Privacy statement
Version dated 7 October 2026. This is the privacy statement for Kindra, the software made by Salix Limited. It is written for an early learning service to adopt: under the Privacy Act 2020 the service is the agency that holds a family’s information, and it puts its own name and privacy officer on its copy.
To ask for information to be deleted, see Deleting your information. For help with the software, see Support.
This statement describes Kindra, the software Salix Limited runs for early learning services. Each service that uses it publishes its own version, naming its privacy officer and its own details. It is not legal advice.
In short
- Your early learning service is responsible for your information. It decides what is collected and answers to you for it under the Privacy Act 2020. Salix Limited runs the software for the service and holds the records only on its behalf.
- The software holds what the service needs to keep children safe, run the centre and claim funding from the Ministry of Education. The tables below list every item and who can see it.
- A centre sees only its own records, and a family sees its own children's records and not another family's, apart from the few items the tables mark as visible more widely. The database enforces both.
- The records are stored in Australia, with Supabase in Sydney. A few other companies outside New Zealand carry out particular tasks, such as sending email; each is named under Where it is held.
- No analytics, no advertising and no tracking. Salix does not use the records for its own purposes.
- You can ask the service to see and to correct what is held about you or your child. Records that support funding claims are kept for at least seven years.
Contents
- Who is responsible for this information
- What the software collects
- What the software does not collect
- Where it is held
- Who can see what
- Who the centre shares it with
- Your rights
- If something goes wrong
- Who to contact
Who is responsible for this information
Under the Privacy Act 2020, the agency that collects personal information carries the obligations. When a family gives a centre their child's allergies, the agency is the centre. Salix Limited, a New Zealand registered company (NZBN 9429053674067), runs the software the centre uses to hold it, and is called Salix for short from here on.
The company is named rather than the product because a family reading this should be able to identify who holds their child's records and, if it came to it, who the services agreement is with. Naming only a trading name would leave both unanswerable.
Section 11 of the Privacy Act 2020 is the provision that does this. It is headed Personal information treated as being held by another agency in certain circumstances, and it says that where one agency holds information for or on behalf of another, as a representative or agent or for safe custody or processing, the information is treated as held by the principal and not by the agent. So the centre remains the agency answerable to a family and to the Privacy Commissioner, and Salix's obligations run through the services agreement rather than directly to the family.
Section 11 has a condition, and it is the one that constrains how Salix may behave. The information is treated as held by the agent as well as the principal if the agent uses or discloses it for its own purposes. Salix holding a centre's records is not the company's information to learn from: using them to build a product feature, to train a model, or to publish a statistic would make Salix an agency holding that information in its own right, with obligations running directly to the family. That is why this document can say what the software collects and where it goes, and cannot offer a benefit derived from anyone's records.
This limit belongs in the services agreement between Salix and each centre, stated explicitly.
So each centre adopts its own copy. A centre using the software puts its own name on this statement, names its own privacy officer, and takes responsibility for it. What Salix can state definitively is the second half of this document: what the software actually collects, where it goes, and who can see it. That part is taken from the software itself.
What the software collects
Everything below is information the software holds today.
The software also holds the following, each described in the sections below: a child's home address; a record that a document proving a child's identity was sighted, and by whom, but never the document's number; the names of visitors signed in at the centre; census details about staff (gender, age band, ethnicity and qualifications), which only the owner, the manager and the staff member themselves can see; and, for a home-based service, the address of each home where care is given.
Three terms are used in the tables below. Staff means the centre's owner, its managers and its educators, each with their own login at that centre. The door tablet is the shared entrance tablet a centre may set up for signing children in and out; the software treats it as a device, not a person. Everyone with a login at that centre means every login the centre has issued, families and the door tablet included. Where a row says a child's whānau can see something, that means the guardians of that child who have a login, never another family.
