Privacy Policy

This Privacy Policy explains how Genesis Steps to Success ("we," "us," or "our") collects, uses, shares, and protects information when you visit our website, submit an enrollment inquiry or application, tour our center, or use the parent, staff, or admin portal (together, the "Services").

It applies to prospective and current parents and guardians, children enrolled in our program, staff and job applicants, and anyone who otherwise visits our website or contacts us. By using the Services, you agree to the practices described here.

We collect information you give us directly, and some information automatically when you use the Services.

Information you provide to us:

• Contact and account information — your name, email address, phone number, mailing address, and login credentials for the parent, staff, or admin portal.
• Enrollment and child information — your child's name, date of birth, age group, emergency contacts, authorized pickup persons, allergies, medical conditions, medications, immunization and health records, and other details you include on an enrollment inquiry or the enrollment application (including a completed PDF or a scan/photo of a paper application you upload or that our staff uploads on your behalf).
• Program records — attendance and check-in/check-out times, daily reports, meal and nap logs, incident reports, photos and activity updates, and progress reports we create about your child while enrolled. If the center makes your child an ID badge, we also keep the photo used for it, stored privately and visible only to authorized staff. Staff photos used for staff ID badges are handled the same way.
• Location at check-in — if the center has location check-in turned on, your phone's location is used once, when you tap Check In or Check Out in the parent portal, to confirm you are at the center. We don't store your coordinates or track your movements; we keep only how many metres from the center you were, with that day's attendance record. The same applies when staff clock in or out with the center's QR code: we keep the clock-in and clock-out times and the distance from the center, not the coordinates.
• Payment information — billing amounts, invoices, and payment history connected to your account. We do not store full payment card numbers ourselves.
• Communications — messages you send through the in-app messaging system (including any pictures or files you attach, which are stored privately and can be opened only by you and the person you sent them to), emails, and anything you tell us by phone or in person that we record in your file.
• Staff and applicant information — resumes, application details, work history, and related documents submitted through our Careers page or staff application forms.
• Files you upload — documents, forms, and photos you or our staff add to the Files & Forms library or attach to an application or message.

Information collected automatically:

• A small number of essential cookies used to keep you signed in and to remember basic preferences, such as whether the sidebar is collapsed. We do not use advertising or cross-site tracking cookies, and our website does not currently run third-party analytics.
• Standard technical information our hosting provider logs, such as IP address and browser type, for security and troubleshooting.

• To evaluate and process enrollment inquiries and applications, and to communicate with you about them.
• To operate our childcare program day to day — attendance, safety, health and allergy management, meals, activities, and daily and progress reporting.
• To provide the parent, staff, and admin portals, including messaging, document sharing, and account management.
• To send administrative emails — enrollment updates, tour confirmations, invoices, and responses to messages you send us.
• To bill for and process payments for tuition and fees.
• To review job applications and communicate with candidates.
• To maintain the safety and security of children, staff, and families, and to meet recordkeeping requirements under Massachusetts childcare licensing regulations.
• To improve our website and Services, and to troubleshoot technical issues.

We do not sell personal information. We share it only in these limited circumstances:

