Privacy policy

1. Who we are

The KidWave service is operated by Sibstil Doors SRL (tax ID RO25411699, Trade Register no. J2009000358326), registered office Str. Oștirii nr. 6, sc. B, et. 7, ap. 73, Sibiu, Romania, represented by Alexandru Rica. Contact for any data question: alex@kulttur.ro.

For children's and parents' data, your school is the data controller and KidWave acts as a processor (art. 28 GDPR), under a data processing agreement (DPA) signed with each school.

2. What data we process

About children: name and class. A photo is optional and only used if the school decides so. We never ask for a national ID, address or any other data about the child.

About adults: name, email and phone for parents and school staff; name and phone for people authorized to pick up a child (grandparents, nannies).

Technical: the pickup history (who announced, who picked up, at what time), push notification subscriptions and the log of sent notifications.

3. Why we process it

In the app, a single purpose: safely coordinating school pickup: announcing arrivals, the school's live board, parent notifications and the handover record. Separately, on the public website (not in the app), we process visit statistics (see the Cookies section) and the pilot requests: the school's name, the contact person's name, email and, optionally, phone, the source and the message. For these, the controller is Sibstil Doors SRL. We use them only to reply to you and organise the pilot, based on our legitimate interest in answering the request of the school you represent (Art. 6(1)(f) GDPR). The request reaches our database and an email notification (via Brevo); we keep it as stated under “How long we keep it”.

We don't sell data, show ads, profile users or use the data for anything else.

4. Location (arrival detection)

Geofence is off by default. You turn it on manually in Settings, and you can turn it off anytime.

Only to compute the distance between your phone and the school. When you're ~300m away, we ask whether to announce your arrival. We never confirm without your consent.

Your coordinates never leave your device and are not saved in any database. The distance calculation happens 100% on your phone. We only store the school's location (set by the admin).

We use location only while you're on the main screen, at low accuracy (light battery use). It stops automatically after you announce arrival and 30 minutes after pickup time.

5. Where it is stored and who else touches it

Database and authentication: Supabase, hosted in the European Union (Frankfurt, eu-central-1). Web app: Vercel Inc. (USA, transfer covered by the Data Privacy Framework / standard contractual clauses). Transactional email: Brevo (Sendinblue SAS, France, EU-hosted). The database backup runs nightly, is encrypted (AES-256) before it leaves our infrastructure and is kept encrypted for 30 days on GitHub (GitHub Inc., USA, transfer covered by the Data Privacy Framework); the decryption key is not stored with the backup. Deleted data also disappears from the backups within 30 days at most.

These are the only sub-processors. The full list, with role and location, is an annex to the DPA signed with the school; any change is notified in advance.

6. How long we keep it

Pickup history: 24 months (traceability for the school), then automatic deletion. Notifications: 90 days. Expired authorized persons: 30 days. School contact requests: 12 months after the last update; those of schools in a pilot or that became customers are kept for as long as we work together. Public-page visit statistics: 13 months. When a parent account is deleted, the database immediately removes: the account, its links to the children, the authorized people you added and the notifications. The pickup history stays with the school until the 24-month limit, without the link to the deleted account (it may keep the name of the person who collected the child).

7. Your rights

You have the right of access, rectification, erasure, restriction and portability, as well as the right to object (Art. 21 GDPR) to processing based on our legitimate interest, such as pilot requests, and the right to withdraw your consent to statistics at any time. Parents can delete their account directly in the app (Settings → Delete account); for a child's data, the request goes to the school and we execute it immediately.

If something's not right, write to alex@kulttur.ro. You may also lodge a complaint with your data protection authority.

8. Security

Each school's data is isolated at the database level (row-level security), traffic is encrypted (TLS), access is strictly role-based (a parent sees only their children, staff only their school), and authorized-person access expires automatically the same day.

9. Cookies

We only use strictly necessary cookies: keeping you signed in (session), your chosen language and, for a person authorized to collect a child, a cookie that binds the pickup link to the phone that opened it first (handover safety). We don't use analytics or advertising cookies. Your choice about website statistics is also kept locally (localStorage), so we don't ask on every page. The theme (light/dark) is not a cookie: it is kept in the browser's local storage (localStorage), like a few in-app preferences (sound, notifications, location) and, for parents, the last state of the home screen, which is cleared when you sign out.

Statistics, only with your consent: on the public pages (not inside the app) we count visits only after you tap “Accept” in the statistics banner. Until then no counter runs. We use two tools, both cookieless: our own counter and Vercel Web Analytics (Vercel Inc.), which receives the page address, the referring site, country, browser and operating system and identifies you only by a code computed from the request, discarded after 24 hours. In our own counter, for each page visited we keep: the page address, the site you came from, campaign parameters in the link (utm), the country derived from your IP address, the device type and the language. We do not store your IP address. From it and your browser type we compute a code that changes every day and cannot be turned back into an IP. This lets us count unique visitors per day, but not follow you from one day to the next. If you accepted and submit the request form, your request is linked to that same day's visit, so we know how you found us. The legal basis is your consent (Art. 6(1)(a) GDPR and Art. 4(5) of Romanian Law 506/2004). You can withdraw it any time from the “Website statistics” link in the page footer; withdrawal stops collection from then on. Our own counter's data is kept for 13 months, then deleted automatically.