About a child
| What | Why it is held | Who can see it |
|---|---|---|
| Name, preferred name, date of birth | Identity, and the ratio calculation needs an age | Staff at that centre; the child's own whānau |
| Gender, ethnicities, iwi, and the languages spoken at home, up to three of each, as Ministry codes | Ministry funding returns ask for these | Staff at that centre; the child's own whānau |
| National Student Number (NSN) | Identifies the child in Ministry systems | Staff at that centre; the child's own whānau |
| Enrolment dates, days, funded hours, 20 Hours ECE | Funding, and the roll | Staff at that centre; the child's own whānau |
| Allergies, medical conditions, dietary requirements, severity, response plan | Keeping a child safe and alive | Staff at that centre; the child's own whānau |
| Medication authorities: medicine, dose, route, instructions, who authorised it | Giving medicine lawfully | Staff at that centre; the child's own whānau |
| Sign-in and sign-out times | Ratios, funding, and knowing who is in the building | Staff at that centre; the child's own whānau |
| Photos and videos, where consent has been given | The learning journal, and notices | Staff, and the audience the consent covers |
| Consent decisions, and who gave each one | So consent is a record, not a memory | Staff at that centre; the child's own whānau |
Also held about a child:
| What | Why it is held | Who can see it |
|---|---|---|
| Middle names | The Ministry records a child's official given names in full | Staff at that centre; the child's own whānau |
| Home address (street, city, country, postcode), and a second address where a child lives in two households | Part of the enrolment record the Funding Handbook requires, and sent to the Ministry with an enrolment | Staff at that centre; the child's own whānau, who can read it and cannot change it |
| That a document proving the child's identity was sighted: which kind, by whom, when, and a note. Never the document's number | The Ministry requires identity to have been checked before a National Student Number is allocated | Staff at that centre; the child's own whānau |
| The identifier the record had in the system it was imported from, where it was imported | So a later import can be matched to the same child | Staff at that centre; the child's own whānau |
| Which children the centre has recorded as siblings | Home-based services only: the limit on under-twos in one home treats siblings differently | Staff at that centre; the child's own whānau |
| The weekly pattern of days and times the child is enrolled to attend, and which guardian agreed to each change and when | The enrolment agreement, which funding claims and the absence rules are checked against | Staff at that centre; the child's own whānau |
| Signatures on the enrolment record: which guardian signed it and when, who attested 20 Hours ECE and when, and who gave notice that the child is leaving and when | The Funding Handbook requires each to be signed and dated | Staff at that centre; the child's own whānau |
| Hours the child attends another service each week, as attested by a guardian, and whether the enrolment is permanent, casual or conditional | Funding caps follow the child across services, and absence funding depends on the enrolment type | Staff at that centre; the child's own whānau |
| Bookings for particular days, and any reason a family gives for an absence | The roll, and funding for enrolled days a child was absent | Staff at that centre; the child's own whānau |
| A guardian's confirmation or dispute of a period of attendance, and the notices sent asking for one | The Funding Handbook requires an authorised signatory to confirm the attendance record | The confirmation: staff at that centre; the child's own whānau. The notices: staff at that centre |
| An exemption from the absence rules, on the basis of an ongoing learning support need or a short-term illness, and the evidence the centre holds for it | Funding Handbook 7-7 lets a centre claim for a longer absence where it holds this evidence | The centre's owner and manager only: not educators, and not the child's whānau |
| A signed reconfirmation of the enrolment agreement after frequent absence, and what changed | Funding Handbook 6-7 requires one before absences in the third month can be claimed | The centre's owner and manager only |
| Which guardian signed the child in or out at the door tablet, and at a home-based service, which home the care was given in | The attendance record the Ministry requires. The home's address is held in a separate list that a family cannot read | Staff at that centre; the child's own whānau |
| Immunisation: what the centre was shown, when, by whom, a reference, and the next due date typed off the document | Centres are required to sight immunisation records | Staff at that centre; the child's own whānau |
| Incidents: injuries, illness, behaviour and near misses, with what happened, where, first aid given, who treated it, a witness's name, when the family was told, and who acknowledged the report | A record the centre must keep, and the family's right to know | Staff at that centre; the child's own whānau once the report is final, never while it is a draft |
| The centre's investigation of an incident, and any photographs taken of an incident or a safety check | The centre's own follow-up and evidence | Staff at that centre only; never a family, including the family of the child concerned |
