Transparency and trust for daycares and families

Pebli is a service and brand from Nexo Labs LLC. This Privacy Policy explains how we ("Pebli", "we", "us", "our") collect, use, share, and protect personal information of staff, parents, and children whose data you process through our Services. It is also the notice required under the Israeli Protection of Privacy Law, 5741-1981, including Amendment 13. By using the Pebli parent app or B2B platform, you agree to these practices. Last updated: August 2026.

Questions about privacy?

Nexo Labs LLC, a Wyoming Limited Liability Company (File No. 2025-001825198), operates Pebli. For users and daycares in Israel, Israeli privacy law applies to the processing described here. Email privacy@pebli.app for privacy inquiries, access requests, or to exercise your rights. You may also lodge a complaint with the Israeli Privacy Protection Authority.

privacy@pebli.app

Israeli privacy law

This notice is given so you know, before or when data is collected, who processes it, for what purpose, and what your rights are, as required by section 11 of the Protection of Privacy Law and Amendment 13 (in force from 14 August 2025). Allergy records are specially sensitive health information. Israeli ID numbers of children are strong identifiers. We do not sell personal information and we do not use allergy records or ID numbers for marketing.

Who is responsible for the data

Roles depend on the type of data. The Data Processing Addendum (DPA) with the daycare is part of the B2B contract.

For parent, staff, and admin accounts (name, phone, email, login, device and usage data): Nexo Labs LLC is the database controller.
For child enrollment, allergies, attendance, media, and family communication data entered by the daycare: the daycare operator is the controller. Pebli is the holder/processor acting on the daycare's documented instructions.
The daycare owner or manager is not a third party for child data that the daycare entered. Authorized staff need that data for daily care.
Parents are data subjects. They are also users of the parent app, for which Pebli is controller of the parent account itself.

Notice of data collected about children and families

When a child is enrolled, the daycare enters the fields below. Each field is collected only for the stated purpose. Statistical, aggregated data that does not identify a person may also be used to improve the product.

Field	Purpose
Child's first and last name	Display in the classroom tablet, parent app, and daycare reports; distinguish children; show daily status (arrived, late, absent, and similar).
Israeli ID number (9 digits)	Unique identification at enrollment and when transferring a child between Pebli daycares, so duplicate records are not created. Not used for marketing and not sent to AI vendors.
Date of birth and gender	Age-appropriate care, birthday notices for the daycare, and staffing/capacity planning.
Class / group assignment	Place the child with the correct staff and classroom tablet.
Allergies (type, name, severity, notes)	Prevent exposure to allergens during meals and activities; alert authorized staff. This is health information.
Medication list (optional)	A parent may add medication names in the parent app. Daycare enrollment does not include a medications form. If entered, this is health information.
Special instructions	Free-text care notes the daycare or a parent may enter (for example routines or handover). This is not a medical-diagnosis field.
Weight, height, feeding notes, diaper size	Daily care logs and handover between staff.
Emergency contacts	Reach a parent or other designated adult if the child needs urgent help.
Parent/guardian name, phone, email, and relationship	Create parent accounts, send attendance and care updates, and authenticate the family in the parent app.
Attendance, meals, sleep, hygiene, and activity logs	Daily operational records and family communication.
Photos, videos, and media-consent record	Share updates with enrolled families when the daycare recorded parental media consent. Consent is collected by the daycare.
Staff notes and TAMAT participation flag (where used)	Internal handover between assistants and program administration at the daycare.

Specially sensitive information (health)

Under Amendment 13, information about a person's health is specially sensitive. In Pebli the health field collected at enrollment is allergies (type, name, severity). A parent may also add an optional medication list in the parent app. We do not collect health-fund membership, kindergarten-doctor details, or a medical-conditions form.

