Privacy Policy · Terms of Service · Data deletion

Privacy Policy

Effective date: 16 September 2026

Last updated: 10 October 2026

Version: 1.7

KindyMenu Pty Ltd (ABN 46 700 825 369) trading as KindyMenu ("we", "us", "our") respects your privacy and handles personal information in accordance with the Australian Privacy Act 1988 (Cth), the 13 Australian Privacy Principles (APPs), and the Notifiable Data Breaches scheme. We commit to APP-equivalent handling of personal information whether or not the Privacy Act applies to us in a given period.

This Privacy Policy applies to the KindyMenu childcare menu planning, food safety record-keeping and parent communication software ("Service"), and to any related websites, mobile applications, or APIs we operate.

Related documents: the Terms of Service, the Data Processing Addendum (which governs our processing of personal information on your centre's behalf) and the Acceptable Use Policy.

1. What we collect

1.1 Personal information you provide

• Account details: name, email address, password (protected with bcrypt on our servers — we never see your password in clear).
• Centre & organisation details: centre name, address, ABN, service approval number, contact phone.
• Staff profiles: staff member names, roles, PINs (protected with a slow, salted hash (PBKDF2) — we cannot recover them), food safety certificates (HLTAID011, SITXFSA005, etc.) and their expiry dates, photo of certificate (optional).
• Operational records: menus, recipes, ingredient prices, cleaning records, HACCP temperature logs, equipment maintenance, pest control visits, food recalls screened, incoming goods logs.
• Children's information. Your centre decides what it records. The Service can hold a child's first name and last initial, room, date of birth, photo, allergies and their severity, dietary, cultural and religious dietary needs, an ASCIA action plan (including an uploaded copy), medication details and where medication is kept, medication expiry dates, an action plan summary, emergency contacts, a doctor's phone number, and the name of the parent who confirmed the record. Health information and information about religious beliefs are sensitive information under the Privacy Act.
• Parent communication: where your centre uses the parent-facing features, we hold the parent's email address (used to sign in to the Parent Portal with a password and a one-time code sent by email, and to send a password reset link), the parent's password (protected with bcrypt on our servers), the content of messages and note threads exchanged between the centre and the parent, any files or photographs attached to them, and meal ratings and feedback a parent chooses to record.
• Mobile numbers: the account owner's mobile number, if the owner turns on SMS backup sign-in codes, and a parent's mobile number, if the centre records it so staff can send an emergency SMS. If sign-in is frozen after wrong attempts, the same parent mobile number (or the owner's backup number) can receive a one-time unlock code by SMS.

1.2 Automatically collected

• Device and usage data: browser type, screen size, anonymous device id, page navigation, error logs (Vercel Analytics + our own debug ring buffer).
• Sign-in attempt records: to count wrong sign-in attempts and freeze sign-in for 1 hour after 3, we keep a random identifier of the browser and a hashed IP address with each account's attempt counter. Records of individual failed attempts are normally removed after 2 days.
• Performance metrics: load times, Web Vitals, crash and error reports (we redact anything matching pin/password/salt/hash/token/secret/apikey before it is sent, but a redaction filter is not a guarantee — see section 5.4).

1.3 What we do NOT collect

• Government identifiers (Medicare, TFN, driver's licence) of children, parents, or staff.
• Payment card numbers (handled by Stripe — see section 6).
• Health information of children beyond what your centre records about allergies, diet, medication and action plans (see section 1.1).
• We do not build advertising profiles, and we do not sell personal information to anyone, ever.

2. Why we collect it (purposes)

We collect, hold, and use personal information only for the following purposes:

1. To provide the Service: account creation, authentication, menu planning, record-keeping, parent communication.

2. To support your own record-keeping as a childcare operator — including the National Quality Standard, the Education and Care Services National Regulations, and Food Safety Standards 3.2.2 and 3.2.3. The Service supports your processes; it does not discharge your obligations.