| Each dose of medicine given: what, when, by whom and who witnessed it | So giving medicine is a record, and a correction is a visible new entry | Staff at that centre; the child's own whānau |
| Sleep checks: when a sleeping child was looked at, the position observed, whether breathing was observed, and by whom | Safe-sleep monitoring, at an interval the centre sets in Settings; no interval is assumed | Staff at that centre; the child's own whānau |
| Excursions: that the child was on the list for an outing, and each consent a guardian gave or withheld for that outing | Consent for each outing is recorded per child, separately from the standing excursion consent | Staff at that centre; the child's own whānau. The outing itself and its headcounts: staff at that centre |
| When the centre asked a named guardian for a consent decision, and each time a guardian confirmed the child's details are current | So an ask is a record, and a confirmation has a date | Staff at that centre; the child's own whānau |
| Posts about named children (learning moments and daily updates), the Te Whāriki strands they are tagged with, and comments on them | The learning journal | Staff at that centre; the whānau of the children named. A comment is seen by staff, and once approved by everyone who can see the post |
| Messages between the centre and the family about the child | Communication with the family, kept with the record | Staff at that centre; every guardian of that child who has a login |
| Fee invoices naming the child, and payments recorded against them | Billing, where the centre bills through the software | The centre's owner and manager; the guardian an invoice is addressed to, once it is issued |
| How the child's National Student Number was obtained, each attempt to obtain one and the message the Ministry returned, and what the Ministry's index said about the child's name and date of birth | The Ministry's rules on allocating and verifying NSNs, and evidence that the centre tried | Everyone with a login at that centre, every family and the door tablet included. That is wider than the rest of the child's record |
| A copy of each message about the child sent to the Ministry's ELI system, kept as it was sent, and a log of each attempt to send one | The Ministry requires the message as sent to be kept; the log holds no content. Only where we have switched the centre on for ELI, which is off by default | The centre's owner and manager |
| Where a home-based child's own home is used for care: its address, labelled as that child's home | Home-based services only. The Ministry requires the address of the home on every attendance record | The centre's owner, manager and educators. Never a family, including that child's own, because the same home is usually another family's too |
About whānau
Full name, relationship to the child, email, phone, address, whether they may collect the child, and whether they are an emergency contact.
In full, and who can see each item:
| What | Why it is held | Who can see it |
|---|---|---|
| Full name, relationship to the child, email, phone and postal address | Contact, and the collection list | Staff at that centre; you, for your own record. You cannot see the other contacts on your child's record, and they cannot see yours |
| Whether you may collect the child, whether you are an emergency contact, your place in the order of contacts, and whether you are named as an authorised signatory for attendance | The collection rules at the door, and the Funding Handbook's signatory rule | Staff at that centre; you, for your own record |
| Whether you have a login, and the role it carries | Access to the parent portal and the app | Everyone with a login at that centre except the door tablet can see who has a login and in what role. Only staff at that centre (owner, manager, educator) can look up the email address a login uses |
| A PIN for the door tablet, where the centre gives you one | Signing your child in or out at the entrance tablet | Nobody. Only a scrambled form is stored and it is checked inside the database; no login, the owner's included, can read it. The office sets it, and five wrong attempts lock it for fifteen minutes |
| Invoices addressed to you, the lines on them, and payments recorded against them | Billing, where the centre bills through the software | The centre's owner and manager; you, once an invoice is issued and never while it is a draft |
| Messages you send and receive, and comments you write on posts | Communication with the centre | Messages: staff at that centre and every guardian of the child who has a login. Comments: staff at that centre, and once approved, everyone who can see the post; a comment on a centre-wide notice is seen by every family at the centre |
| Notifications sent to you in the app, and your notification settings, including quiet hours | Delivering what you asked for, when you asked for it | Only you |
| A device token, if you turn on notifications on your phone | Push notifications through Expo, which nothing sends yet | Only you |
Custody and court orders
Where a centre records a custody arrangement, it holds the detail entered and a court order reference. Visible to staff only, and never to any parent, including the parent it concerns. That is deliberate: a screen that shows one parent what has been recorded about the other is a screen that turns a centre into a party to a dispute.
