Privacy Policy
Last updated: July 2026 · CentreCheck is operated by rubytiger.io, a registered Canadian business (Ontario, Canada), operating as CentreCheck.
CentreCheck is a tool for licensed child care centres to check their own compliance records against Ontario's CCEYA and O. Reg. 137/15 before a Ministry inspection. The documents you upload may include records that name children or staff at your centre — daily written records, incident reports, playground inspection logs, and similar. This policy explains what we collect, why, and what we do (and don't do) with it.
You — the centre — remain the custodian of any personal information about children and families in the records you upload. CentreCheck acts as a processor on your instructions: we store and analyze what you give us, for the purpose you give it to us, and nothing else.
What we collect
- Account data: your email address (used for magic-link sign-in — we never see or store a password).
- Centre profile data you enter: centre name, licensed capacity, age groups served, hours of operation, and program type. This is used only to determine which compliance requirements apply to your centre.
- Documents you upload for a check, and the reports generated from them. These may contain children's and staff names, dates, signatures, and incident details, depending on what you upload.
- Usage data: which checks you run, and basic logs needed to operate and troubleshoot the service.
- Billing data will be handled by Stripe directly once billing is live; we never see or store your card number.
Why we collect it
- To run the service: matching your uploaded documents against the compliance requirements that apply to your centre, and producing a gap report.
- To operate your account: authentication, support, and service communications.
- To bill for the service, once billing is live.
We only collect what the service needs. We don't collect information about the children in your care directly — only what appears in the documents you choose to upload.
How your documents are analyzed
Uploaded documents are analyzed using Claude, an AI model provided by Anthropic, via Anthropic's commercial API. This is an automated process: the AI reads each document, extracts the relevant information (dates, whether a document is signed, what it covers), and compares it against Ontario's child care regulations to produce your gap report. A human does not read your documents as part of generating the report.
We've designed the system so that children's names never appear in your generated report — findings refer to records by date and type (for example, “the daily record for June 12”), not by a child's name. Personal information about children stays in the source documents you uploaded, which are private to your account.
What we never do
- Sell your data.
- Use your documents, or allow Anthropic to use them, to train AI models. Anthropic's commercial API terms exclude API data from model training by default — this is a contractual commitment from Anthropic to CentreCheck, and we pass that same commitment on to you.
- Share your documents or reports with anyone except the service providers listed below, who process data only on our instructions to run the service.
- Use your data for any purpose other than providing you the service, without asking you first.
Where your data is stored, and cross-border transfer
Your documents, reports, and account data are stored in Canada — our database and file storage run in a Canadian data centre (AWS Canada Central, in Montreal). Two things still cross the border, and we want you to know about them plainly rather than bury them in legal language: when a check runs, document content is sent to Anthropic's AI service in the United States for the duration of the analysis, and our web application itself is served by Vercel, whose servers may process requests in the United States. Information processed in the United States may be accessible to that country's courts, law enforcement, and national security authorities under its laws, in the same way Canadian authorities can compel disclosure of information stored in Canada. We choose service providers who are contractually bound to protect your data to a comparable standard regardless of where it's processed.
Subprocessors
- Supabase — database, file storage, and authentication (built on AWS infrastructure).
- Vercel — application hosting.
- Anthropic — AI document analysis via the Claude API (does not train on your data — see above).
- Stripe — payment processing, once billing is live.
Retention & deletion
Your documents and reports are retained while your account is active, so you can re-run checks and track progress over time.
- Deleting a check permanently deletes its uploaded documents from storage and its report — this is immediate, not a soft delete.
- Deleting your account removes your profile, all checks, all documents, and all reports. Email us to request account deletion; we complete it within 7 days.
- We keep an internal record of any security incident (whether or not it meets the legal threshold for notification) for at least 24 months, as required by Canadian privacy law.
Because your centre may have its own recordkeeping obligations under the CCEYA (which can require you to retain certain child records for up to 3 years after a child leaves your care), keep your own copies of anything you upload — don't rely on CentreCheck as your only copy of a record you're required to retain.
Sharing report links
If you generate a share link for a report, anyone with that link can view the report — and only the report. Source documents are never accessible via a share link, and reports don't contain children's names (see “How your documents are analyzed,” above). Don't share a link if you don't want the report seen by whoever has it.
Your rights
You can ask us, at any time, to:
- Tell you what personal information (e.g., your account email, profile data) we hold about you.
- Correct inaccurate information.
- Delete your data (see “Retention & deletion,” above).
- Withdraw consent to processing, subject to reasonable notice — note that withdrawing consent for document processing means we can no longer provide the service for that data.
Email us for any of the above. We'll respond within 30 days, consistent with Canadian privacy law.
Questions or complaints
If you have a concern about how we handle personal information, contact us first — most things are a misunderstanding or a quick fix. If you're not satisfied with our response, you can complain to the Office of the Privacy Commissioner of Canada: priv.gc.ca/en/report-a-concern.
Changes to this policy
We'll update this page if our practices change, and update the “Last updated” date above. If a change is material — for example, a new subprocessor or a change to cross-border data transfer — we'll email account holders in advance.