3. To detect, prevent, and respond to security incidents, fraud, and abuse.

4. To improve the Service (aggregate analytics — never sold to third parties).

5. To send essential service emails and SMS (sign-in codes, account verification, password reset, staff invitations, security alerts such as a notice that sign-in was frozen, billing, sign-in unlock codes by SMS, and emergency SMS from a centre to a parent). Marketing communications require your explicit opt-in.

We do not use personal information held in the Service to train artificial intelligence models. KindyMenu has no AI provider of its own and does not send data to AI services on its own. The features labelled "Smart suggestions (no AI)" are KindyMenu's own built-in rules and algorithms; they run inside KindyMenu and send nothing to anyone. If your centre chooses to connect its own external AI key, that provider's own terms decide how it may use the data — see section 5.1.1.

3. Children's privacy and the Children's Online Privacy Code

The Children's Online Privacy Code is being made under the Privacy Act. As at the date of this policy it exists as an exposure draft and must be registered by 10 December 2026. Under the Privacy Act the Code binds APP entities. Whether and when it binds KindyMenu depends on whether we are an APP entity at that time. We are treating the draft Code's standards as a design target now rather than waiting.

Because the Service holds information about children attending childcare, the following protections apply today:

• The Service is built to hold only child information that the kitchen and the centre need for meals, allergies and communication with the child's own parent (see section 1.1). Your centre decides which of those fields it fills in.
• We do not profile children, build behavioural advertising audiences, or share child-linked data with any third party for that third party's own purposes.
• We design default settings to protect children's privacy.
• Access to child-linked records inside your centre is gated by Role-Based Access Control and PIN. Parent-facing features are scoped so that a parent sees only the children the centre has linked to that parent.
• We never use child information to train artificial intelligence models or for any secondary research.
• A parent or guardian can request, through your centre, the deletion of records mentioning their child. Deletion is subject to the retention obligations in section 8, which bind the centre — a record the centre must keep for three years cannot be deleted on request.

Separately, the automated decision-making transparency amendments (APP 1.7–1.9) commence 10 December 2026 and apply to APP entities. KindyMenu does not use automated decision-making to make, or to do anything substantially and directly related to making, a decision about an individual that could reasonably be expected to significantly affect their rights or interests. The built-in "Smart suggestions (no AI)" and any external AI your centre connects only produce suggestions for a human to accept, edit or reject.

4. How we hold and protect it

• Hosting: The database, authentication, file storage, Edge Functions and backups are hosted by Supabase on AWS infrastructure in the Sydney (ap-southeast-2) region. Region selection is a data-location control, not proof of regulatory compliance — see section 5.4 for the data that does leave Australia.
• Encryption in transit: TLS 1.2+ for all connections.
• Encryption at rest: AES-256 at the Supabase storage layer.
• Authentication: passwords are protected with bcrypt on our servers (we do not use Supabase Auth's built-in login; a password is checked only inside our own database functions). Staff PINs are protected with a slow, salted hash (PBKDF2). Every role signs in with a password and then a one-time code sent by email. One-time codes are stored hashed, never in clear. After 3 wrong attempts on a device, sign-in for that account on that device is frozen for 1 hour.
• Security reports: report security issues to security@kindymenu.com. We aim to fix critical vulnerabilities within 7 days and others within 30 days.
• Row-Level Security (RLS): enabled on every database table. Tables reachable directly through the API filter every row by tenant and role; tables reserved for internal use are instead blocked from direct API access entirely, reachable only through a controlled database function. Either way, a user from one centre cannot read another centre's data, even if they guess the URL.
• Closed mail and SMS paths: the email and SMS sending functions are not callable from the browser. They can only be invoked through server-side gateways with the caller's credentials and centre membership verified first. We never put a password in an email; invitations and resets carry a single-use link or code instead.
• Audit logging: changes to food-safety and kitchen records are logged with actor, timestamp, and prior value.
• Backups. Every day at about 2:15 am Brisbane time we take an automatic backup snapshot of each active organisation's data. Snapshots are stored in the same Supabase database in Sydney (ap-southeast-2), with the same encryption and access controls as the live data. We keep one snapshot per day for 30 days, then one per week up to 12 weeks, then one per month up to 60 months. Users with the backup permission in your organisation can also take a manual snapshot; manual snapshots are kept while the account is active, until they are deleted. These retention periods apply to active accounts; when an account closes, its snapshots are deleted with its data (see After your account closes). A safety snapshot taken just before a restore is kept for 7 days. Snapshots are used only to restore your data after an error or an incident. They cannot be reached through the public API: only our server-side functions (service role) can read them, for your organisation only. Supabase also keeps its own platform backups of the whole database for a limited period set by its service plan. Export. Users with the backup permission can download the Recovery Kit at any time: a file with the data held in your kitchen workspace, including menus, recipes, children with their dietary and allergy records, stock, suppliers and receipts. Food-safety registers can be printed from the app. A complete copy of all your organisation's records, including food-safety logs and parent messages, is available free of charge on request to support@kindymenu.com.

