Swift Start Privacy Policy
Contents
- Who we are
- Quick summary
- Information we collect
- How we use your information
- Who we share information with
- Children's privacy (COPPA)
- Education records (FERPA)
- How long we keep information
- Your rights
- Security
- Data breach notification
- SMS / text messaging
- Data location and international transfers
- Third-party links
- Changes to this policy
- Contact
1. Who we are
Swift Start is a childcare management mobile and web application owned and operated by RoundUp LLC, an Oregon limited liability company located at PO Box 7102, Springfield OR 97475 ("we," "us," "our"), and offered under the Swift Start brand for Swift Start early learning centers. This policy describes what information we collect, how we use it, and your rights — with special attention to information about children, which we handle under the Children's Online Privacy Protection Act ("COPPA").
If you have questions, contact us at privacy@roundupece.com or write to the address above.
2. Quick summary
- We collect information about you and your child to help your child's center provide care and keep you informed.
- We never sell your child's information. We never use your child's information for advertising.
- We share information only with service providers that need it to run the app (Stripe for payments, AWS for hosting and AI features, etc.), and we require them to use it only to provide their service to us. Section 5 lists every one of them.
- Some app features use AI. When they do, your child's name is replaced with a placeholder before the request is sent, and your child's information is never used to train an AI model. See Section 5.
- You can review, correct, export, or delete your child's information at any time from Settings → My child's data in the app, or by emailing privacy@roundupece.com.
- For users under 13, we collect personal information only after we have your verifiable parental consent.
3. Information we collect
From you (the parent or guardian)
- Name, email, phone, mailing address.
- Login credentials (we store a hash of your password, never the password itself).
- Payment method details (handled and stored by Stripe — we never see your card number).
- Messages you send to staff and other authorized users.
- Notification preferences and app settings, including SMS opt-in status.
- Device information: device type, OS version, and a device identifier used to deliver push notifications.
About your child
- Name, date of birth, room/classroom assignment (e.g., Debut, Little Loves, Evermores).
- Allergies, dietary restrictions, immunization records, and other health information your child's center asks you to provide.
- Emergency contacts and pickup-authorized adults.
- Attendance records (check-in / check-out times).
- Daily care logs (feeding, nap, diaper / bathroom, mood).
- Developmental observations and portfolio entries.
- Photos and videos taken by staff, subject to the media permissions you set.
- Incident reports (injuries, illnesses, behavior).
- Messages exchanged between you and staff about your child.
Automatically
- App usage data: which features you use, screen views, button taps. This data does not include your child's name or identifier. Identifiers are hashed before transmission.
- Crash reports and performance diagnostics. These contain device and OS info but not personal information about your child.
From your center's previous software
If your center moved to this app from another childcare system (for example Procare, Brightwheel or Lillio), a center administrator can import the roster they exported from it. That import can carry your child's name and date of birth, their classroom, allergies, and guardian contact details — the same information the center already held about you in that system. Importing does not email anyone, and it does not create an account for you; a center administrator invites families separately.
4. How we use your information
We use the information described above to:
- Run the app's core features (attendance, daily reports, messaging, billing).
- Deliver photos and updates from your child's care team.
- Send you push notifications and, where you have opted in, SMS messages (check-in/out, daily updates, billing reminders).
- Process payments through Stripe.
- Improve the app, fix bugs, and develop new features.
- Comply with state childcare licensing laws (ratio monitoring, incident reporting, etc.).
We do not use your child's information for advertising, profile-building beyond the app's care features, or sale to third parties.
