Privacy Policy

Last updated: July 22, 2026

This Privacy Policy explains how Willow Peak Digital, LLC (“we,” “us,” “our”) handles information in connection with Wylari, our childcare-management service at wylari.com and its related apps (the “Service”).

Two relationships, two roles. Wylari is used by childcare providers to run their programs. When a provider signs up, we handle their account information as described below. When a provider stores information about the children and families in their care, the provider is the party responsible for that information (the “controller”), and we process it only on their behalf and on their instructions (as a “processor”/service provider). We do not use children’s or families’ information for our own purposes, and we never sell it.

Contents

Information we collect
Children’s information
How we use information
How information is shared
Data retention
Security
Your choices & rights
Cookies & devices
Where data is stored
Changes to this policy
Contact us

1. Information we collect

a. Information from providers (our customers)

When a childcare provider creates and uses an account, we collect: name, email address, password (stored only as a secure hash), daycare/business name and contact details, optional logo and branding, time zone and operating hours, and, if you subscribe, billing details handled by our payment processor (see Sharing). We also collect basic technical data such as IP address, browser/device type, and activity logs used to operate and secure the Service.

b. Information providers store about children, families & staff

Providers use Wylari to record information about the people in their care and their team. Depending on the features a provider uses, this can include:

Children: name, preferred name, date of birth, photos, allergies, medications, immunization notes, emergency and health information, general notes, and any custom fields the provider adds.
Guardians & authorized pickups: names, contact details (email, phone), relationship, and check-in PINs.
Attendance & check-in: check-in/out times and who performed them, drawn signatures, health-screening answers, and—only if a provider enables remote check-in and a parent chooses to use it—approximate device location at the moment of that check-in, used to confirm proximity to the daycare.
Communication & daily records: messages between providers and families, announcements, daily updates, progress observations, milestones, photos, meal plans, and documents shared with families (including acknowledgements and electronic signatures).
Payments record-keeping: tuition and fee entries, receipts, and year-end statements. Wylari records these for the provider’s bookkeeping; Wylari does not process card payments or move money between families and providers.
Staff: employee names, roles, work email, PINs, and activity attribution.

The provider decides what to enter and is responsible for having a lawful basis and any necessary consents to do so (see Children’s information).

c. Information collected automatically

We use a session cookie to keep you signed in, and optional “trusted device” tokens to reduce how often you re-enter a code or PIN. If you enable notifications, we store the push-subscription identifier your browser provides. We keep server logs for security and troubleshooting. On our staff-facing app and public pages we use analytics cookies (see Cookies & devices); we do not use third-party advertising or cross-site advertising cookies.

2. Children’s information

Protecting children’s information is central to what we do. Wylari is a tool for licensed and in-home childcare providers; it is not directed to children, and children do not create accounts.

Any information about a child in Wylari is entered by the provider (or by a parent/guardian through the provider’s parent portal) and is processed by us solely to provide the Service to that provider.
The provider is responsible for obtaining and maintaining any parental consents required by law (for example, under the U.S. Children’s Online Privacy Protection Act (COPPA) and applicable state laws) before entering a child’s information.
We do not use children’s information to market to anyone, we do not build advertising profiles, and we do not sell or rent it.
A parent/guardian who wishes to access, correct, or delete a child’s information should contact their childcare provider, who controls that information. We will assist providers in responding to such requests.

3. How we use information

To provide, maintain, and improve the Service and its features.
To secure accounts and the platform, prevent abuse, and troubleshoot problems.
To communicate with providers about their account, service updates, and support.
To process subscription billing (once paid plans are active) through our payment processor.
To send optional product and marketing emails to people who ask to hear from us (e.g., beta or launch interest) — you can opt out at any time.
To understand overall, aggregated usage so we can make the product better. We do not use the contents of a provider’s child/family records for our own analytics or marketing.
To understand aggregate usage and improve the Service using analytics tools — Google Analytics (page and feature usage) and Microsoft Clarity (heatmaps and masked session-behavior insights). These run only on our staff-facing app and public pages — not on the check-in kiosk or the parent portal — and we do not use analytics to profile children or market to them.

We do not sell personal information. We share information only as needed to run the Service:

Service providers (sub-processors) who help us operate, such as our server/hosting provider, our subscription payment processor (LemonSqueezy, once paid plans are enabled), our email/marketing tool for prospect and launch messaging (MailerLite), and browser push services. These parties may process information only on our behalf and under obligations of confidentiality.
At a provider’s direction — for example, delivering a message or document to the families a provider chooses.
Legal & safety — when we reasonably believe disclosure is required by law or legal process, or necessary to protect the rights, safety, or property of Wylari, our users, or the public.
Business transfers — if Wylari is involved in a merger, acquisition, or sale of assets, information may transfer as part of that transaction, subject to this policy.

5. Data retention

We keep account and customer information for as long as a provider’s account is active and as needed to provide the Service. When a provider deletes a record or closes their account, we delete or de-identify the associated information within a reasonable period, except where longer retention is required:

Attendance and check-in records may be retained even after a related child or family is removed, because childcare licensing and recordkeeping rules commonly require these to be preserved. Where possible, such retained records are kept in a form limited to what those rules require.
We may retain limited information as needed to comply with legal obligations, resolve disputes, and enforce our agreements.

Providers remain responsible for meeting their own legal recordkeeping obligations, including exporting or retaining records they are required by law to keep.

6. Security

We take reasonable measures designed to protect information, including: strict per-provider data isolation at the database level (row-level security), encryption of traffic in transit (HTTPS), passwords stored only as salted hashes, optional two-factor authentication and device verification for staff and owners, and role-based access controls. No method of transmission or storage is 100% secure, so we cannot guarantee absolute security; please use a strong, unique password and keep your credentials confidential.

7. Your choices & rights

Account information: providers can review and update most account details in the app, or contact us for help.
Child/family information: because the provider controls this information, parents and guardians should direct access, correction, or deletion requests to their childcare provider. We support providers in fulfilling those requests.
Marketing emails: unsubscribe using the link in any marketing email, or contact us.
Notifications: manage or turn off push and email notifications in your settings or your device/browser.
Depending on where you live, you may have additional rights (such as to access, correct, delete, or port your personal information, or to complain to a regulator). To exercise them, contact us at the address below; we may need to verify your identity, and for child/family data we may direct the request to the relevant provider.

8. Cookies & devices

Wylari uses the cookies and local identifiers it needs to work: a sign-in session cookie; optional “remember this device” tokens that let owners, staff, or parents re-enter with a code or PIN on a device they’ve verified; and, if enabled, a push-notification subscription. Blocking essential cookies will prevent sign-in from working.

On our staff-facing app and public marketing pages we also use analytics cookies from Google Analytics and Microsoft Clarity to understand aggregate usage and improve the Service; Clarity session recordings are masked. These analytics cookies are not set until you accept them in our cookie banner — analytics stay off if you decline, and you can change your mind by clearing your browser storage for our site. We do not use advertising or cross-site advertising cookies, and no analytics run on the check-in kiosk or the parent portal.

9. Where data is stored

The Service is operated from servers located in the United States (Phoenix, Arizona). If you access Wylari from another country, you understand your information will be processed where our servers and service providers operate.

10. Changes to this policy

We may update this policy from time to time. When we make material changes, we will update the “Last updated” date and, where appropriate, notify providers through the Service or by email. Your continued use of the Service after an update means you accept the revised policy.

11. Contact us

Questions about this policy or your information? Contact us at privacy@wylari.com, or by mail at Willow Peak Digital, LLC, 16168 Settlement Ave, Caldwell, ID 83607.