About staff
Name, role, and the compliance records the centre is required to hold: first aid, police vetting, safety checks, practising certificates, child protection training, each with its reference, dates, and who sighted the original document.
A staff member can always read their own records. That is not a courtesy: the Act gives a right of access to information about oneself, and building a system where an educator cannot see their own police vetting result would be building a system that denies it.
In full, and who can see each item:
| What | Why it is held | Who can see it |
|---|---|---|
| Full name, a note on the role, start and finish dates, and whether the person has a login | The record of who works at the centre, which rosters, attendance and the certificated-teacher count hang off | Staff at that centre |
| Compliance records: first aid, police vetting, safety checks, practising certificates, child protection training and others, each with its reference, dates, and who sighted the document | Licensing requires the centre to hold them | The centre's owner and manager; the person the record is about |
| Sign-in and sign-out times, and intervals when the person was present but not counted towards the ratio (a break, non-contact time), with whether each interval was paid | Staff hours for funding, the ratio, and the hours worked the ECE Return asks for (a paid break counts as time worked) | Staff at that centre. Never a family |
| Rostered shifts, leave (dates and kind, not entitlements or balances), and contracted contact hours per weekday | Rostering, the ratio forecast, and the contact hours the ECE Return asks for | Staff at that centre. Never a family |
| Census details for the annual ECE Return: gender, an age band (not a date of birth), ethnic groups, the roles held, the qualification for each role, whether paid, permanent or full time, dates in each role, the ages taught, and where a person went on leaving | The Ministry's annual ECE Return asks for them | The centre's owner and manager, and the staff member themselves. Not colleagues, and never a family |
| Start and finish times for each day of the ECE census week, entered by the centre for a person who did not sign in that week | The actual contact times and hours worked the ECE Return asks for | The centre's owner and manager, and the staff member themselves. Not colleagues, and never a family |
| Teacher details for the Waha Rumaki/PITA return: initials, Teaching Council registration number and expiry, years of experience, contract hours and FTE | The Ministry's monthly Teacher Data return, for the services that file it | The centre's owner and manager, and the teacher themselves |
| A copy of each Waha Rumaki/PITA return as filed: the teachers claimed, with the details above and their employment dates, and the name, designation and email of whoever filed it | The Ministry forbids changing a filed return; a correction is a new one | Everyone with a login at that centre, every family and the door tablet included. Kept for seven years and cannot be deleted before then |
| A copy of each ECE Return as filed, with each person's census details | Evidence of the last filed return is required for seven years | The centre's owner and manager. Kept for seven years after the return date, whatever happens to the staff record |
| On the RS7 funding return: the name, contact number and designation of whoever submits it, and the salary attestations made | The Ministry's return declaration | The centre's owner and manager |
| At a home-based service: which coordinator oversees which educator, each contact and visit with an educator, each observation of a child with a note, and the address of an educator's home where care is given there | Home-based services only. The Regulations require coordinator oversight, and the Ministry requires the home's address on each attendance record | Staff at that centre. Never a family, including the family of a child observed |
| Your login's email address, and your role at the centre | Access | Everyone with a login at that centre except the door tablet can see who has a login and in what role. Only staff at that centre (owner, manager, educator) can look up the email address a login uses |
| Invitations: the email address invited, the role, who invited them and whether it was accepted | Joining a centre | The centre's owner and manager. The token in the invitation email is stored only as a hash that no login can read |
| The audit log: which login changed which record and when, by field name | Accountability. It holds no contents | The centre's owner and manager |