5. Who we share it with (and when)

We never sell personal information.

5.1 Subprocessors

We disclose personal information to the following providers, who act on our instructions and are bound by their own terms of service and confidentiality obligations. This list is accurate as at the "Last updated" date.

Our social pages. Our website links to our YouTube channel and our Instagram profile. If you open them, YouTube (Google) or Instagram (Meta) handles your information under its own privacy policy. We do not add tracking from those platforms to our website or app. If you comment on our Instagram posts or message @kindymenu, see section 5A.

KindyMenu itself does not sell child information and does not share it with anyone for their own purposes.

Groups of centres. If a centre belongs to a group on the Multi or Enterprise plan, the group owner and the network managers the group chooses can see the records of every centre in the group, including children's allergy records and parent notes. Staff of each centre see only their own centre. Ingredient lists, prices and supplier lists stay inside the organisation and are not shown to other customers.

SMS. SMS messages are sent through Brevo for three purposes only: a backup sign-in code to the account owner's mobile, if the owner turns it on; a one-time unlock code when sign-in is frozen after wrong attempts, sent to the parent's mobile number on file (or the owner's backup number); and an emergency text from centre staff to a parent's mobile number on file. Brevo receives the mobile number and the message text. The sending function is not callable from the browser and has daily limits. We do not send marketing SMS. An SMS from KindyMenu may show the sender as "Unverified". In an emergency, always phone the parent as well.

Email tracking. Brevo's open and click tracking are on for every email we send through Brevo, including sign-in codes and letters to parents. We use them to check that important emails are delivered and opened. Sign-in codes and other system messages come from noreply@kindymenu.com; letters and reports from a centre come from hello@kindymenu.com. If you use an email's unsubscribe link, Brevo stops further email from that address to you, and we may show your centre that email to you is blocked.

5.1.1 Services your centre chooses (not our subprocessors)

KindyMenu does not provide AI. External AI is optional and works only if your centre adds its own API key in Settings. A staff member must first tick "I understand and accept" under a notice. The centre then chooses the provider, holds the account with it, and decides what to upload. The browser sends that content directly to the chosen provider, under that provider's terms. KindyMenu does not receive a copy of the AI request or reply on its servers.

Processing may also happen in other countries, under each provider's terms. The menu generator sends only the recipe list (dish names, food groups, allergens), never children's names or records. Child import does not use external AI. Price-tag reading sends the photo or text that staff choose, and only after staff tick a warning.

Allergy and dietary details are health information, which is sensitive information under the Privacy Act. Your centre decides whether to send any of it to an external AI service and is responsible for that decision, including any consent it needs. Before sending, cover the surname, address, date of birth and Medicare number. Do not upload children's photos or unnecessary personal details.

Voice input in the kitchen assistant is optional and uses your browser's own speech service. In Chrome, the audio is processed by Google.

If your centre adds a Slack webhook for monitoring alerts, those alerts go to Slack (United States) under your centre's Slack account.

5.2 Other disclosures

1. Law enforcement or regulators if compelled by valid Australian legal process (warrant, court order, regulator notice), and only the strictly required information.

