Saplyn Privacy Policy

Effective date: October 10, 2026 · Mommalyn Inc.

Saplyn is a childcare-management platform operated by Mommalyn Inc., a Delaware corporation ("Saplyn," "we," "us"). Childcare providers ("Centers") use Saplyn to run their operations; parents, guardians, and other household members ("Family Users") use it to stay connected with their Center. This policy covers the Saplyn web application at saplyn.co, the Saplyn mobile app, and our public web pages (the "Service").

1. The two roles we play

(a) On behalf of your Center (Saplyn as processor / service provider). The records a Center keeps in Saplyn about children, families, and staff ("Center Records") belong to the Center. This includes anything a family submits to a Center through Saplyn, such as an application or enrollment paperwork. The Center decides what is collected and who may see it; we process these records only on the Center's instructions under our Data Processing Addendum. To access, correct, or delete Center Records — including records about you or your child — contact your Center. We will help the Center respond, but the decision is the Center's, and childcare licensing laws may require it to keep certain records.

(b) For ourselves (Saplyn as controller). We are responsible for account and sign-in data, any payments a Center makes to Saplyn, usage analytics, our public website (including early-access, waitlist, demo and event sign-ups, promotional drawings, and the Discover directory, Section 8), marketing email, and messages you send directly to us.

2. Information we collect

Provided by you or your Center:

Account data: name, email address, language, and settings. Sign-in uses a link or code emailed to you; there is no Saplyn password.
Staff: employment and contact details, roles, schedules and time records, credentials and training records, and messages.
Families: household and contact details, relationship to each child, emergency contacts and authorized pickups, messages with the Center, applications and enrollment forms, and billing and payment history. Card and bank details go directly to our payment processor, Stripe; we keep only tokens and display details such as card brand and last four digits.
Children (entered by Centers and families): name, date of birth, enrollment and attendance, daily care and activity records, photos and media and the family's photo permissions, developmental observations, health-related information (allergies, diet, medical and medication information, immunizations, incident reports), uploaded documents, and custody or release restrictions a Center records.
Invitations and prospective customers: the email address an invitation or early-access request was sent to or from, and related details. When you sign up through our website or at an event, this includes your name, email, phone number (optional), role, your center's name, city and size, the software you use today, what you asked us for, your preferred language, any notes you add, and the campaign link you arrived from. We do not ask about children on these forms.
AI and voice features: what you type or dictate into an AI feature, and its response (Section 3).

Collected automatically:

Usage data: product analytics events (pages viewed, features used), device and browser type, and feature-flag evaluations, associated with your account.
Log, audit, and error data: IP address, timestamps, a record of meaningful actions taken in a Center's account, and technical error reports.
Email delivery status: whether a message we sent was delivered, bounced, or reported as spam. We do not track email opens or link clicks.
Push tokens: if you enable notifications in the mobile app.

From other sources: payment outcomes from Stripe, and public childcare licensing records used for the Discover directory.

What we do not collect: we do not collect precise geolocation, do not use facial recognition or derive biometric identifiers, and do not collect information from children directly (Section 7).

3. How we use information

We use information to provide, secure, support, and improve the Service; to process payments; to send service communications (sign-in, notifications, billing, messages); and to comply with law and enforce our terms.

Prospective customers. If you ask us for a demo, beta access, or a place on a waitlist, or enter a promotional drawing, we use what you give us to answer that request, confirm it by email, run the drawing under its official rules, and understand which campaigns reach centers. We send you marketing email only if you opt in, and every marketing email has an unsubscribe link.

AI features. Some features send the relevant request and context — which can include information about children, families, and staff — to an AI provider to produce a draft, summary, translation, transcription, or answer. These providers act as our subprocessors and may not use this data to train their models. AI features change a Center's records only when a person approves the action or the Center has turned on automation for it.

We do not sell personal information, share it for targeted advertising, or use Center Records for advertising or to train AI models. We may create and use de-identified, aggregated statistics that cannot reasonably be used to identify any Center, child, or person, and we will not attempt to re-identify them.

4. How information is shared

With your Center and the people it authorizes — Center staff according to the Center's permission settings, and the Family Users connected to each child.
With our subprocessors — the vendors that host and power the Service, listed with their purposes in our Subprocessor List.
With Stripe, which processes payments under its own privacy policy.
In a business transfer (merger, acquisition, or sale of assets), with this policy continuing to apply.
For legal reasons, if required by law or to protect the safety of a child, our users, or the public. Requests about Center Records are referred to the Center where we are permitted to do so.

We never share personal information with third parties for their own marketing.

5. Retention

Center Records are kept while the Center's account is active. When a Center closes its account it has 30 days to export its data, and we then delete Center Records as described in the DPA (§ 9). Licensing laws may require a Center to keep records even when a person asks for deletion.
Account data is kept while your account is active and deleted or de-identified within 90 days of account deletion, except records we must keep for legal, tax, or accounting purposes.
Audit and security logs are kept for about 12 months.
Some records are short-lived by design — for example unfinished applications and AI request logs — and are deleted automatically.
Copies in backups are removed on our providers' rolling schedules.

6. Your rights and choices

Center Records: contact your Center (Section 1(a)).
Your Saplyn account: Family Users can delete their account in the app or parent portal under Profile → Delete account. This removes your sign-in and de-identifies your account; it does not delete Center Records. Staff accounts are removed by their Center.
Other requests: email legal@saplyn.co to request access to, correction of, a copy of, or deletion of data we control. We will verify the request and respond within the time required by law. You may appeal a denial by replying to it.
State privacy rights: some U.S. states give residents rights to opt out of the sale of personal information or targeted advertising. We do neither.
Notifications: manage them in your settings. Essential service messages, such as sign-in emails, cannot be turned off.
Marketing email: unsubscribe at any time with the link in any marketing email, or by emailing legal@saplyn.co.

7. Children's privacy

The Service is for adults; users must be at least 18. Children do not have accounts, and no part of the Service is directed to children. Information about children is provided by their childcare provider and their own parents or guardians so the provider can care for them. Centers are responsible for obtaining any parental consents that their license, enrollment agreements, or the law require. If you believe a child's information reached us outside this arrangement, contact legal@saplyn.co and we will delete it.

8. The Discover directory

Our public Discover page maps licensed childcare providers using public state licensing records. Ratings shown are derived from that public data, not user reviews, and we limit the location precision shown for home-based providers. The map is drawn with a third-party map service, which receives your IP address when the page loads. Providers who want a listing corrected or limited can contact legal@saplyn.co.

9. Security

We use administrative, technical, and organizational safeguards designed to protect personal information, including encryption in transit and at rest, separation of each Center's data, role-based access controls, and audit logging. Some emailed links act as a key to a single record — treat them like a password. Saplyn staff access a Center's records only when needed to support the Center, and that access is logged. Full payment credentials are held by Stripe, not by us.

No system is perfectly secure. If we learn of a breach affecting your personal information, we will give the notices the law requires.

10. Cookies

We use strictly necessary cookies and similar storage to keep you signed in and remember your preferences, and analytics storage for product analytics and feature rollout. We do not use advertising or cross-site tracking cookies, and we do not respond to browser "Do Not Track" signals because we do not track you across other sites.