Privacy Policy

NepiNest · Last updated: 26 September 2026

1. Who We Are and Our Roles

NepiNest is a software service for preschools and daycare centres (παιδικοί σταθμοί and νηπιαγωγεία) and the families they serve. It lets staff run the daily routine — reports, attendance, pickup, menus, announcements — and share a child's day with that child's parents, through nepinest.com and the NepiNest mobile apps.

Two data-protection roles apply. For a child's care records (daily reports, attendance, pickup, belongings, incidents, dietary/allergy/health notes, photos and class messages), the participating daycare decides why and how those records are used and acts as the data controller; NepiNest processes them on the daycare's behalf, as its processor, to provide the service. For your account, login, subscription/billing and technical/security data, NepiNest is the controller. Questions about a specific child's records are handled together with that daycare.

2. Data We Collect

• Account and membership data: name, email address, role, daycare, classroom, invitations, and account preferences.
• Child and family-link data: a child's name, date of birth, classroom, and links to authorized parents or guardians.
• Child-care records: daily reports, mood, meals, naps, activities, attendance, pickup, belongings, incidents, notes, and any dietary, allergy, medication, or health information staff enter.
• Photos and communications: report photos, class-group messages, announcements, and legacy direct-message records.
• Billing data: organization plan, invoice/subscription status, subsidies, discounts, and payment-provider identifiers. NepiNest does not store full payment-card numbers.
• Technical and security data: device type, app version, timezone, push token, IP address, user agent, authentication attempts, audit events, and error diagnostics.
• Contact-form messages: if you write to us from the form on nepinest.com, your name and email, and whatever else you choose to add (school, phone, city, number of children, message). NepiNest is the controller; we use them only to answer your request, on the basis of your consent in the form. The address you write from is not stored with the message.

Most child-care information is entered by daycare staff rather than collected directly from the child. Staff should record only information needed for care and communication.

3. Legal Basis for Processing

NepiNest does not apply one legal basis to every processing activity. Depending on the controller, purpose, and applicable law, processing may be necessary to provide a requested service or contract, comply with a legal obligation, perform a public-interest task, or pursue legitimate interests such as service security and fraud prevention. Consent is used only where the relevant controller specifically requests it and the law makes consent appropriate.

If dietary, allergy, medication, incident, or similar notes contain health data, the daycare must also establish an applicable condition for processing special-category data under Article 9 GDPR. Withdrawing consent does not affect earlier lawful processing and does not require deletion of records that must be retained on another lawful basis. Contact your daycare for the exact basis applying to its child-care records.

4. How We Use Your Data

• Authenticate users and enforce daycare, classroom, family, and staff permissions.
• Provide child-care reports, attendance, pickup, billing, photos, announcements, and communications.
• Send privacy-minimized push alerts; notification text does not include child names or message contents.
• Prevent abuse, investigate incidents, maintain audit records, diagnose failures, and protect service availability.

We do not use your data for marketing, advertising, or any commercial purpose.

5. Data Storage & Security

• Authentication tokens are stored in the device's secure enclave (iOS Keychain / Android Keystore) via Expo SecureStore.
• Sensitive mobile caches are encrypted with a per-device key and separated by account.
• Server data is transmitted through nepinest.com using HTTPS/TLS, and remote database connections verify the server certificate.
• Access controls and audit logs restrict and record staff and platform administration.

Active class-group messages and child-care records are readable by authorized service and daycare systems; they are not end-to-end encrypted. Legacy direct messaging has separate encryption code but is not the active class-chat service. No security measure is perfect; use a strong, unique password and report suspected account misuse promptly.

6. Recipients and Service Providers

We do not sell or rent personal data. Data is disclosed only as needed to authorized parents/guardians, authorized staff in the relevant daycare or classroom, platform administrators with an operational need, and service providers supporting the application.

Provider categories may include database and hosting, push-notification delivery, payment processing, email or operational error notification, backup storage, and professional security/support services. Payment providers process payment details under their own notices. Push providers receive a device token and generic alert metadata, not the underlying report or message text. Providers must be limited by contract and appropriate confidentiality and security obligations.

Some providers may process data outside the European Economic Area. Where that occurs, the responsible controller must document the destination and use an applicable transfer safeguard. Contact us for the current provider and transfer details for this deployment.

7. Data Retention

• Account deletion: a verified deletion request disables sessions and is scheduled after a 14-day recovery period.
• School-controlled records: deleting a parent's account does not necessarily delete child-care, attendance, incident, billing, or communication records controlled by a daycare. The daycare must apply its documented legal and operational retention schedule.
• Notifications: read in-app notifications are removed after 60 days and all in-app notifications after 180 days.
• Security records: login-attempt records are retained for up to 90 days; organization and platform audit logs for up to 400 days.
• Contact-form messages: deleted once the conversation needs nothing more from them, and at the latest after 18 months.
• Web server logs: the IP address, time and requested address of each request to nepinest.com are kept for 14 days, to detect and block attacks.
• Backups: deleted data may remain until encrypted backup copies rotate out under the applicable backup schedule.

Where law, dispute resolution, safeguarding, or security investigation requires longer retention, the responsible controller must document the reason, restrict access, and delete or anonymize the data when that reason ends.

8. Your Rights (GDPR)

Under GDPR you have the right to:

• Be informed about how your personal data is used.
• Access a copy of your personal data (Article 15).
• Rectify inaccurate data (Article 16).
• Request erasure where the legal conditions apply (Article 17).
• Restrict or object to processing in applicable circumstances (Articles 18 and 21).
• Portability for eligible data in a machine-readable format (Article 20).
• Withdraw consent where processing relies on consent, without affecting prior lawful processing (Article 7(3)).
• Lodge a complaint with the Hellenic Data Protection Authority (dpa.gr).

The self-service export contains core account data and is not necessarily a complete Article 15 response. To exercise a right, contact support@nepinest.com and, for daycare-controlled records, the relevant daycare. We may verify your identity before disclosing or changing data.

9. Children and Automated Decisions

NepiNest is used by adults responsible for child care; children do not create their own accounts. Daycares and parents/guardians must provide any notices or permissions required for children's data. NepiNest does not use child or parent data for advertising, profiling, or solely automated decisions that produce legal or similarly significant effects.

10. Changes to This Notice

We will update the date above and notify users of material changes through the app, email, or their daycare. Where a change requires consent, we will request it rather than treating continued use as consent.