2. A successor entity in case of merger, acquisition, or asset sale — your data continues under this Privacy Policy or a substantially similar one, and you will be notified.

5.3 Notice of change

We will notify account admins by email before adding a new subprocessor that receives personal information, and before relocating the hosting of Service data to a different country.

5.4 Cross-border disclosures

Some personal information does leave Australia.

The core of the Service — database, authentication, file storage and backups — stays in the Sydney region. The following flows go offshore:

• Optional external AI (usually the United States). Only if your centre has added its own key (section 5.1.1). Your browser then sends what staff upload directly to the provider your centre chose. Most of these providers are in the United States; Mistral is in France. Anything uploaded to external AI leaves Australia. This is your centre's decision and responsibility. Do not upload children's photos or unnecessary personal details, and cover the surname, address, date of birth and Medicare number. The Acceptable Use Policy also covers this. The built-in "Smart suggestions (no AI)" send nothing.
• Transactional email and SMS (European Union). Brevo receives the recipient's email address or mobile number and the content of the message we send them. Brevo's open and click tracking tell Brevo when an email is opened and which links in it are clicked.
• Error monitoring (if enabled). Sentry is not enabled in the live app at the "Last updated" date. If enabled, Sentry receives error and diagnostic data. We redact common secret patterns before sending, but redaction is best-effort, and an error report can incidentally contain personal information.
• Hosting and billing. Vercel serves page assets and request metadata from a global edge network. Stripe processes billing data internationally.
• Web resources. Google Fonts, YouTube (when a video is played), public code CDNs and ipify receive your IP address and browser details. Open Food Facts (France) receives barcode numbers.

Overseas disclosure statement (APP 1.4(f) and (g)). We are likely to disclose personal information to overseas recipients. They are located in the United States, the European Union (France) and on global networks, as listed in sections 5.1 and 5.1.1. External AI providers receive data only if your centre connects them with its own key.

Where the Privacy Act applies to a disclosure, APP 8 governs it and we will take steps reasonable in the circumstances to ensure an overseas recipient handles the information consistently with the APPs. If your centre is an APP entity, it has its own APP 8 obligations and its own accountability under s 16C for personal information it discloses. The Data Processing Addendum sets out what we do to help you meet them, and section 5.1 gives you the country-level detail APP 8 notice requires.

5A. Instagram (Meta) data we receive through KindyMenu Publisher

KindyMenu Pty Ltd runs the Instagram Business account @kindymenu. We use our own app, "KindyMenu Publisher", which connects to Instagram through Meta's Instagram API (Instagram API with Instagram Login), to publish our posts and to read and answer comments and direct messages sent to @kindymenu.

What we receive. When you comment on our posts or send a direct message to @kindymenu, Meta gives us:

• your Instagram username, your Instagram-scoped user ID and, where Meta provides them, your profile name and profile picture;
• the text of your comment or message, and any photo, video, file, link or Story reply you send us;
• the date and time of your comment or message, and whether it is a reply.

We do not receive your Instagram password, your followers or your private posts. We receive only what you send to @kindymenu, or post on @kindymenu's content.

Why we use it. Only to:

• read and answer your questions about KindyMenu;
• moderate comments on our posts (reply, hide or remove spam or abusive comments);
• keep a record of the conversation so our team can follow up;
• publish our own content to @kindymenu.

What we do not do. We do not sell this data. We do not use it for advertising or to build profiles. We do not use it to train artificial intelligence models, and we do not add it to a centre's KindyMenu workspace. If you later become a KindyMenu customer and ask us to, we may move the relevant conversation into your support record. We do not send you messages you did not start. Our replies are written by people on our team.

Where it is stored and who sees it. The data is stored in our Supabase database in Sydney, Australia (ap-southeast-2), with the same security as the rest of the Service (section 4). Only KindyMenu staff who manage @kindymenu can see it. Meta also processes this data under its own Privacy Policy (privacycenter.instagram.com/policy). We handle data from Meta in line with the Meta Platform Terms and Developer Policies.