| If the centre turns on written summaries: which login asked for each one, the feature, the model and the token counts, never the text sent or returned | Cost and accountability for the optional feature described below, which is off unless a centre turns it on | The centre's owner and manager |
| If the centre connects Xero: which login connected it and when, and which Xero organisation | Accounting, where a centre connects it. No centre has connected one yet | The centre's owner and manager. The credential Xero issues is encrypted and no login can read it |
| Emergency broadcasts: who sent one, its text, and how many people it went to | The record of what the centre told families | The centre's owner and manager |
About visitors
| What | Why it is held | Who can see it |
|---|---|---|
| A visitor's full name, organisation, why they came and who they came to see, and when they signed in and out | The visitor book: who was on site, which is the first question after an incident and the one asked in an evacuation | Staff at that centre. Never a family |
| A count of visiting children under six who are present and not enrolled (a sibling at pick-up, a staff member's own child), by age band, with the time and who recorded it | Every person under six who is present counts towards the ratio. A count and deliberately not a name: the centre has no relationship with a visiting child that would justify recording one | Staff at that centre. Never a family |
A visitor's record cannot be deleted by anybody, because a visit that happened is evidence. A count cannot be changed either; a wrong count is corrected by recording a new one.
About somebody applying for a job
The careers page on the public website asks applicants to email the centre, and no form on the public website collects these fields. The software can still hold an application, and what follows describes how it treats one.
Name and email, and optionally a phone number, the sort of role wanted, an earliest start date, whether the applicant says they hold a current New Zealand practising certificate, and whatever they choose to write about themselves.
Four things about this collection are deliberate. Until 25 September 2026 it was one of only two places, the other being the enrolment enquiry below, where somebody who is not a member of the centre could write to the database. No form on the public website uses either now, and the public can no longer write to the database through either:
- The certificate question is the applicant's own statement and is not treated as evidence. The screen says so where it is displayed. Evidence is a sighted document in the staff records, and a practising certificate is checked before anybody starts, not from a web form.
- Nothing is asked that belongs to a safety check. No date of birth, no address, no criminal-record question. A safety check is required before a children's worker starts; answering any of it into an unauthenticated public form would be a disclosure made before anybody had even decided to read the application.
- CVs are not stored by the software. They still go to the careers mailbox, so the centre holds them the way it always has. A CV carries an address, an employment history and referees' names and phone numbers (third parties who agreed to nothing), and storing it needs a retention rule and a deletion path that do not exist yet.
- Only the centre's owner and manager can see an application. Not educators, even at the same centre. Enforced by Postgres, and asserted by the isolation suite rather than claimed here.
Deletion, unusually, is available. The centre can destroy an application outright, and the audit log records that a deletion happened while keeping no copy of the row. That is asserted in the test suite, so "we removed your application" is a checkable statement rather than a reassuring one. This is not a change to the position below: the Act still gives no general right to erasure. It is the centre choosing not to keep the employment history of somebody it did not employ, which is the retention principle rather than an erasure right.
About somebody making an enrolment enquiry
Since 2026-09-25 no form on the public website sends enquiries to the software. The website is not connected to the software yet, so its enquiry form emails the centre's own enrolment mailbox and nothing from it is stored in the database. That email is the only copy. It is held in the centre's mailbox, can be read by anyone the centre gives access to that mailbox, and is kept for as long as the centre's own mail practice keeps it: no rule in the software reaches it. The software can still hold an enquiry, and what follows describes how it treats one.
