on our servers. We may retain non-sensitive records such as amount, date, status, card brand, and last four digits.
• Technical/usage information: device and browser information, IP address, and log data used to operate and secure the site (see our Cookie Policy).

2. How We Use Information

We use your information only to provide and administer the childcare service: to process enrollment, tuition, and deposits; to schedule tours; to communicate with families; to document and deliver care; to maintain safety; and to meet legal, licensing, tax, and accounting obligations. We do not sell personal information, and we do not use children’s information for advertising.

4. How We Share Information — Sub-processors

We share information only as needed to operate the program, and only with service providers bound by contract to protect it. We do not sell personal information. The sub-processors we rely on are:

• Stripe — payment processing for tuition, deposits, and fees (card payments). See stripe.com/privacy.
• Plaid — bank-linking for ACH is not currently enabled on this site; no bank-account data is collected or transmitted to Plaid at this time. If ACH is enabled in the future, this policy will be updated and Plaid’s privacy notice (plaid.com/legal) will apply.
• Email/SMTP provider — delivery of transactional email (enrollment, tour, and account notices).
• Hosting/infrastructure provider — secure hosting of the application and its database.

We may also disclose information where required by law, court order, or licensing authority, or to protect the safety of a child, our families, or the public.

5. Data Retention

We keep personal information only for as long as it is needed for the purpose it was collected, and then securely delete or de-identify it. As general guidance:

• Child & family care records are retained while your child is enrolled and afterward for the period required by Maryland child care licensing regulations (COMAR 13A.16).
• Financial & payment records are retained as required by tax and accounting law (generally up to seven years).
• Prospective-family inquiries and tour requests are kept only as long as needed to respond and for a reasonable follow-up period, unless you enroll.
• Website/technical logs are kept for a short period for security and troubleshooting.

6. Your Privacy Rights

Depending on where you live, you may have the right to access, correct, delete, or receive a portable copy of your personal information, and to opt out of the “sale” or “sharing” of personal information (we do not sell or share it for cross-context behavioral advertising). California residents have these rights under the CCPA/CPRA and will not be discriminated against for exercising them. Individuals in the EU/EEA/UK may exercise equivalent rights of access, rectification, erasure, restriction, portability, and objection. To make a request, contact us using the details in Section 10; we verify identity before responding.

Maryland residents. Under the Maryland Online Data Privacy Act (MODPA), you may confirm whether we process your personal data and access, correct, or delete it, obtain a portable copy, and opt out of any sale of personal data, targeted advertising, or certain profiling. We do not sell personal data, we do not use it for targeted advertising, and we do not use children’s data for advertising or profiling. We treat a child’s information as sensitive data and collect only what is strictly necessary to provide care. To exercise a right, contact us using the details in Section 10; we respond within the time required by law and will not discriminate against you for exercising a right. If you believe we have not resolved your request, you may contact the Maryland Office of the Attorney General, Consumer Protection Division, at (410) 576-6300.

Opt-out preference signals. Because we do not sell personal information or use it for cross-context behavioral advertising, there is nothing to opt out of for that purpose; even so, we honor recognized browser opt-out signals such as the Global Privacy Control (GPC) where applicable.

7. Security & Breach Notification

We use administrative, technical, and physical safeguards, including encryption of sensitive personal information at rest (AES-256) and in transit (TLS 1.2+), role-based access controls, and authentication on sensitive operations. Card data is handled inside Stripe’s PCI-compliant environment and does not touch our servers. If a breach affecting your personal information occurs, we will notify affected individuals and authorities as required by applicable law.

8. Cookies

We use strictly necessary cookies to operate the site and optional analytics cookies only with your consent. Manage your choices via the “Cookie Preferences” link in the footer or read our Cookie Policy.

9. Google Account Access (Email Sending)

The centre may connect one of its own Google accounts so that notices from this site — enrollment updates, document reminders, payment notices and scheduled reports — are sent from the centre’s mailbox. This connection is made by a centre administrator and is never requested from parents, staff or any other visitor.

When that connection is in use we request only the permission to send mail on that account’s behalf(gmail.send) and to read the address of the account that granted it (userinfo.email). We do not request, and cannot obtain, permission to read, search, download or delete messages in that mailbox.

We store only the authorisation tokens Google issues and the address of the connected account. Tokens are encrypted at rest and are used for no purpose other than sending the messages described above. This data is not sold, not shared with third parties, not used for advertising or profiling, and not used to train any model. It is deleted when the administrator disconnects the account or changes the centre’s email settings to another method.

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

10. Changes to This Policy

We may update this Policy from time to time. Material changes will be reflected by the “Last updated” date above. Continued use of the Service after an update constitutes acceptance of the revised Policy.

11. Contact

Questions or requests about this Policy? Contact: