Operator details pending confirmation
Legal entity name, Companies House number, registered office and ICO registration number will be published here once confirmed. Until then, contact legal@peekaboohq.com.
1. Who we are
Peekaboo is a childcare management platform operated by Peekaboo HQ ("Peekaboo", "we", "us"), a business registered in England and Wales. This Privacy Policy explains how we process personal data when you use peekaboohq.com, app.peekaboohq.com, and related services.
For most account, website, billing, and support data, we act as a data controller. For personal data that childcare providers upload about children, parents, and staff in the course of running their setting, the provider is typically the data controller and we act as their data processor under UK GDPR Article 28 (see section 3).
Privacy and data-protection contact: legal@peekaboohq.com. If we appoint a Data Protection Officer, their contact details will be listed here.
2. Personal data we collect
2.1 Account and organisation data
Name, email address, phone number, role, login credentials (stored hashed), organisation/setting details (name, type, size, location), and billing contacts.
2.2 Child, family, and staff data (customer content)
Providers may upload names, dates of birth, attendance, observations, photographs, emergency contacts, dietary needs, and medical information (including allergies and conditions). Some of this is special category data under UK GDPR Article 9. Providers decide what to upload. We process it on their instructions as a processor, except where UK law requires us to act otherwise.
2.3 Parent portal data
If a parent is invited by a provider, we process their name, email, authentication data, messages, and interactions with content shared by the provider.
2.4 Website and technical data
IP address, device/browser type, approximate location derived from IP, pages viewed, referring URL, and diagnostic/log data needed to operate and secure the service. See also Cookies.
2.5 Communications
Content of support requests, contact-form submissions, demo requests, and email correspondence.
2.6 Payment data
Subscription plan, invoices, and payment status. Card payments are processed by Stripe. We do not store full card numbers on our servers.
2.7 Register your interest
Peekaboo is not yet open for new sign-ups. If you use the Register your interest form on peekaboohq.com, we act as data controller for the details you give us.
- What we collect: your name, email address, nursery or setting name, your role, phone number (optional), number of sites, and whether you are a nursery or childminder. We also record the page you registered from, the date and time, a one-way (hashed) version of your IP address and your browser type, to protect the form against spam and abuse. If you tick the marketing box, we record that you agreed, when, and the wording you agreed to.
- Why we use it: to respond to your interest, to contact you about Peekaboo for your setting, and to tell you when Peekaboo opens. If you tick the optional box, we will also send you Peekaboo news, launch updates and offers by email.
- Lawful basis: legitimate interests (Art 6(1)(f)) for responding to your interest and telling you when Peekaboo opens, which you asked us to do. Consent (Art 6(1)(a) and PECR) for marketing emails. The box is unticked by default and is optional; you can still register without it.
- Who sees it: the Peekaboo team, using our CRM and email providers (see section 5). We do not sell it or share it with other companies for their own marketing.
- How long we keep it: until 12 months after Peekaboo opens to new sign-ups, or until you ask us to delete it, whichever is sooner. If you open an account, your details are then handled as account data. We keep a minimal record of any marketing opt-out so we can honour it.
- Unsubscribe, withdraw consent or delete your details: use the unsubscribe link in any marketing email, or email legal@peekaboohq.com (or hello@peekaboohq.com) and ask us to stop emailing you or to delete your registration. Withdrawing consent does not affect emails we sent before you withdrew it. You also have the rights in section 11.
2.8 Website chat
If you use the chat button on peekaboohq.com, we keep your name, email address, the messages you send and receive, the page you started the chat from, and the time of each message. A member of the Peekaboo team reads and answers them in our customer relationship system (CRM). If you leave the page before we reply, we reply to the email address you gave. Your browser stores a chat reference in local storage so the conversation is still there if you come back; clearing your browser storage removes it. We use chat details only to answer you, on the basis of our legitimate interest in responding to enquiries (or to take steps at your request before a contract). We do not use them for marketing unless you separately opt in.
3. Our roles and your responsibilities
- Controller: website visitors, marketing enquiries, provider account administration, billing, security, product analytics we control, and improving Peekaboo.
- Processor: child, parent, and staff records entered by a provider. Providers must have a lawful basis (and Article 9 condition where needed) to collect and share that data with us, and must provide their own privacy information to families and staff.
Business customers should enter a Data Processing Addendum (DPA) with us covering Article 28 terms. Contact legal@peekaboohq.com to request the current DPA.