Until 25 September 2026 enquiries held by the software came from the public website's enquiry form, which asks the same questions but now sends the answers only by email, where the "Who can see it" column below does not apply. An enquiry requires your name, your email, which centre you are asking about, roughly when you would like to start, and how you heard about us. Your phone number, which days you would like, and anything you want to write are all up to you.
About the child it asks three things, every one of them optional:
| What | Why it is held | Who can see it |
|---|---|---|
| Your child's first name | So the centre can talk about your child by name when it rings you back | The centre's owner and manager |
| Your child's date of birth | Which room, when your child would move up, and where they sit on a waiting list | The centre's owner and manager |
| A tick for "my child is not born yet" | Families often join the waiting list before the birth | The centre's owner and manager |
It also asks how you heard about the centre, from a short list. That one is required, and it is about you rather than your child.
Four things about this are deliberate. Until 25 September 2026 this was one of only two places where somebody who is not a member of the centre could write to the database; nothing on the public website uses it now, and the public's access to it has been withdrawn:
- Every question about your child is optional. An enquiry that names no child and gives no date is a complete enquiry, and the centre will ring you back the same way. The database columns are nullable, not just the form, and the test suite asserts that so it cannot quietly become required.
- There is no surname field. The centre asked for a first name, on the basis that it is what they use when they ring you.
- What it will never ask is anything belonging to an enrolment record: no address, no National Student Number, no ethnicity or iwi, no allergies, no medical or health information, no question about custody or guardianship. Those are collected once your child is enrolled, after you have met the centre. The test suite checks the enquiry's database function for every one of those and fails if any appears.
- Only the centre's owner and manager can see an enquiry. Not educators.
Deletion is available here, and for the same reason it is on job applications: this table was written to by members of the public until 25 September 2026 and may hold messages about named children, and not keeping what is no longer needed is what the retention principle is about. Note that New Zealand law gives you a right to see and to correct what is held about you, but no general right to have it erased. The centre deleting an old enquiry is the centre following its retention rules, not you exercising a right of erasure.
Changed on 2026-09-14. Until that date this form asked no child's name and no date of birth at all.
Changed on 2026-09-25. From that date the public website's enquiry form writes nothing to the software and only emails the centre, because the website is not connected to the software yet. The enquiries it had already written were exported for the centre and deleted from the software that day. The centre had already received each of them by email. Copies stayed in the software's daily database backups taken before the deletion until those backups expired; since 3 October 2026 no database backup holds them.
About a family on the waiting list
Separate from an enquiry, this is the list the centre keeps of families waiting for a place, entered by the office.
| What | Why it is held | Who can see it |
|---|---|---|
| The child's name and date of birth, a guardian's name and a contact, when a place is wanted from and on which days, a note, and how the entry was resolved | Managing places | The centre's owner and manager. Not educators |
Technical
An email address and password for anybody with a login. A device token for anybody who turns on notifications. A log of who changed what and when, recording the names of the fields that changed and never their contents, so the log itself holds no information about any child.
What the software does not collect
- No payment card details. There is no payment processing.
- No analytics, no advertising identifiers, no tracking of any kind. There is no third-party analytics script in either app.
- No location data from any device, and no GPS. At a centre, a sign-in records a time, not a place. At a home-based service a sign-in can also record which home the care was given in, because the Ministry requires that home's address on every attendance record. The address is held once, in a list of the service's homes that only its staff can see, not on the attendance record a family reads.
- No biometrics.
- No contact list, calendar or photo library access beyond the photo a user chooses to attach.
- No staff member's date of birth. The annual return asks for an age band, and the band is what is held.
- No name for a visiting child. The software holds a count of visiting children by age band, not a person.
- No text messages. The software sends no SMS.
Where it is held
In a Postgres database and file storage operated by Supabase, in Sydney, Australia (ap-southeast-2). The web application that reads it runs on Railway, in Southeast Asia. Both are confirmed from the deployment rather than assumed: the Supabase region was read from the provider's own project record on 2026-09-02, and the Railway region from its dashboard.