5. Who we share information with
We share information only with:
| Recipient | Purpose | What they receive |
|---|---|---|
| Stripe | Payment processing | Your payment method, billing email, invoice amounts |
| Amazon Web Services (AWS) | Cloud hosting and processing — storage for photos, files, records, and curriculum documents (Amazon S3), reading text from photos and scans a center takes in the app — paper sign-in sheets and other licensing forms, checks recorded as payments, and printed menus (Amazon Textract), and delivering our email (SES) | Data the app stores, the scanned images, and the email we send you. A sign-in sheet shows children's names, their check-in and check-out times, and the signatures of the adults who signed them in and out. A check shows the payer's name, the amount, and the bank routing and account numbers printed on it; we keep only the amount, check number, payer and date read from it, and do not store the photo |
| AWS End User Messaging | SMS delivery (opt-in only) | Your mobile number and the message content you opted into |
| AWS Bedrock (AI features) | Generating lesson plans, development summaries, newsletters, search results and translations; answering questions in the in-app AI assistant; and Quick Log (turning a teacher's spoken note into daily-report entries) | The text of the request, which can include a child's age, allergies, developmental milestones and behavior-incident notes. Children's names are replaced with placeholders before the request is sent, and the request is refused outright if that replacement cannot be verified. The AI is not used to make decisions about your child, and your child's information is not used to train any AI model. |
| Oregon ALERT IIS (the Oregon Health Authority's statewide immunization registry) | Looking up your child's vaccination history, so the center can keep the immunization records Oregon child-care rules require. Used only when a center director looks up your child | Your child's first and last name, date of birth and our internal identifier for your child, and the center's ALERT site code. To help the registry find the right child, the director may also enter your child's middle name and sex, the mother's maiden name, your home address and phone number, and whether your child is a twin or other multiple birth; those extra details are used for that one lookup and not kept. The registry sends back the vaccinations it has on record for your child, and the director chooses which to add to your child's record. The other details the registry sends back are used only to confirm it found the right child, then discarded |
| Sentry | Crash and error diagnostics | Crash reports and device diagnostics, with personal fields removed before sending |
| New Relic | Mobile app performance monitoring | Interaction traces, network timings, device and app version. Collected only where you have opted in to analytics; off by default |
| Expo | Push notification delivery and app updates | Your device's push token, the content of notifications about your child, and standard app-update-check requests |
| Microsoft Entra ID | Staff single sign-on — staff accounts only, never parents or children | Staff work email and sign-in identity |
| Apple / Google | App distribution and push notification delivery (APNs / Firebase Cloud Messaging) | Standard platform telemetry and push routing |
Optional integrations your center's director can connect. The app also offers integrations that are off until a center administrator connects an account with that provider. When (and only when) your center connects one, it receives:
| Recipient | Purpose | What they receive |
|---|---|---|
| Intuit QuickBooks / Xero / Sage | Accounting export | Family name and billing email, invoice amounts and tuition periods |
| Mailchimp (incl. its Mandrill service) | Center newsletters and announcements | Parent name and email, plus tags such as classroom or enrollment status — never your phone number |
| DocuSign / Dropbox Sign | Electronic signatures on enrollment and consent documents | Signer name, email, and the document being signed |
| Merge / Rippling / Gusto | Staff payroll, HR, and timekeeping — staff only, never parents or children | Staff names, work emails, and timesheets |
| Canva / Adobe Express | Design tools for center newsletters and flyers | The staff account that connects them and the designs staff edit |
| Slack / Microsoft Teams | Alerting the center's own staff channel when a classroom is short-staffed or an incident is logged | The center's name, a classroom name, and how many children and staff are in that room — or that an incident was logged and in which room. Never your child's name, never a staff member's name, and never what happened. The channel belongs to your center, in its own workspace |
| Salesforce | Sending your center's enrollment inquiries into the center's own Salesforce account, so its enrollment team can follow up | When you inquire, book a tour or apply: your name, email and phone, your preferred start date, how you heard about the center, where your inquiry stands (for example, enrolled or withdrawn), and the time of any upcoming tour. Never any information about your child — not their name, age or date of birth — and never staff notes. The Salesforce account belongs to your center, and nothing is read back from it |
| Google Calendar / Outlook / Apple Calendar | Publishing the center calendar so staff and families can subscribe to it | Event titles, times and locations from the center's calendar — for example "Picture day" or "Closed for Labor Day". No information about you or your child. Whoever subscribes receives it through their own calendar provider |
| Verizon ThingSpace | Classroom environment sensors, where installed | Sensor device identifiers and readings — no personal information |
Utility lookups that carry no personal information. To show weather and air quality for your center, the app contacts Apple WeatherKit, Open-Meteo, and AirNow (EPA) with the center's location only — never yours or your child's. The food-program barcode scanner looks up scanned product barcodes against Open Food Facts and UPCitemdb. Like any internet request, these reveal the requesting device's network address, but they carry no information about you or your child.
