Incident response & data retention

Last updated September 2026

Security incident response

A security incident means unauthorized access, disclosure, alteration, or loss of personal information we process for DailyDotKids, or a serious availability event that puts centre data at risk.

How we handle it

1. Detect & contain — investigate alerts, revoke compromised access, isolate affected systems where needed.
2. Assess — determine what data and which centres may be affected.
3. Notify — inform affected centre owners/admins without unreasonable delay once we confirm a breach involving their personal information, and provide what we know: nature of the incident, data categories (if known), steps we are taking, and recommended actions for the centre.
4. Remediate & learn — fix the root cause, rotate credentials if required, and document follow-up.

Notification targets

• Acknowledge a confirmed centre-impacting incident to the centre’s primary admin contact within 72 hours of confirmation (sooner when practical).
• Updates as material facts change until the incident is closed.
• Centres remain responsible for notifying parents or regulators when their policies or law require it; we will cooperate with reasonable information requests.

How to report a concern

Email hello@dailydotkids.ca with subject line Security incident, or call +1 236-862-1951. Include daycare name, what you observed, and approximate time.

Data retention

Unless a longer period is required by law or a written agreement with the centre:

• Active centres: We keep operational records while the centre uses DailyDotKids.
• After a centre closes or asks to leave: We retain records for up to 90 days to allow export or reactivation requests, then delete or irreversibly anonymize personal information from production systems, except where we must keep limited records (for example billing disputes, security logs, or legal holds).
• Individual account deletion: Follows the process in our Privacy Policy. Shared centre history needed by remaining users may stay until the owner requests centre closure.
• Backups: Deleted data may remain in encrypted backups for a limited rolling window until those backups expire.
• Security and technical logs: Kept for a limited period (typically up to 12 months) for abuse prevention and troubleshooting.

Export & deletion requests

Centre owners may request an export or deletion by emailing hello@dailydotkids.ca. We verify authority (owner/admin) before acting. We aim to complete routine verified requests within 30 days.

Related

Security & data residency · Privacy Policy · DPA · Subprocessors