1. Who is responsible for your information

iSky is used by daycares and kindergartens (“Centers”) to manage enrollment, attendance, daily care and communication with families. For information that a Center records about the children in its care and about its staff, the Center decides how that information is used, and iSky processes it on the Center's behalf. For account, technical and usage information needed to operate the apps, iSky is responsible.

If you have questions about how a specific Center handles your child's information, you can contact that Center directly or reach us at help@iskyapp.com.

2. Information we collect

Account information

• Name, mobile phone number (used for sign-in with a one-time code), and email address where provided.
• Profile photo (optional), preferred language, and role (parent, staff, admin).
• Staff accounts are created by the Center's administrators, who provide the staff member's name, contact details, branch and role.

Child and enrollment information

• Child's name, date of birth, gender, photo, class/group and branch.
• Enrollment applications and uploaded documents (for example ID copies, vaccination or medical reports) submitted by parents or the Center.
• Parent/guardian links to each child, and authorized pickup information where provided.

Daily care and development records

• Attendance, check-in/check-out (including QR code scans), and arrival notifications.
• Daily notes such as meals, naps, activities, moods and health observations.
• Photos and videos of activities posted by staff, development assessments, and monthly reports.

Communications

• Messages, inquiries, voice messages and attachments exchanged between parents and staff within the apps.
• Questions you ask the in-app AI assistant.

Technical information

• A push-notification token for your device, device type and operating system, app version, and basic diagnostic logs needed to keep the service reliable.

Subscriptions

• Subscription plan, status and dates recorded by the Center. We do not collect or store payment card numbers in the apps.

We do not sell personal information, show third-party advertising, or use advertising or cross-app tracking identifiers.

3. Device permissions

The apps only request permissions when you use a feature that needs them. You can decline or revoke any permission in your device settings; the related feature will simply not be available.

• Camera — to take photos or videos for posts, notes, documents and profile pictures, and (Staff app) to scan child check-in QR codes.
• Photos / media library — to attach existing photos, videos or documents, and to save images you choose to download.
• Microphone — to record voice messages and videos with sound.
• Notifications — to alert you about new posts, messages, arrivals, reports and enrollment updates.
• Location (Staff app only) — used only while the app is open, when an administrator chooses to pin a branch's location on a map. We do not track the location of parents, children or staff.

4. How we use information

• To create and secure your account and verify your phone number.
• To provide the core service: enrollment, attendance, daily updates, posts, chat, arrival coordination, reports and subscriptions.
• To send push notifications and SMS messages related to your account and your child.
• To provide optional AI-powered insights and report drafts (see section 5).
• To maintain, troubleshoot and improve the apps, and to prevent abuse and keep the platform secure.
• To comply with legal obligations and respond to lawful requests.

5. AI features

iSky offers AI features that summarize a child's daily records into insights for parents, answer parents' questions about their child, and help staff draft development reports. To do this, relevant records (such as notes on sleep, meals, activities and development results) are sent to our AI provider, OpenAI, to generate a response.

• Data sent to the AI provider is used only to generate the requested response and is not used by the provider to train its models, in line with OpenAI's API data-usage policy.
• AI output is guidance only. It is not medical, psychological or diagnostic advice, and staff review reports before sending them.

6. Sharing & service providers

We share information only as needed to operate the service:

• Within your Center — parents see information about their own children; staff see information needed for their role and branch, according to the permissions set by the Center.
• Supabase — database, authentication, file storage and real-time updates (our hosting provider).
• Google Firebase Cloud Messaging — delivery of push notifications.
• Twilio and Msegat — delivery of SMS verification codes and account messages.
• OpenAI — AI insights and report drafting, as described above.
• Legal reasons — where required by law, or to protect the safety of children, users or the public.
• Business transfers — if iSky is involved in a merger or acquisition, subject to this policy's protections.

Service providers may only use information to provide their services to us and are bound by confidentiality and security obligations.

7. Children's privacy

The iSky apps are intended for use by adults — parents, guardians and Center staff. Children do not create accounts or use the apps themselves. Information about children is provided by their parents or guardians and by the Center caring for them, and is visible only to the child's linked parents/guardians and authorized Center staff.

Parents and guardians can review their child's information in the app and may ask the Center or us to correct or delete it at any time.

8. Retention & account deletion

• We keep information for as long as your account is active or as needed to provide the service to your Center.
• Parents can delete their account at any time from Settings → Delete Account in the iSky Parent app. This removes your account and personal profile data.
• Staff accounts are managed by the Center; staff can ask their administrator, or email us, to delete their account.
• You can also request deletion by emailing help@iskyapp.com from the phone number or email linked to your account. We will respond within 30 days.
• Records that a Center is legally required to keep (for example attendance records) may be retained by the Center for the required period, then deleted or anonymized.

9. Security

Data is encrypted in transit (HTTPS/TLS) and stored with a managed cloud provider. Access is restricted by role-based permissions and database row-level security, so users can only access the records they are authorized to see. No system is perfectly secure, but we work to protect your information and will notify affected users and Centers of any breach as required by law.

10. Your rights & choices

Depending on where you live, including under Saudi Arabia's Personal Data Protection Law (PDPL) and similar laws, you may have the right to:

• Access the personal information we hold about you and your child.
• Correct inaccurate or incomplete information.
• Request deletion of your information.
• Withdraw consent, for example by turning off notifications or not using AI features.
• Request a copy of your information in a portable format.

To exercise these rights, contact us at help@iskyapp.com. We may need to verify your identity before acting on a request.

11. International transfers

Our service providers may process information in countries other than your own. When this happens, we rely on providers that apply appropriate safeguards to protect your information.

12. Changes to this policy

We may update this policy from time to time. We will post the updated version on this page with a new effective date and, for significant changes, notify you in the app.

13. Contact us

For privacy questions, requests or complaints, email help@iskyapp.com.