We require every recipient to use your information only to provide their service to us, to apply appropriate security measures, and not to use it for their own purposes. We do not permit any of them to sell it or use it for advertising.
Oregon ALERT IIS is different: it is run by the Oregon Health Authority, not by a service provider of ours. The center uses it as an authorized child-care user under its own agreement with the Oregon Health Authority, which holds registry records under Oregon public-health law.
Product analytics. We do not use a product-analytics service. The app used to include one; it was removed in August 2026 rather than kept switched off. If we ever add one, we will update this policy before it is enabled and will not send information that identifies your child.
We do not share information with advertisers or data brokers. We do not share your mobile number or SMS consent with third parties for their own marketing.
We may disclose information if required by law, in response to valid legal process, or to protect the safety of children in our care.
If the company is sold, merged, or transferred, your information will be transferred under the same protections described in this policy.
6. Children's privacy (COPPA)
We collect personal information directly from children only as part of the care services your child's center provides — for example, photos taken by a teacher, attendance recorded at drop-off, or observations of your child's development.
We collect this information only after a parent or legal guardian has accepted this Privacy Policy and we have verifiable parental consent. The current consent record is captured during account creation in the app and re-confirmed when this policy materially changes.
Your rights as a parent
You have the right to:
- Review what information we hold about your child.
- Refuse to permit further collection of your child's information.
- Request deletion of all or part of your child's information.
- Change media permissions (whether staff may take photos / videos and how broadly they may be shared).
To exercise any of these rights, open Settings → My child's data in the app, or email privacy@roundupece.com. We will respond within 5 business days and complete most requests within 30 days.
Withdrawing consent may limit your center's ability to provide some services (e.g., we can't send you daily photos if photo permission has been withdrawn). Your center will work with you on alternatives.
How we obtain verifiable parental consent
When you accept a parent invite, we present this Privacy Policy, the Terms and Conditions, and a parental-consent acknowledgement. You must affirmatively confirm that you are the child's parent or legal guardian and are 18 or older.
Today, verifiable parental consent is obtained through this in-app affirmation at account creation. If we adopt a stronger verification method in the future (such as a signed consent form or a credit-card verification step), we will update this section and notify you before the change takes effect.
7. Education records (FERPA)
If your child's center receives federal funding (e.g., Head Start, CCDF), your child's records may also be governed by the Family Educational Rights and Privacy Act ("FERPA").
Under FERPA you have the right to:
- Inspect and review your child's education records.
- Request that the school correct records you believe are inaccurate or misleading.
- Restrict disclosure of personally identifiable information from education records.
Tap Settings → My child's data to inspect what we hold, or email privacy@roundupece.com to request a correction.
8. How long we keep information
| Category | Retention |
|---|---|
| Account profile and contacts | Until you delete your account, then 30 days for backup purposes |
| Attendance records | 3 years (state licensing requirement) |
| Daily reports and care logs | 1 year |
| Health and incident records | 5 years (liability records) |
| Developmental observations | Until your child ages out of the program + 1 year |
| Photos and videos | Until your child's enrollment ends + 90 days, then auto-deleted |
| Messages | 1 year |
| Payment records | 7 years (tax and accounting requirements) |
| Anonymized analytics | 2 years maximum |
When you delete your account, we permanently remove the categories above on the schedule listed. Some records (financial records, state-licensing records) may be retained longer where the law requires.