4. Purposes and lawful bases
We only process personal data when we have a lawful basis under UK GDPR Article 6. For special category data we also need an Article 9 condition (usually applied by the provider as controller; where we are controller, we will state the condition).
| Purpose | Lawful basis |
|---|---|
| Create and manage accounts; provide the platform | Contract (Art 6(1)(b)) |
| Process subscriptions and invoices | Contract; Legal obligation for tax records |
| Security, fraud prevention, abuse detection | Legitimate interests (Art 6(1)(f)) |
| Service messages (security, billing, material product changes) | Contract / legitimate interests |
| Optional product emails / newsletters | Consent, or PECR soft opt-in where lawful; withdraw anytime |
| Improve features using aggregated/pseudonymised usage data | Legitimate interests |
| Customer content (children/families/staff) on provider instructions | Processor: provider's basis; our processing under Art 28 |
| Respond to contact/demo forms | Legitimate interests / steps toward contract |
| Register your interest: respond and tell you when Peekaboo opens | Legitimate interests (Art 6(1)(f)) |
| Register your interest: marketing emails (only if you tick the box) | Consent (Art 6(1)(a)) and PECR; withdraw anytime |
Where we rely on legitimate interests, we balance our interests against your rights. You may object (see section 11).
5. Data sharing and processors
We do not sell personal data. We share data only with:
- Payment processors (currently Stripe) for billing
- Cloud hosting and infrastructure providers that host the platform
- Email and transactional messaging providers
- Professional advisers (legal, accounting) under confidentiality
- Authorities where required by law
Processors are bound by written contracts with UK GDPR-appropriate terms. A current sub-processor list is available on request from legal@peekaboohq.com.
6. International transfers
Our primary application data is intended to be hosted in the United Kingdom. Some providers (for example Stripe, and certain email or support tools) may process data in the EEA, United States, or other countries.
Where personal data leaves the UK, we use an appropriate safeguard recognised under UK GDPR Chapter V, such as the UK International Data Transfer Agreement / Addendum, or another lawful transfer tool. Details for a specific transfer are available on request.
7. Retention
- Active accounts: kept while the account remains open and as needed to provide the service.
- Billing and tax records: typically 6 years (or longer if required by law).
- Support tickets: typically up to 24 months after closure, unless needed longer for disputes or security.
- Customer content (processor): retained according to the provider's instructions and our DPA; deleted or returned within a reasonable period after account closure, subject to legal holds and residual encrypted backups that expire on a rolling schedule.
- Register your interest submissions: until 12 months after Peekaboo opens to new sign-ups, or until you ask us to delete them, whichever is sooner (see section 2.7).
- Marketing suppression lists: kept as needed to honour opt-outs.
8. Security
We use TLS encryption in transit and encryption at rest for primary datastores, access controls, authenticated sessions, and monitoring aimed at preventing unauthorised access. No method of transmission or storage is 100% secure. Please use strong unique passwords and enable available security features.
If we become aware of a personal data breach, we will assess it and, where required, notify the ICO without undue delay and within 72 hours of becoming aware, and notify affected customers/individuals as required by UK GDPR and our DPA.
To report a security vulnerability, email hello@peekaboohq.com with "Security" in the subject line.
9. Cookies and similar technologies
We use strictly necessary cookies and similar storage for authentication, security, and essential preferences. These do not require consent under PECR.
On app.peekaboohq.com, your refresh session is stored in an HttpOnly cookie (peekaboo_refresh, scoped to .peekaboohq.com) so it cannot be read by page scripts. Short-lived access tokens and profile data may still use browser storage required to run the app. We do not store your refresh token in JavaScript-accessible storage in production builds.
We do not set non-essential analytics or marketing cookies on the marketing website unless and until we obtain your prior consent through a cookie banner or preference centre. If we introduce analytics or marketing cookies, we will update this section with a cookie table (name, provider, purpose, duration, type) and only set non-essential cookies after consent.
You can also control cookies in your browser settings. Blocking necessary cookies may prevent login or core features from working.
10. Children
Peekaboo is designed for adult childcare professionals and invited parents/guardians. We do not knowingly offer provider accounts to children. Children's personal data in the platform is entered by providers (or shared with invited parents) in the context of childcare services. Providers remain responsible for transparency and lawful bases toward families.
11. Your rights
Under the UK GDPR you may have the right to:
- Access your personal data
- Rectify inaccurate data
- Erase data (in certain circumstances)
- Restrict processing
- Data portability
- Object to processing based on legitimate interests
- Withdraw consent where processing is consent-based
- Not be subject to solely automated decisions producing legal or similarly significant effects (we do not currently make such decisions)
To exercise rights, email legal@peekaboohq.com. We will respond within one month (extendable by two months for complex requests, with notice). We may need to verify your identity. If we process data as a processor, we will redirect or support the request according to the provider's instructions and our DPA.
You can complain to the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint, or Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.
12. Changes
We may update this policy. The version and date above will change when we do. Material changes will be notified by email or in-product notice where appropriate. Where a change requires a new consent or other action under UK law, we will ask for that before relying on the new processing.
13. Contact
General: hello@peekaboohq.com
Legal: legal@peekaboohq.com