Privacy & data handling
Website notice · Version 3 · October 18, 2026
Little Bears Academy LLC uses this website to manage enrollment inquiries and, for authorized accounts, daycare records and communication. Arbay Hassani is the Business Owner. This notice describes the features currently implemented; it is not a certification of regulatory compliance.
Information collected
- Public inquiries: parent or guardian name, email, optional phone and age group, and the message you choose to submit.
- Private child records: names, birthdays, classroom assignments, care notes, allergies, emergency contacts, authorized pickup people, attendance, confirmed schedules, reported absences, proposed emergency-contact and pickup changes, activities, daily reports, permitted photos, and documents entered by authorized users.
- Administration: account email and role, staff time entries, onboarding and training completion references and renewal dates, invoice and manually recorded payment details, messages, backup-status metadata, and an audit history of supported changes.
Do not include medical records, government identifiers, payment-card numbers, or other sensitive details in the public inquiry form. It does not confirm an opening, reserve a place, or finalize enrollment.
Why information is used
Information supports inquiry follow-up, child-specific care records, family communication, attendance, staff administration, billing records, and access protection. Public inquiry submissions are saved for administrator review. Account invitation and recovery email may be sent through Brevo when the service is configured and approved. Text and push delivery are not available.
Who can access private records
A signed-in account must also be authorized by the academy. Parents are limited to children assigned to their account. Staff access is limited by their classroom assignment and role. Business owners and administrators have broader management access. An account invitation must use the person’s own email address, with the correct child or classroom assignment.
Sign-in and hosting
The academy offers its own email-and-password sign-in for invited parents, staff, administrators, and the Business Owner. Passwords are stored as salted, one-way hashes. Existing verified administrator sign-in remains available during the transition to avoid lockout. Hosting, database records, and private file storage use ChatGPT Sites and its Cloudflare-backed infrastructure. Review the OpenAI Privacy Policy for hosting-provider information.
Photos and documents
Photo permission must be recorded before a photo is uploaded for a child. Staff can choose whether an uploaded item is shared with that child’s authorized parents. A family may ask the administrator to change photo permissions or sharing. The academy must obtain permission for every recognizable child in a group photo before sharing it; the software’s child assignment alone does not establish that permission.
Care forms and sensitive records
The secure portal may hold versioned permission forms, guardian verification attestations, electronic signing consent, authenticated signer identifiers, signed copies, incident reports and acknowledgments, medication authorizations, and administration records. Medication recording requires director policy review and specifically qualified staff permissions. Incident receipt acknowledgment is not a liability waiver. Direct-care supervision records are separate from clock-in records.
Electronic signing is optional; request a paper method from the academy. The academy must independently verify guardian identity and authority. Access, download, correction, approval, and supported signing events are recorded in the audit history. Signing reminder emails, when configured and consented to, contain only a prompt to sign in; delivery provider acceptance is not a guarantee of delivery.
Account email
When invitation and recovery email is enabled, Brevo processes recipient email addresses and account setup or recovery links to send these messages. Account emails do not include children’s medical, attendance, or financial records. Replies go to the academy’s configured reply-to mailbox. Provider acceptance does not establish delivery.
Academy account security
Parents and staff can use academy email-and-password sign-in without ChatGPT. Passwords are stored as salted, one-way hashes; the academy cannot read them. Setup and recovery links are private, one-use credentials. Administrators verify the recipient before sharing a link. Automatic invitation and recovery emails require a verified sending-service connection; availability is shown in the account screens. Password sessions expire after 8 hours. Password changes and recovery revoke existing academy password sessions. Existing verified administrator access through ChatGPT remains available for recovery and keeps its original provider session controls.
Account security events are logged. Protected database backups include password hashes so account credentials can be recovered; active sessions and setup links are excluded. Only authorized administrators may download these backups and must store them securely.
Operational metadata
The public inquiry form uses a hashed network identifier to limit repeated submissions. The application also stores timestamps and audit records needed for supported administrative changes. Hosting and sign-in providers may process their own operational metadata under their policies.
Retention, archiving, and backups
Archiving a profile or file does not permanently erase it. Database checkpoints are updated after supported changes, and newly uploaded files receive an additional protected copy in the same storage account. Administrators can download a database and file backup. Separate external scheduled backups are not configured. The academy must confirm its record-retention and deletion policies before routine operational use; backups and audit records may retain earlier information.
Questions, corrections, and access requests
Enrolled families can contact the administrator through the private portal. Prospective families can use the enrollment inquiry form to ask for a direct contact channel. Keep the initial request general and do not submit sensitive child information publicly. The administrator can review requests to correct records, change account access, or review photo sharing.