Privacy Policy

Last updated November 8, 2026

This Privacy Policy describes how CenterDirector LLC (“CenterDirector,” “we” or “us”) handles information when you use our child care compliance tools. It applies to account information, operational records and content submitted to the Service.

1. Information we collect

• Account and program details you provide, such as your name, email, program name, location, license type and onboarding choices.
• Records you enter, including staff or provider credentials, training, child-file checklist information, facility approvals, drills, attendance, care logs, medication records and inspection walkthroughs.
• Co-pilot questions, conversation history, responses, policy documents and other content you submit or save.
• Authentication and session information, service activity, timestamps, errors and technical diagnostics needed to operate and protect the Service.
• Product usage events, such as which pages are viewed, which features are used and plan selections during signup. These events are stored in our own database, are linked to your account when you are signed in, and do not include the contents of your records, search text or page addresses that identify individual records.
• Support correspondence and information you choose to include in a request.

2. How information is used

We use information to provide and maintain your account, store and display records, evaluate recorded dates and checklist statuses, tailor tools to your license type, generate requested AI responses, diagnose problems, protect the Service and respond to support or legal requests. We do not sell your records, and we do not sell or share personal information for behavioral advertising. The Service does not run third-party advertising or remarketing trackers.

Usage analytics. We use first-party usage events to understand which features programs rely on, find problems and improve the Service. Only our administrators can read them. We do not send them to advertising networks or third-party analytics services. If your browser sends a “Do Not Track” signal, the app does not record these events.

Cookies and browser storage. We do not use advertising or tracking cookies. The app uses your browser’s local and session storage only for strictly necessary functions: keeping you signed in, completing sign-in and password-reset steps, carrying a selected plan through signup, remembering interface preferences such as collapsed menu groups and setup progress, and grouping usage events within a single browser session. Clearing your browser storage signs you out and resets those preferences.

3. Service providers and AI processing

We rely on third-party cloud hosting, managed database, authentication and infrastructure providers to operate the Service. These providers process information only as needed to deliver those functions. An email delivery provider sends account and onboarding emails on our behalf. When we change or add providers — such as cloud hosts, AI gateway or model vendors, or email delivery services — we reflect that by updating this policy on the website rather than sending individual advance notice. If you use Google sign-in, Google also handles your sign-in under its own terms and privacy policy.

When you use the co-pilot or policy tools, the content you submit is sent to third-party artificial intelligence gateway and model providers (such as OpenAI or similar model vendors) to generate a response. This includes your question, relevant conversation context, program or license context and retrieved regulatory excerpts; policy requests can also include the text or PDF you upload. Your other records, such as staff, child, attendance or medication entries, are not sent to AI providers by these tools unless you include them in what you submit.

Saved co-pilot conversations remain in the application so you can reopen them. The model receives a limited conversation context rather than necessarily the entire saved history. Saved policy documents and results are also stored in the application.

AI service providers handle requests under their applicable terms and data policies. This policy does not promise a specific provider retention period, zero provider logging or that provider training is disabled. Removing content from your CenterDirector account does not establish that every provider copy has been removed. Contact support if you need clarification before submitting confidential information.

Automated payment collection is not currently enabled, and the app does not currently collect payment card details. We will update the relevant disclosures before introducing payment processing.

4. Child, staff and provider information

CenterDirector is business software for licensed program operators, and accounts are not intended for children. Your program — not CenterDirector — controls the records it chooses to store, and you are responsible for any permissions or notices required for the staff, provider and child information you provide. Parents, guardians and facility staff who have questions about records a program keeps should contact the program directly; CenterDirector does not act on behalf of parents, guardians or program staff or respond to third-party requests about a program's records except as required by law.

Do not include identifiable child information, sensitive medical records, passwords or financial details in co-pilot questions, policy uploads or support emails. Remove personal information before uploading documents. The app does not guarantee automatic detection or removal of sensitive information.

5. Access and security

Account records use authenticated access controls and owner-scoped database policies. This limits ordinary users to their own records; it does not prevent authorized service administration. Our team and service providers may access information when needed to operate, secure or support the Service or meet legal obligations.

Information is encrypted in transit between your device and the Service using HTTPS (TLS), and encrypted at rest in our managed database and its backups using industry-standard AES-256 encryption. Passwords are handled by our authentication provider and are not stored in readable form. Payment card details are not collected.

Encryption and access controls reduce risk, but no system can guarantee complete security or uninterrupted availability. Keep your sign-in details private and report suspected unauthorized access to support. A plain-language summary of these practices is available on our Security page.

6. Retention and your own record-keeping duties

The Service stores saved account records and history for ongoing use. There is currently no automatic account-data deletion schedule triggered by trial expiry or subscription cancellation, and no implemented 90-day post-cancellation retention period.

This does not guarantee indefinite storage or satisfy your program’s legal retention obligations. Keep independent copies of required records. Before closing your account, you can print or save your logs, rosters and inspection reports directly from the application. Available print views cover selected information, not a complete export of every account record; the Service does not offer an automated full-account data export.

7. Account closure and deletion requests

To request account closure, deletion or assistance accessing or correcting your information, email support@centerdirector.com, preferably from the email used for your account. We may need to verify your identity and authority before acting. Account deletion is handled through support, not a self-service account-deletion button.

We review and respond to verified account-holder requests within a commercially reasonable timeframe; we do not commit to a fixed turnaround deadline. Support will confirm the scope and handling of a verified request. Deletion applies to the active production database. Routine server logs and encrypted disaster-recovery backups are retained only for standard operating cycles and roll off automatically; we do not remove individual records from existing backups. Applicable legal requirements, security needs and provider retention practices may also affect what can be removed and when. Deletion can be irreversible; preserve required records before requesting it.

8. Changes

We may revise this policy as practices or features change. The revised version will be posted here with an updated “Last updated” date. Routine operational updates take effect when posted, and your continued use of the Service after posting constitutes acceptance of them.

9. Contact

Privacy questions and requests: support@centerdirector.com.