9. Your rights
All users
- Access what we hold about you and your child.
- Correction of inaccurate information.
- Deletion of your account and your child's records.
- Data portability — a downloadable copy of your data.
- Withdraw consent at any time (SMS, media, etc.).
Exercise these rights through Settings in the app or by emailing privacy@roundupece.com.
California residents (CCPA / CPRA)
You have additional rights:
- Know what categories of personal information we collect (Section 3 above lists them).
- Correct inaccurate personal information.
- Delete personal information, subject to specific exceptions.
- Opt out of "sale" or "sharing" of personal information. We do not sell or share personal information as those terms are defined under California law.
- Limit use of sensitive personal information.
- Non-discrimination for exercising your rights.
To exercise California rights, email privacy@roundupece.com with subject "California Privacy Request."
EU / EEA residents (GDPR)
You have the rights under GDPR Articles 15–22: access, rectification, erasure, restriction of processing, data portability, objection, and rights related to automated decisions.
The lawful bases on which we process your data are: (a) contract necessity (we need this information to provide the care service you contracted for); (b) consent (for SMS and external photo sharing); (c) legal obligation (state licensing record-keeping); (d) legitimate interest (security monitoring).
We do not engage in automated decision-making that produces legal effects.
EU residents can lodge a complaint with their national supervisory authority.
10. Security
We use industry-standard safeguards including:
- HTTPS for all data in transit.
- Server-side encryption at rest for stored records (AWS-managed).
- iOS Keychain / Android Keystore for authentication tokens on your device (so even a lost phone doesn't expose your login).
- Role-based access controls so center staff see only the children in their classroom.
- A privacy-curtain overlay that hides app contents when you switch to another app.
- An idle timeout that signs you out automatically.
No security system is perfect. If you suspect your account has been compromised, contact us immediately at security@roundupece.com.
11. Data breach notification
In the event of a data breach involving your or your child's information, we will notify you without unreasonable delay and within the timeframes required by applicable law (72 hours for GDPR, 45 days for Oregon, etc.). Our internal response process is documented and rehearsed.
12. SMS / text messaging
If you opt into SMS, message frequency varies. Message and data rates may apply. Reply STOP to unsubscribe or HELP for help. Opting out of SMS does not remove you from the app or other communications. We do not share your mobile number or consent with third parties for marketing. See https://www.swiftstart.org/legal-information for the full SMS terms.
13. Data location and international transfers
The app is operated from and stores data in the United States. If you use the app from outside the U.S., you consent to the transfer of your information to the U.S. for processing. For EU/EEA users, transfers to the U.S. are made under Standard Contractual Clauses with our processors.
14. Third-party links
The app may contain links to external websites or services. This policy does not cover those services; review their own privacy policies before using them.
15. Changes to this policy
We may update this policy from time to time. Material changes will be communicated by:
- Posting the updated policy at this URL with a new "Last updated" date.
- Sending a notification through the app.
- Requiring you to re-acknowledge the policy on next app open.
Continuing to use the app after a material change means you accept the updated policy.
16. Contact
- Privacy questions: privacy@roundupece.com
- General support: inquiries@roundupece.com
- Security concerns: security@roundupece.com
- Mailing address: RoundUp LLC, PO Box 7102, Springfield OR 97475
- For California residents: subject your email "California Privacy Request"
- For EU residents: subject your email "GDPR Request"
If you are not satisfied with our response to a privacy concern, you may also:
- File a complaint with the FTC at reportfraud.ftc.gov (children's privacy)
- File a complaint with your state attorney general
- File a complaint with the U.S. Department of Education at the Family Policy Compliance Office (FERPA)
- File a complaint with your national EU supervisory authority (GDPR)
End of policy.