• With our service providers, who process data on our behalf and are bound by confidentiality obligations: our database and file storage provider (Supabase), our email delivery provider (Resend), and our website hosting provider (Vercel).
• With our AI provider, for the website assistant (Gene). If you use the "Ask Gene" chat on our public website, the questions you type are sent to Anthropic, which generates the answers. Gene only knows our public website information. It never receives enrollment, child, family, or staff records, and we do not save chat conversations. Please don't type personal details or your child's information into it.
• With our AI provider, for our staff's writing helper. Our staff can use an AI "Draft with Gene" tool to turn their own rough notes into a clearer message, daily-report note, or progress-report summary. Only the notes the staff member types into that tool, plus the child's and parent's first names, are sent to Anthropic to write the draft. Staff are instructed not to include last names, birthdates, addresses, or medical details, and no records are pulled from our database for it. A staff member always reviews and edits a draft before anything is saved or sent to a family, and we do not store the notes or drafts in the tool itself.
• With our AI provider, for our administrator's assistant (Gene). Our administrator can ask Gene, our AI assistant, to find information, answer questions, and help build reports and notes about the center’s operations. To answer, Gene looks up records using the administrator’s own access and sends what it finds to Anthropic. Depending on the question, that can include children’s and parents’ names, a child’s age, program, classroom, allergies and authorized pickup and emergency contacts, parents’ and applicants’ phone numbers and email addresses, attendance, daily reports, meals, naps, incident and progress reports, billing amounts and statuses, messages, applications and tours, and staff names and clock-in times. Gene does not receive dates of birth (only ages), insurance or physician details, home addresses, saved payment methods, or file contents. It can only read; it cannot change, send, or delete anything, and we do not store the conversations.
• With our AI provider, for the parent assistant (Gene). Parents who choose to use the optional assistant, Gene, in the Parent Portal (after a notice and their agreement) can ask about their own child. To answer, it looks up that child’s information using the parent’s own access and sends it to Anthropic: the child’s first name and age, the day’s attendance, mood, activities, meals, naps and teacher notes, and the center calendar and announcements. It does not receive last names, birthdates, health or medical records, billing information, or any other family’s information, it cannot change anything or contact staff, and we do not store the conversations.
• Within our team — authorized admin and staff who need the information to care for your child or run the program.
• With people you authorize — for example, an emergency contact or authorized pickup person you list, or a specific link or document you ask us to share.
• As required by law — to comply with licensing requirements, respond to a valid legal request, or protect the safety of a child, our staff, or the public, including mandated reporting obligations that apply to childcare providers.
• In a business transfer — if our center is ever sold, merged, or transferred, information may transfer as part of that transaction, subject to this policy or a policy at least as protective.

We restrict access to personal and health information to admin and staff who need it, store enrollment documents and uploaded files in private storage rather than public web pages, and use role-based access controls in our systems so, for example, a parent can only see their own child's records. No method of storing or transmitting information online is completely secure, and we cannot guarantee absolute security, but we work to protect your information using reasonable administrative, technical, and physical safeguards.

We keep enrollment, attendance, health, and other child-related records for as long as your child is enrolled and afterward for the period required by Massachusetts childcare licensing regulations and our own recordkeeping practices — generally at least five years after a child leaves the program. We keep other account and communication information for as long as needed for the purposes described in this policy, or as required by law, and delete or de-identify it when it is no longer needed.

Our Services are directed to parents, guardians, and staff, not to children. We collect information about enrolled children directly from their parents or guardians, or from our own staff in the course of providing care, and use it only as described in this policy. We do not knowingly collect personal information directly from children through our website.

Our enrollment inquiry and enrollment application forms ask the person signing to confirm they are the child's parent or legal guardian (or otherwise authorized to enroll them) and are at least 18 years old, before any information about the child is submitted.

Depending on your relationship to us and where you live, you may be able to:

• Ask to see, correct, or update the personal information we hold about you or your child.
• Ask us to delete information that we are not required to keep for legal or licensing reasons.
• Opt out of non-essential email communications by using the unsubscribe link, where one is provided, or by contacting us directly.
• Ask questions about how your information is used and shared.

To ask us to delete your information or stop non-essential email, use our Privacy Requests page, or contact us using the information in "Contact us" below. We may need to verify your identity, and some information cannot be deleted while your child is enrolled or while we are required to retain it under childcare licensing rules.

We may update this Privacy Policy from time to time as our Services or legal obligations change. We will post the revised policy here with an updated "Last updated" date, and for significant changes we will make reasonable efforts to let current families and staff know directly.

If you have questions about this Privacy Policy or how we handle your information, contact us at info@genesisstepstosuccess.com, by phone at (978) 489-8401, or through our Contact page.