How long we keep it. Our current policy is to keep messages and comments for 24 months after the last message in a conversation and then delete them. We delete them sooner if you ask (see below). If a comment is deleted on Instagram, we remove our copy within 30 days. Access tokens for our own account are deleted when we disconnect the account.

Deleting your Instagram data. You can ask us to delete the Instagram data we hold about you at any time:

• email privacy@kindymenu.com with the subject "Instagram data deletion" and your Instagram username, or
• send "DELETE MY DATA" in a direct message to @kindymenu.

We delete the data within 30 days and confirm by email or by Instagram message. Deleting it from KindyMenu does not delete it from Instagram. You can delete your own comments, and unsend your messages, in the Instagram app. Full instructions: kindymenu.com/data-deletion.

If you connected an Instagram account to KindyMenu Publisher (KindyMenu staff only): you can remove the app at any time in Instagram → Settings → Website permissions → Apps and websites → Remove. When Meta tells us that the app was removed, we delete the access token and the data received through it within 30 days.

Section 5A (Instagram) and the Meta Platforms row in section 5.1 were added on 15 October 2026.

6. Payment data

Payment card details (number, expiry, CVC) are entered directly into Stripe's hosted checkout and never touch our servers. We receive only a subscription status, customer ID, and the last 4 digits of the card. Stripe's privacy practices are governed by Stripe's Privacy Policy.

7. Your rights (Australian Privacy Principles 12 and 13)

You have the right, at any time, to:

• Access the personal information we hold about you.
• Correct information that is inaccurate, incomplete, or outdated.
• Delete your account and associated data (subject to the retention obligations in section 8, which can prevent deletion).
• Export your data: the Recovery Kit button downloads your kitchen workspace data, and we provide a complete machine-readable copy of all records on request (see section 4).
• Withdraw consent at any time for any optional processing.
• Complain to us, and escalate to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or 1300 363 992 if you are not satisfied with our response.

You can contact us without giving your name where that is practical. Complaints: email privacy@kindymenu.com. We will acknowledge your complaint within 5 business days and give you our answer within 30 days. If you are not satisfied, you can complain to the OAIC.

To exercise any right, email privacy@kindymenu.com with the subject line "Privacy request — [Access / Correct / Delete / Export]". We will respond within 30 days, usually much sooner.

If you are a parent, the centre — not KindyMenu — decides on access, correction and deletion requests about your child. See section 11.

8. Retention

Your centre is the record keeper, and KindyMenu is not the system of record for regulated retention.

Under regulation 183 of the Education and Care Services National Regulations, the approved provider — your centre — must keep the documents prescribed by regulation 177 in a safe and secure place for the periods set out below. That duty binds the centre, not the software vendor. KindyMenu gives you exports (section 4) so that you can meet it; the decision about what to keep, and for how long, is yours.

Which classes the Service generates today. KindyMenu has no child incident, injury, trauma or illness register, so the 25-year and 45-year classes are not currently created in the Service. If we add such a module, we will update this section before it ships. The three-year class engages almost everything the Service does hold: the allergy and dietary register, attendance-related records, parent correspondence and note threads, meal photographs, and food safety records that name a child.

How this works inside the Service.