Two regions matter and they are not the same: Supabase holds the records at rest, Railway processes them in transit.
Neither is in New Zealand. Your children's records are stored in Australia. The Privacy Act permits that (IPP 12 requires comparable safeguards, not domestic hosting), but a centre should be told plainly rather than left to discover it, and a centre adopting this statement should satisfy itself that the arrangement is one it accepts.
Error reporting to Sentry is built into the software and is switched off until it is configured, so no error report is sent today. When it is switched on, error reports will go to Sentry when something breaks. Those reports are scrubbed before they leave: email addresses, phone numbers, dates of birth and any database value quoted inside an error message are removed. That scrubbing has its own tests, because a bug in it does not produce a wrong screen. It sends a child's medical information to a third party.
Emails from the software are sent by Resend, a company outside New Zealand, from noreply@kindra.co.nz. Resend handles these emails in the United States. The software sends:
- invitations to staff and parents, and password reset emails, each only to the person it is for;
- reminders to your centre's owners and managers about returns that are due, and on the first of each month a notice to them that the month's compliance pack is ready to print;
- a notice to your centre's owner when records of children who have left have passed their retention period and are ready for the owner to review;
- an emergency message, when your centre's owner or manager sends one, to the centre's staff and to the guardians linked to a child currently enrolled. Each person receives it as a blind copy, so nobody sees anyone else's address. Replies go to the centre's own email address where one is recorded; otherwise the email asks people to contact the centre directly;
- any problem report someone at your centre sends us;
- an alert to us if a message to the Ministry of Education is held back, which names the centre and no person.
To deliver an email, Resend receives the address and the email itself, which can include the person's name and your centre's name. An emergency message contains whatever the centre wrote in it, and a problem report whatever its writer put in it. The reminders and notices contain no child's or family's details.
If your centre's parents reach the parent portal through your own website's address, that traffic passes through Cloudflare, a company outside New Zealand, which runs that address for your website. Cloudflare carries everything a parent sends and receives in the portal on the way to and from the software, including their sign-in, and does not store the records. The staff console does not pass through Cloudflare.
A daily backup copy of uploaded photographs and files is held by Cloudflare, in its R2 storage service, separately from the main system, so that they can be recovered if the main storage is lost. We ask Cloudflare to keep this copy in the Oceania region, but Cloudflare does not guarantee where it is held, so it may be held outside Australia. A photograph or file deleted from the software stays in this copy for seven days and is deleted from it within about a day after that.
A daily copy of the database itself, to the same Cloudflare storage, is built and switched off. It would hold every record this statement describes. It stays off until this statement says where that copy is held and your centre has been told in writing.
The mobile app registers each phone for push notifications through Expo, whose service also builds the app. When you turn notifications on, the app stores a token for your phone, and a push notification would reach it through Expo. Nothing sends a push notification yet. Where Expo would handle one is not recorded in this statement yet.
UptimeRobot checks every five minutes whether the staff console, the parent portal and this website are up, and shows the result on a public status page. It is not signed in, and a caller who is not signed in can reach no record, so it receives nothing about any child, family or staff member.
If your centre's owner connects the centre's own Xero organisation, the software stores the credential Xero issues, encrypted with a key held outside the database, in a table no login can read; only the owner can connect or disconnect it. Nothing is sent to Xero yet: sending fee invoices and reading payments back are not built, and no centre has connected a real Xero organisation. Before anything is sent, this statement will say what is sent and where Xero holds it.
Written summaries, if your centre turns them on
This is off unless somebody at your centre has switched it on, in Settings. While it is off, nothing described here happens and nothing leaves for this purpose.
With it on, this product can send totals and dates to Anthropic, a company outside New Zealand, and get back a paragraph you can put in a report: how many breaches there were in a month, how much is overdue and for how long, which days next week are short.
