1. Who we are
Espalier Limited (company number 9467247, NZBN 9429054041158) is a New Zealand company based in Auckland. We make Espalier: online tools for early childhood education services. Those tools are the staff app, Espalier Policies, Espalier Family (the family app), Espalier Operations and Espalier Growth (the Professional Growth Cycle app). Together they are the “Service”.
We follow the Privacy Act 2020 and its information privacy principles. Questions go to our privacy officer at admin@espalier.co.nz.
2. Centres and us
Most of the information in Espalier is put there by an early childhood centre (or the organisation that runs it) about its children, families and staff. For that information:
- the centre decides what is collected and why, and is responsible for it under the Privacy Act;
- we hold and process it on the centre’s behalf, only to provide the Service, as the centre’s agent.
If you are a parent, whānau member or staff member, your centre is usually the best first contact for questions about your information. We will help them answer you.
We are responsible ourselves for information about the organisations that subscribe to Espalier (billing contacts, invoices and payments), for sign-in details, and for anything you send us directly.
3. What we collect
When you sign in
- Your name and email address, and a verified password that Amazon Cognito holds for us (we never see or store it).
- If you choose Continue with Google or Continue with Facebook, we receive your name, email address and an account identifier from that provider. We don’t receive your password, contacts, posts or friends, and we never post anything for you.
Information centres put in
- Children: names, dates of birth, rooms, attendance and sign-in/out times, care routines (sleep, meals, nappies), health and medical information including allergies and medication, incidents and accidents, learning stories, individual development plans, and photos and videos.
- Families and whānau: names, relationship to the child, contact details, who may collect a child, consents, messages, notices, policy feedback and read receipts.
- Staff: names, contact details, roles, rosters, clock-ins and timesheets, qualifications and certification, and Professional Growth Cycle records, which may include reflections, evidence, observations and voice recordings.
- Centre documents: policies, procedures and other files the centre uploads.
Subscribing organisations
- The organisation’s name and legal name, billing contact, invoice email, plan and invoices.
- Card and bank account details are entered straight into Stripe’s secure form. We keep only what Stripe tells us, such as the card brand, its last four digits and whether a payment succeeded.
Automatically
- Technical logs (IP address, browser, time and the request made) to keep the Service running and secure, and which pages of the staff app are used, so the home screen can show your frequent pages.
4. How we use it
- To provide the Service: sign-in, showing the right information to the right people, sending the emails and notifications you or your centre ask for, and running features such as attendance, billing, policies and learning stories.
- To bill subscribing organisations and collect payment.
- To support you, fix problems, keep the Service secure and prevent misuse.
- To improve the Service, using usage information about how features are used rather than the content of children’s records.
- To send service messages, and newsletters to organisation contacts. Every newsletter has an unsubscribe link.
We don’t sell personal information, use it for advertising, or let anyone else use it for their own purposes.
5. AI features
Some features use AI to help kaiako write: drafting learning stories and Professional Growth Cycle records, turning recordings into text, and suggesting policy wording and answers in the staff app’s assistant. These use Amazon Transcribe and Amazon Bedrock, run in our own AWS account.
- Amazon doesn’t use what we send to train its models or share it with model makers.
- AI output is always a draft. A person reviews, edits and decides whether to keep it.
- Bedrock may process a request in another AWS Asia-Pacific region (see where it’s kept).
7. Where it’s kept
Your information is stored in Amazon Web Services’ Sydney region in Australia. AI requests may be processed in other AWS Asia-Pacific regions. Australia and those AWS services provide protection comparable to the Privacy Act. Stripe may process payment information in the United States and elsewhere under its own privacy safeguards.
8. How long we keep it
- While an organisation subscribes, we keep its information until it deletes it or asks us to.
- When a subscription ends, the organisation can ask for an export within 60 days. After that we archive and then delete it.
- Database backups roll over after 35 days and earlier file versions after 90 days.
- We keep invoices and payment records for seven years, as New Zealand tax law requires.
9. Security
Information is encrypted in transit and at rest. Every request is checked against the centre it belongs to, so one centre can never see another’s records. Access by our own team is limited to what’s needed to run and support the Service. If a privacy breach is likely to cause serious harm, we will tell the affected centre and help notify the people affected and the Privacy Commissioner, as the law requires.
10. Your rights
You can ask to see the personal information held about you and ask for it to be corrected. For information your centre holds, ask your centre, or ask us and we’ll pass it on and help. For anything else, email admin@espalier.co.nz. We’ll reply within 20 working days.
If you’re not happy with how we’ve handled a privacy matter, you can complain to the Office of the Privacy Commissioner at privacy.org.nz.
11. Deleting your data
To delete your Espalier sign-in and the information linked to it, including what we received from Google or Facebook:
- Email admin@espalier.co.nz from the email address you sign in with, with the subject “Delete my Espalier data”.
- We confirm it’s you, delete your sign-in and personal details within 30 days, and email you when it’s done.
Records your centre must keep, such as attendance, incident and learning records, belong to the centre. We’ll pass your request to them so they can decide what to remove. You can also remove Espalier from your Facebook or Google account settings at any time. That stops sign-in with that account but doesn’t delete what we already hold.
13. Children
Children don’t use Espalier or have accounts. Their information is entered by their centre and seen by their own family and the staff who care for them. We treat it with particular care and never use it for marketing or advertising.
14. Changes to this policy
We’ll update this page when our practices change and show the new effective date at the top. If a change is significant, we’ll tell subscribing organisations by email before it takes effect.
15. Contact us
Privacy Officer, Espalier Limited, Auckland, New Zealand · admin@espalier.co.nz