• Active accounts. We retain your data for the life of your subscription, subject to the retention settings you choose.
• Retention settings. You can turn on automatic deletion of old parent messages and notes. If you set a period shorter than regulation 183 requires for a record, you remain responsible for exporting that record and keeping it outside the Service. We do not check your settings against regulation 183 for you.
• Export. The Recovery Kit and a complete copy on request are described in section 4. Records exported from the Service are your responsibility once they leave it.
• After your account closes. Before you close your account, download your records: the Recovery Kit, printed registers, or a complete copy on request to support@kindymenu.com. Your centre is responsible for downloading its records before closure and for keeping the records the Education and Care Services National Regulations require (regulation 183) — for example records of an incident, injury, trauma or illness until the child is 25 years old, and other records about a child for 3 years after the child last attended. For 90 days after closure the account stays read-only so you can still download. About 14 days before deletion we email the account's contact address. 90 days after closure we delete your organisation's data and all its backup snapshots, automatic and manual, and any copy we kept when the account was deleted. Copies in Supabase platform backups then expire within that provider's backup period. If you ask us in writing before deletion to keep specified records (legal hold), we keep them until you tell us to delete them. Billing records are kept for 7 years, as tax and corporations law require, and then deleted. We delete data we no longer need, as APP 11.2 requires. On request we will confirm deletion in writing.
• Parent accounts. A parent's access to the Parent Portal ends when the centre removes the parent or the child leaves, or when the centre's account closes. About 14 days before deletion we email the parent. 90 days after access ends we delete the parent's account, email address, messages and Family Kitchen data. A parent can ask us to delete their own account at any time by emailing privacy@kindymenu.com; we then delete it after the 14-day notice. Records about the child (allergies, diet, attendance and similar) belong to the centre and stay under the centre's control. Paid parent subscriptions are cancelled when the centre's account closes, and refunds are handled under the Refund and Cancellation Policy.
• Regulation 184 transfer. If a service approval transfers to another provider, we will help you export the regulation 177 documents for currently enrolled children so you can transfer them on the transfer date. Parental consent for that transfer is the centre's responsibility.
• Billing records. At least 7 years, as required by tax and corporations law.
• Anonymised analytics. Kept indefinitely, in a form designed so that it cannot be linked back to you.

9. Cookies and similar technologies

We use:

• Strictly necessary cookies and local storage for authentication and session management — these cannot be disabled.
• Analytics (Vercel Analytics) for anonymous page metrics, and error monitoring (Sentry) for crash and error reports, only if you allow it (Sentry is not enabled in the live app at the "Last updated" date).
• No third-party advertising cookies. Ever.

10. Data breach notification

If we become aware of unauthorised access to, unauthorised disclosure of, or loss of personal information held in the Service, we will:

• Notify the affected centre(s) within 48 hours of becoming aware, with the facts we have at that point, and keep updating you as we learn more.
• Cooperate with your assessment. This matters: where we and your centre both hold the affected information, an eligible data breach of ours is an eligible data breach of your centre, and your centre is the entity on the Notifiable Data Breaches clock — all reasonable steps to complete the assessment within 30 days. We will give you what you need to meet it.
• Notify the OAIC ourselves where the Notifiable Data Breaches scheme applies to us.
• Provide a written incident report with root cause, scope, affected records and remediation.
• Publish a transparency note on our status page where the incident affected more than one centre.

11. Children's parents and guardians

How a parent account is created. There is no self sign-up for the Parent Portal. A parent can sign in only after their child's centre adds the parent's email address and invites them. We receive the parent's email address, and the link between the parent and the child, from the centre.

If you are a parent or guardian and a record about your child is held by a centre that uses the Service, contact your centre. For information about children and families the centre is the entity that decides — under privacy law it is the entity that controls the information, and under the Education and Care Services National Regulations it is the approved provider. KindyMenu acts as a processor on the centre's instructions. We will assist the centre to respond within 30 days.

Note that before releasing a record to you, the centre may need another person's written consent where the record contains that person's personal information (regulation 177(4A)–(4C)), and confidentiality obligations under regulation 181 may limit what can be released.

12. Changes to this policy

We may update this Privacy Policy. The "Last updated" date at the top will change. Material changes will be announced by email to account admins at least 14 days before taking effect. A new version applies to a centre when an authorised user accepts it in the app. Previous versions are listed under "Previous versions" on this page and are available on request.

12A. Language

The English version is the binding version. Translations are provided for convenience only. If there is any difference, the English version prevails.

13. Contact us

Privacy Officer: KindyMenu Pty Ltd Privacy Officer

Email: privacy@kindymenu.com

Security: security@kindymenu.com

Postal address: Ormeau Hills, Queensland, Australia

OAIC (regulator): oaic.gov.au · 1300 363 992

© 2026 KindyMenu Pty Ltd (ABN 46 700 825 369). All rights reserved.

KindyMenu is a product of KindyMenu Pty Ltd (ACN 700 825 369).