How Pebli processes child and family data for your daycare

1. Subject matter and duration

Pebli provides software for enrollment, attendance, daily care logs, family communication, and related daycare operations. Processing lasts for the term of your subscription and any retention period required by your instructions or by law. This DPA applies to personal data you enter or collect through Pebli about children, parents, and staff.

2. Roles

• You (the daycare operator) are the controller of child enrollment, health, attendance, media, and family communication data you enter.
• Nexo Labs LLC (Pebli) is the holder/processor of that data, acting only on your documented instructions, including these Terms, this DPA, and in-product settings.
• Pebli is the controller of parent, staff, and admin account data (login, contact details, device and usage data) needed to operate the accounts themselves.
• Parents are data subjects. They may also be users of the parent app under Pebli's controller role for their own account.

3. Types of personal data

The nature of the processing is hosting, storage, display, messaging, backup, and optional AI insights tooling. Specially sensitive information under Israeli law is included when you enter it.

4. Pebli's duties as processor

• Process child and family data only on your instructions and not for our own marketing.
• Keep personnel with access under confidentiality duties.
• Apply technical and organizational security measures: encryption in transit, role-based access, monitoring, and backups.
• Not send Israeli ID numbers or health fields to Anthropic or other AI vendors. Optional daily insights may use care-activity metrics only.
• Help you respond to data-subject requests (access, correction, deletion) that relate to data we hold for you.
• Notify you without undue delay after becoming aware of a personal-data breach affecting data we process for you, and provide information reasonably needed for you to meet legal notice duties.
• Delete or return child and family data at the end of the contract when you instruct us, except data we must keep by law or that belongs to a remaining controller account.
• Make available information reasonably necessary to demonstrate compliance and allow audits agreed in writing, subject to confidentiality and the security of other customers.

5. Your duties as controller

• Have a lawful basis to enter and use the data, including parental or guardian consent before entering a child's Israeli ID number or allergies.
• Give parents the notice required by Israeli privacy law (purpose, controller identity, rights) when you collect data.
• Collect and keep media consent before sharing photos or videos of a child.
• Limit staff access to people who need the data for care.
• Not instruct Pebli to process data for a purpose incompatible with daycare operations or this DPA.
• Handle parent requests that you, as controller, must answer (for example correcting a child's allergy record in the dashboard).

6. Sub-processors

You authorize Pebli to use the following sub-processors. We will give notice of material changes. Current typical regions are listed in the vendor list; processing may occur in the United States.

• Amazon Web Services - hosting, media storage, infrastructure
• Google Firebase - analytics, push messaging, crash reporting
• Twilio - SMS one-time passcodes
• Stripe - B2B subscription payments
• Anthropic - optional daily insights from care-activity metrics only (not ID numbers or health fields)
• Meta - marketing pixel on the public marketing site only, with cookie consent

7. International transfers

Sub-processors may store or process personal data in the United States or other countries. Where required, Pebli uses contractual safeguards. Transfers of Israeli personal data abroad remain subject to the Protection of Privacy Law and its regulations. We do not transfer Israeli ID numbers or health fields to Anthropic.

8. Breach notification

If we become aware of a personal-data breach affecting data we process for you, we will notify the daycare's account contacts without undue delay and provide facts reasonably available (nature, categories of data, likely consequences, and measures taken). You remain responsible for notices to the Privacy Protection Authority and to data subjects when the law requires you, as controller, to give those notices.

9. Deletion and return

During the contract you can correct or deactivate child records in the product. At contract end, email privacy@pebli.app to request deletion or export of daycare-held child and family data. Parent and staff accounts they still use are not bulk-deleted solely because the daycare subscription ends, except as the product and privacy tools provide. Legal holds and backup cycles may delay complete erasure.

10. Order of documents

This DPA is part of the Terms of Service. If this DPA conflicts with the Privacy Policy on controller/processor roles for child data, this DPA prevails for B2B processing. Israeli mandatory privacy law prevails over this DPA where they conflict for processing in Israel.