Privacy policy

NeoNest is published by a sole trader (auto-entrepreneur) based in Agadir, Morocco. Contact: administration@neonest.ma.

For the data entered in NeoNest (children, parents, staff), the daycare decides what is recorded: it is the data controller. NeoNest acts as its processor: we process this data only on its instructions and only to run the service.

For data related to our own business (the neonest.ma website, demo requests, daycare subscriptions), NeoNest is the data controller.

• Daycare staff: last name, first name, email address, role, assigned groups, daily attendance status, profile photo (optional) and password (stored hashed, never in plain text).
• Parents: last name, first name, phone number, WhatsApp number (optional), email address, profile photo (optional), messages exchanged with the daycare, comments on the daily report, enrolment requests and invoices issued by the daycare.
• Children: last name, first name, date of birth, group, arrival and departure times, daily report (meals, mood, naps, bottles, nappy changes, staff comments) and photos taken by the daycare.
• Location (parent app, optional): if you use directions to the daycare, your position or the starting address you choose, and the addresses you decide to save.
• Technical data: device notification identifier, security logs (IP address, date, action performed) and error reports from the web workspace.

The current version of NeoNest collects no health data (no allergies, no medical information).

• Running the service: attendance, daily report, photos, messaging between the daycare and parents, invoices, enrolment requests.
• Managing accounts: invitation, sign-in, password reset.
• Notifying you (new report, new photo, new message).
• Calculating directions to the daycare, when you ask for them.
• Securing the service and fixing technical errors.
• Answering demo and contact requests.

Your data is never sold, rented or used for advertising or profiling.

Each processing operation relies on one of the bases set out in the GDPR (Article 6) and Moroccan law no. 09-08 (Article 4):

• Performance of a contract: providing the service to the daycare and, through it, to parents and staff (accounts, attendance, reports, messaging, invoices).
• Consent: photos of children (collected by the daycare from parents), notifications and location (your phone's permissions, which you can withdraw at any time in its settings).
• Legitimate interest: security of the service, abuse prevention, error fixing, answering demo requests.
• Legal obligation: keeping invoices.

• The daycare: its management and staff, according to their role.
• Parents: only the data of their own children. Only the news posted by the daycare is visible to all parents of that daycare.
• NeoNest: only when needed for support or maintenance.
• Our technical service providers, listed below, only for the part of the service they provide.

Our service providers:

• Neon — database — Germany (EU)
• Microsoft Azure — application servers and photo storage — Netherlands (EU)
• Sentry — error monitoring for the web workspace — Germany (EU)
• OpenRouteService (HeiGIT) — route calculation — Germany (EU)
• OpenStreetMap — address search and map tiles — United Kingdom
• Google — sending emails, website fonts — United States
• Expo, Apple and Google — delivering notifications — United States
• Calendly — appointment booking on the "Book a demo" page — United States

Your data is stored in the European Union (Germany and the Netherlands), whose level of protection is recognised as adequate.

Some providers are based in the United Kingdom or the United States. We only send them what their service requires: email address and email content, the starting point of a route, and the IP address of website visitors. Notifications only contain generic text (for example "Today's report is available"): no names, no message content, no details of the child's day. These transfers rely on the safeguards offered by these providers (European Commission standard contractual clauses or the EU–US Data Privacy Framework).

• Accounts, children's data and content (reports, photos, messages): for the duration of the contract between the daycare and NeoNest, then deleted no later than 3 months after that contract ends or the child leaves.
• Invoices: 10 years (accounting obligation).
• Security logs: 12 months.
• Notification identifier: until you sign out of the app.
• Demo and contact requests: 3 years after the last exchange.

• All connections are encrypted (HTTPS) and our hosting providers encrypt stored data.
• Passwords are hashed: nobody, not even NeoNest, can read them.
• Photos can only be accessed through signed, time-limited links.
• Each user only accesses the data their role allows.
• On the phone, your session is kept in the device's secure storage.
• Sensitive actions are logged.

The NeoNest apps are intended for adults: daycare staff and parents. No child has an account and our apps are not directed at children.

• Who enters the data: the daycare (management and staff). Parents can fill in an enrolment request and comment on the daily report.
• Who can access it: the child's parents and their daycare's team. A child's photos and daily report are never visible to other parents. The daycare's general news, visible to all its parents, is the daycare's responsibility; it makes sure to show only children whose parents have agreed.
• Parental consent: the daycare obtains the parents' agreement, in particular for photos, at enrolment, and NeoNest requires this by contract. Parents can withdraw this agreement at any time through the daycare.
• Data minimisation: only information useful for caring for the child is processed, with no health data in the current version. Photos are never public and never used for commercial or advertising purposes.
• Protection: the measures in the "Security" section apply, in particular signed, time-limited links for photos.
• Retention: a child's data is deleted no later than 3 months after they leave the daycare.

You have the right to access, rectify, erase, object to, restrict and port your data, and to withdraw your consent at any time.

To exercise these rights, write to administration@neonest.ma or contact your daycare. We reply within one month and may ask you to prove your identity.

You can also lodge a complaint with the CNDP (Moroccan data protection authority, www.cndp.ma) or, if you live in the European Union, with the data protection authority of your country.

You can ask at any time for your NeoNest account (parent app, staff app or web workspace) to be deleted:

• write to administration@neonest.ma from your account's email address, with the subject "Account deletion";
• we delete your account and your personal data within 30 days and confirm it by email.

We only keep: invoices, for the legal period, and your child's data while they are enrolled at the daycare, which remains responsible for it (see "How long we keep it").

The neonest.ma website sets no cookies and uses no analytics or advertising tools. Its fonts are loaded from Google Fonts, which therefore receives your IP address. The "Book a demo" page embeds Calendly, which may set its own cookies. If you write to us on WhatsApp, your messages go through WhatsApp (Meta).

The web workspace and the apps use no advertising trackers or audience analytics. They only keep on your device what is needed to keep you signed in.

We may update this policy to reflect changes to the service or to regulations. The date of the last update is shown at the top of this page.

NeoNest — Agadir, Morocco — administration@neonest.ma