Privacy Policy

Seedlist (“we,” “us,” or “our”) operates the Seedlist platform at myseedlist.com (the “Service”). This Privacy Policy explains how we collect, use, disclose, and protect information when you use our Service, whether as a childcare center director (“Director”) or a parent or guardian submitting a waitlist application (“Parent”).

By using the Service, you agree to the collection and use of information in accordance with this policy. If you do not agree, please do not use the Service.

1. Information We Collect

1.1 Information Provided by Directors

When you create a Seedlist account, we collect:

• Your first name, last name, and email address
• Your center's name and contact information
• Classroom configuration (names, age ranges, capacity)
• Account credentials (passwords are stored in hashed form only)
• Billing information (processed and stored by Stripe; we do not store payment card details)

1.2 Information Provided by Parents

When a parent submits a waitlist application through a center's intake form, we collect:

• Parent first name, last name, email address, and phone number
• Child's first name, last name, and date of birth (or expected due date)
• Desired start date and schedule preferences
• Any additional information the Director has configured on their intake form (e.g., referral source, notes, allergies)

1.3 Information Collected Automatically

When you access the Service, we may automatically collect:

• Log data (IP address, browser type, pages visited, time of access)
• Cookies and similar technologies for session management and authentication

2. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain the Service
• Process waitlist applications and manage enrollment pipelines on behalf of Directors
• Send transactional emails (account verification, password resets, automated “still interested” check-ins on behalf of Directors)
• Process payments and manage subscriptions
• Respond to support requests
• Improve the Service, fix bugs, and develop new features
• Comply with legal obligations

We do not use your information to serve advertisements. We do not sell, rent, or trade personal information to third parties for marketing purposes.

3. Children's Information and COPPA

Seedlist collects limited information about children (name, date of birth or expected due date) solely to facilitate waitlist management on behalf of childcare providers. This information is collected from parents or guardians, not directly from children.

We act as a service provider to childcare centers. Directors are the data controllers responsible for the child data they collect through the Service. We collect and process children's information on behalf of the childcare provider and at their direction, consistent with the Children's Online Privacy Protection Act (COPPA).

We do not knowingly collect personal information directly from children under the age of 13. If you believe we have inadvertently collected such information, please contact us immediately and we will delete it.

4. Data Sharing and Third-Party Services

We do not sell your data. We share information only with the following categories of service providers, solely to operate the Service:

• Stripe — Payment processing. Stripe receives your billing information to process subscriptions. Stripe's privacy policy is available at stripe.com/privacy.
• Resend — Transactional email delivery. Resend processes email addresses and message content to send emails on behalf of Directors (e.g., still-interested check-ins, status notifications). Resend's privacy policy is available at resend.com/legal/privacy-policy.
• Neon (PostgreSQL hosting) — Database infrastructure. All application data is stored in a Neon-hosted PostgreSQL database. Neon's privacy policy is available at neon.tech/privacy.
• Vercel — Application hosting. Vercel serves the web application and may process log data. Vercel's privacy policy is available at vercel.com/legal/privacy-policy.

We may also disclose information if required by law, court order, or governmental regulation, or if we believe disclosure is necessary to protect our rights, your safety, or the safety of others.

5. Data Access and Ownership

Directors control the waitlist and enrollment data within their account. Only the Director(s) associated with a center can access their center's data through the Service. Seedlist staff do not access customer data unless required for technical support with the Director's explicit permission, or as necessary to maintain the Service.

Parents can view their own waitlist status through their unique status link. Parents do not have access to other families' information.

6. Data Security

We implement industry-standard security measures to protect your data:

• All data is encrypted in transit using TLS/SSL (HTTPS)
• Database data is encrypted at rest
• Passwords are salted and hashed using bcrypt
• Authentication sessions use secure, signed tokens
• Access to production systems is restricted to authorized personnel

While we strive to protect your information, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security but commit to promptly addressing any breach in accordance with applicable law.

7. Data Retention

We retain your data for as long as your account is active or as needed to provide the Service. Specifically:

• Active accounts: Data is retained for the duration of the subscription.
• Canceled accounts: Data is retained for 90 days after cancellation to allow for reactivation, then permanently deleted.
• Archived waitlist entries: Retained within the Director's account until the Director deletes them or the account is closed.

We may retain anonymized, aggregated data (which cannot identify any individual) for analytics and service improvement purposes.

8. Your Rights and Choices

Depending on your jurisdiction, you may have the right to:

• Access the personal information we hold about you
• Correct inaccurate or incomplete information
• Delete your personal information (subject to legal retention requirements)
• Export your data in a portable format
• Withdraw consent for data processing where consent is the legal basis

Directors can export their waitlist data at any time using the built-in export feature. To request account deletion, contact us at the address below.

Parents who wish to access, correct, or delete their information should contact the childcare center directly, as the center is the data controller for waitlist applications. Parents may also contact us and we will assist in directing the request.

9. Cookies

We use essential cookies for authentication and session management. These cookies are strictly necessary for the Service to function and cannot be disabled. We do not use advertising or tracking cookies.

10. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify Directors by email or by a prominent notice within the Service at least 30 days before the changes take effect. Your continued use of the Service after the effective date of a revised policy constitutes acceptance of the changes.

11. Contact Us

If you have questions about this Privacy Policy, your data, or wish to exercise your rights, please contact us at:

Seedlist
Email: [email protected]