Purpose: daily care, safety, and emergency response at the daycare - not advertising, profiling for marketing, or sale.
Basis: parental or guardian consent collected by the daycare before the data is entered, plus the contract between the daycare and Pebli (including the DPA).
Access: authorized daycare staff and, where the product shows it, linked parents. Pebli personnel access it only as needed to operate, secure, or support the service.
We do not send health fields or Israeli ID numbers to Anthropic or other AI providers. Optional daily insights use care-activity metrics (for example meals, sleep, attendance), not medical records.
You may refuse to provide allergy information. The daycare may then be unable to record allergies in Pebli; on-site safety remains the daycare's responsibility.

Child's Israeli ID number

When provided, the ID is stored as a unique identifier across Pebli so a child can be enrolled or transferred without creating a second profile. It is not optional in the current enrollment flow because it is the lookup key. We do not use it for marketing, we do not share it with advertisers, and we do not send it to AI vendors. Parents may ask the daycare or privacy@pebli.app to correct it. Deletion of the ID follows the daycare's instructions and applicable record-keeping duties; it is not deleted automatically when a parent deletes their own account.

1. Information we collect

We collect personal information in three ways: data you provide, data gathered automatically during use, and data received from third parties.

Account & profile information

Full name, profile photo, gender, and age/date of birth
Email address, phone number, and password
Daycare details for operators: legal name, role, and contact info

User-generated content

Photos, daily updates, and messages shared with families
Attendance, meals, sleep, hygiene, and activity logs entered by staff

Children & enrollment information

Child names, class assignment, date of birth, gender, Israeli ID number, allergies, optional medication list, special instructions, emergency contacts, and notes you enter - see the field-by-field notice above
Parent and guardian contact details linked to enrolled children

Chat & communication

Messages between staff and parents (where enabled)
Photos or videos sent via chat and support conversations

Verification

Age or identity verification artifacts when required
Proof of business ownership for B2B accounts

Device & technical information

IP address, device identifiers, operating system, and model
Screen resolution, language settings, app version, and mobile carrier

Usage information

Pages or screens viewed and actions performed
Screens, features, and messages you interact with and time spent
Clicks, taps, and session duration

Location data

Approximate location derived from IP address
We do not currently collect precise GPS for core daycare features

Cookies & tracking

Cookies and similar technologies for functionality, analytics, security, and-only with your consent-marketing (Meta Pixel on the marketing site)
Signals from Firebase Analytics, Firebase Crashlytics (mobile), Firebase Messaging, and AWS server logs

1.3 Information from third parties

Twilio, which sends SMS one-time passcodes for phone authentication
Daycare operators you interact with on the B2B platform
Other users who mention or tag you in content or chats
Analytics partners such as Firebase and infrastructure providers such as AWS

2. How we use your information

We process personal information to operate the platform, personalize experiences, communicate with you, keep the community safe, improve performance, and comply with the law. We do not perform automated decision-making that produces legal or similarly significant effects.

Platform functionality

Create and manage user accounts and daycare workspaces
Display classes, children, attendance, and daily logs; manage family communication
Manage messages, notifications, and B2B tooling

Personalization

Show relevant updates from your enrolled daycare
Tailor the in-app and web experience to your preferences

Communication

Send confirmations, updates, and notifications via Firebase Messaging
Respond to customer support requests and product questions

Safety & moderation

Detect and prevent fraud, abuse, or policy violations
Moderate content and enforce our Terms of Use

Analytics & improvements

Understand how users navigate the apps and platform
Improve stability, performance, and develop new functionality

AI-assisted insights

Generate optional daily insights for parents using Anthropic based on care-activity metrics (for example meals, sleep, attendance). We do not send Israeli ID numbers, allergy records, or medication lists to Anthropic
Insights are informational only and are not medical, developmental, or professional advice

Legal obligations

Verify identity or age when laws require it
Comply with applicable regulations and lawful requests

3. How we share information

We do not sell personal information. We only share data in the limited situations below.