What is sent is numbers and dates that this product calculated. No child's name, date of birth, National Student Number or health information is ever sent, and neither is any staff member's or family member's. That is not a promise about care taken: the code that builds what gets sent can only carry numbers, and it refuses to run rather than send anything else. Like the error-report scrubbing above, it has its own tests, and those tests are checked by deliberately breaking the rule and confirming they notice.
Anything written this way is a draft for a person to check. It is never a finding about your centre's compliance, and nothing in the evidence binder comes from it unless somebody has read it and put it there.
If your centre would rather not use it, leave it off. Nothing else in the product changes.
Who can see what
Separation is enforced by the database, not by the application. Every table carries row-level security, and there are two boundaries:
- Between centres. A person at one centre cannot read another centre's records, even where the same person works at both. A dedicated isolation suite re-tests this on every change to the product, including that a write across the boundary is refused, not just a read. It is the largest suite we run and it runs as its own gate, separate from the ordinary tests, because a failure here means something different from a failing feature.
- Between families inside one centre. A parent sees their own children and nobody else's. This is keyed on the guardianship record, so it survives a role change.
Photographs have a third gate. A photo of a child whose whānau have not consented is refused when it is uploaded. Should consent be withdrawn later, the photo becomes unreadable rather than merely hidden: the link the browser needs can no longer be issued.
A photo in a pānui, a notice every family at the centre can read, is shown to other families only if every child in it has consent for photos shared publicly. With consent for the learning journal only, it is seen by the child's own whānau and the centre's staff, and nobody else.
When a guardian withdraws a consent, the centre's owners and managers get a notice in the software naming the guardian, the child and the consent.
The door tablet can see, for each child, a display name and whether the child is here; and for each of a child's guardians, their name, whether they may collect, whether they have a PIN, and whether they are an authorised signatory. It sees no date of birth, no photograph, no contact details and no address, and at a home-based service it cannot read the address of the home it stands in.
Who the centre shares it with
Outside the centre and Salix, the information goes to these people, and only these:
- The Ministry of Education, as a condition of funding. The centre gives the Ministry each child's details, enrolment and attendance; staff details in the annual ECE Return (the census); and, at the services that file one, teacher details in the monthly Waha Rumaki or PITA return.
- On request, for audits and reviews. The Ministry's Funding Handbook requires the centre's records to be available to Ministry of Education staff, reviewers from the Education Review Office (ERO) and other authorised personnel. That includes enrolment and attendance records, and the staffing record with copies of practising certificates and qualifications.
What the Ministry does with what it receives is the Ministry's to say. Its Funding Handbook says that enrolment, attendance and ECE Return information is shared by the Ministry only where the Privacy Act 2020 or other primary legislation permits, such as the Data and Statistics Act, the Oranga Tamariki Act or the Family Violence Act, and that information in a Waha Rumaki or PITA return may be shared with the Teaching Council to verify a teacher's registration.
Your rights
- To see what is held about you or your child. Ask the centre. The Act gives you this right and the centre must respond.
- To ask for a correction. Also a right. Where the centre disagrees, you may ask for a statement of your view to be attached to the record.
On deletion: New Zealand law does not give a general right to have information erased. That is European law and it does not apply here. What the Act does require is that information is not kept longer than it is needed. See how long information is kept for how long that is and why.
If something goes wrong
A privacy breach that is likely to cause serious harm must be notified to the Office of the Privacy Commissioner and to the people affected. The centre is the agency that notifies; Salix's obligation is to tell the centre immediately and to help establish what happened. The steps, and the timeframes, are in Salix's breach response procedure.
Who to contact
- The centre's privacy officer, for anything about your own or your child's information. Every agency must have one, and a centre adopting this statement puts its privacy officer's name and contact details here.
- Salix, for anything about the software itself: vakkas@salixtech.co.nz.
- The Office of the Privacy Commissioner, if a complaint is not resolved: privacy.org.nz.
Template last updated 2026-10-07. A centre adopting it should date its own version and review it whenever what the software collects changes.