Service providers

We share only the data needed for vendors to perform work on our behalf, including Firebase (Analytics, Messaging, Crashlytics), AWS hosting, Twilio (SMS/OTP), Stripe (B2B subscription payments), Anthropic (optional AI daily insights from care-activity metrics only - not ID numbers or health fields), and Meta Pixel on the marketing site when you consent to marketing cookies.

Daycare operators (B2B accounts)

When you are enrolled at a daycare using Pebli, authorized staff at that center can access the child and family information needed for daily care and communication. Daycare operators do not receive your private messages outside the Pebli messaging features configured for your center.

Legal compliance

We may disclose information in response to court orders, government requests, or law enforcement investigations when required by law.

Business transfers

If Pebli is involved in a merger, acquisition, or sale, your information may be transferred to the new entity.

4. Your rights and choices

Depending on your location, you may exercise the following rights. We will verify your identity before processing a request and respond within the time period required by law.

Under the Israeli Protection of Privacy Law: review (access) information we hold about you, and request correction of incomplete or inaccurate data
Request deletion of your account; child enrollment and health records belong to the daycare and are not deleted automatically when a parent account is closed
Object to direct marketing; we do not use allergy records or ID numbers for marketing
Lodge a complaint with the Israeli Privacy Protection Authority
Update or correct your account data in the app settings
Export a portable copy of your data via Settings or GET /api/user/privacy/export (authenticated)
Request account deletion via Settings or POST /api/user/privacy/request-deletion
Opt out of certain data uses or disable push notifications
Manage cookie preferences on the website (accept or reject non-essential cookies)
Where GDPR-style laws apply: object to processing, restrict processing, or lodge a complaint with a supervisory authority
Under applicable US state privacy laws (e.g. CCPA/CPRA): Right to Know, Delete, Correct, and Opt out of Sale/Sharing - we do not sell personal information; you may still email privacy@pebli.app for do-not-sell/share requests

Submit a request by emailing privacy@pebli.app or use in-app privacy tools.

5. Data security

We use reasonable technical and organizational measures to safeguard personal data, though no system is completely secure.

Secure AWS infrastructure with network and access controls
Encrypted communication channels between apps and servers
Role-based permissions and internal access governance
Monitoring for suspicious activity and abuse

6. Data retention

We retain account data as long as needed to run the platform, comply with legal obligations, support security, and verify account ownership. Parent and staff account data is deleted after a valid deletion request, subject to legal holds. Child enrollment, allergy, attendance, and media records belong to the daycare: they are not deleted automatically when a parent closes an account. After a child leaves, retention follows the daycare's instructions and applicable record-keeping duties.

7. Children’s privacy

Pebli processes information about enrolled children primarily on behalf of the daycare operator (holder/processor), including Israeli ID numbers and allergy records, with parental consent collected by the daycare (including media consent for photos and videos). Pebli is a technology platform, not a childcare provider and not a healthcare provider. The parent mobile app is intended for parents and legal guardians (typically 18+). We do not knowingly allow children to create their own accounts. Optional AI daily insights use care-activity metrics only and must not include ID numbers, allergy records, or medication lists. If we learn we collected personal information from a child in violation of applicable law, we will take appropriate steps to delete it.

8. International data transfers

Your information, including child data held for Israeli daycares, may be stored or processed by vendors such as AWS, Firebase, Twilio, Stripe, and Anthropic in the United States, the EEA, or other countries. Where required, we use appropriate safeguards (for example contractual clauses) for international transfers. We do not transfer Israeli ID numbers or health fields to Anthropic. Transfer of personal data abroad remains subject to Israeli law, including the Protection of Privacy Law and its regulations.

9. Changes to this policy

We may update this Privacy Policy as our services evolve. We will update the "Last Updated" date above and, when appropriate, provide additional notice.

10. Contact us

Nexo Labs LLC • Privacy Office (privacy@pebli.app)
111 NE 1st St, 8th Floor, Suite #89239
Miami, FL 33132
Wyoming LLC (File No. 2025-001825198)
📩 privacy@pebli.app