Privacy notice

1. Who we are, and who is responsible for what

Coat Peg is a communication app for nurseries. Staff post from a device in the room; a child's own parents see it; one notification goes out at the end of the day, with two exceptions described in section 7. It is operated by Rohit Gupta, a sole trader trading as Coat Peg, of Flat 3, 171a Gipsy Road, London SE27 9QT. We are registered with the Information Commissioner's Office, registration number ZC268121.

Coat Peg is currently a sole trader, not a limited company. The trader is named above, with an address at which documents can be served. That is what data protection law asks of a controller, and what Companies Act 2006 s.1201 asks of a business trading under a name. If the business moves into a company, that company takes on every duty in this notice, and we will tell nurseries before it happens and update the name here.

Data protection law splits responsibility into two roles, and it matters here because the answer is different depending on whose data you mean.

In plain terms: your nursery decides what happens to information about your child, and we do as the nursery asks. If you want a photograph removed, or you want to know what is held, the nursery is the right first place to ask. We will help them, but the decision is theirs. The exception is the nursery's own account details, which are ours.

The written contract that governs the first row is the data processing agreement in our terms, which every nursery accepts when it creates an account. UK GDPR Article 28 requires it to exist; it is published rather than negotiated so that a nursery can read it before signing up rather than after.

2. What we hold about a child

A nursery decides how much of this to use. Everything here is optional except a name.

• Identity. First and last name, date of birth, room, key worker, and a profile photograph if the nursery adds one.
• The keepsake record. Photographs, posts, observations, and reactions from parents.
• The day. Meals (and which member of staff checked the child's food at each sitting), nappy changes, and bookings.
• The register. Attendance and arrival and leaving times; the reason for an absence and when the child is expected back; each call made about an absence, with who was rung, how, whether they were reached and what they said; and who the child's key person was on each day, with every change.
• Sleep. When a child was put down to sleep and when they woke, or how long they slept. For a child under two, also where and in what position, and every check made while they slept (position, breathing and colour, and who checked).
• Welfare and health. Allergies, with an allergy action plan, its review date and a photograph of the plan if the nursery adds one; medical notes such as asthma or a care plan; dietary requirements.
• Medicines. Each medicine a parent has agreed to, with their written consent: the details they agreed to and the name they typed to sign it, every later version, and any withdrawal. Where a parent signed the nursery's own paper form instead, an admin types it in, with who signed it, the date on it and, if added, a photograph of the form. Every dose given, by whom, any witness, and whether the child refused it or reacted to it; and doses the parent says they gave at home.
• Accidents and incidents. What happened, when and where; where on the body; how the child seemed afterwards; any escalation to 999, 111 or a GP; witnesses; and how and when the parent was told. Where recorded, who was supervising, who gave first aid and the injury's side and size. A report of choking also records the food and the seating. For a serious incident, a log of who was told (such as the regulator, local safeguarding partners or the HSE) and when.
• Acknowledgements. When a parent read an accident report or a medicine record, or confirmed that a paper consent was typed in correctly.
• Development. The progress check at age two, if the nursery writes it here, with anything added afterwards and the parent's comments; and, where an earlier version of the app asked it, their answer on whether it may be shared with their health visitor.
• Photo permissions. The two permissions in section 5, and a dated history of every change and who made it.
• Collection. Emergency contacts, people authorised to collect the child, and a collection password if the nursery uses one.
• Safeguarding. Concerns raised by staff, and the safeguarding lead's updates on each, which are added to and never overwritten.
• Fees, if the nursery invoices through Coat Peg. The days and hours the child is booked, and from when; any funded hours, with the type of funding, its eligibility code and dates, and when the nursery checked it; which extras the family takes; who pays for the child, and their share; and the invoices and credit notes the nursery issues, each with the child's name on it.

Health information, and any safeguarding record, are special category data under Article 9, a higher bar than ordinary personal data. They are held because a nursery cannot lawfully operate without them, and they are treated accordingly: see sections 5, 6 and 9.

3. What we hold about parents and staff

Parents: name, email address, a phone number if given, a password (stored only as a hash), whether notifications are wanted, and a device token so they can be delivered. Also what a parent writes into their child's record: a medicine consent and the name they type to sign it, doses they gave at home, changes to photo permissions, comments on a two-year check, and which reports and records they have read.

Whoever pays a nursery's fees, if the nursery invoices through Coat Peg: their name, email address and postal address, and the invoices addressed to them. A payer may be a parent on the app, or someone the nursery types in. When the nursery types in a payer whose email address is exactly the same as that of a parent on the app linked to the same child, the two are linked, and that payer's invoices appear in that parent's app.

Staff: name, email address for admins, a four-digit PIN (stored only as a hash), a profile photograph if added, role, which rooms they work in, and whether they are the safeguarding lead. A member of staff's name is also written on the records they make, and on records that name them: as a witness, as the person who gave first aid or checked a sleeping child, or as a child's key person on a given day. The nursery is the controller of these records.

Nursery account holders: name, email, the nursery's name and address, billing records, which version of our terms was accepted and when, and how the nursery found us: the website that sent them or the link they followed. We are the controller of these.

4. Why we are allowed to hold it

The nursery sets the lawful basis for children's data, as controller. Typically it relies on legal obligation and public task or legitimate interests for the welfare and statutory records it must keep under the Early Years Foundation Stage framework. For special category health data the usual Article 9 condition is substantial public interest or the protection of vital interests. Your nursery's own privacy notice should state which it relies on.

Photographs are the nursery's choice too, and consent is not always the right basis. The ICO says a setting can rely on public task (a public body) or legitimate interests (most private settings) for everyday photographs shared with families, provided it tells parents and offers a way to say no, and should keep consent for optional uses it would genuinely stop if a parent refused. Whichever basis a nursery chooses, the two photo permissions in section 5 record what each family has agreed to, and Coat Peg enforces them. Coat Peg never publishes a photograph outside the app.

For the nursery account data we control, our basis is contract (we cannot provide the service without it) and legitimate interests for keeping the service secure and working.

Writing help in the staff app, called Peggy, runs on the device and is off unless the nursery turns it on. It suggests wording for a post and points out things such as another child's name in the text. The model it uses runs on the device itself. On an iPad or iPhone that is Apple's own model, part of Apple Intelligence, which runs on that device. In a browser it is Gemini Nano, the model Google builds into Chrome, which runs on that computer under Chrome's own terms. Coat Peg does not send the words or photographs it reads to us, to Google or to anyone else to do it. What a member of staff posts is stored as their post, like any other.

5. Photographs, and the consent that governs them

Photography is the part of this product most worth explaining, because it is where the risk is.

• Photo consent is two permissions. One says photographs of the child may be shared with their own family. The other says the child may appear in photographs other families see, such as a photograph of the whole room. A family can give the first without the second.
• Both are off until somebody turns them on. A child added without a decision being recorded has neither. Absence of an answer is never read as permission.
• Parents can change them in their app, at any time. Staff can change them only on the child's page, after a confirmation step. Every change is recorded with the date and who made it, and that history is kept (section 6).
• Consent is checked twice: when a photograph is posted, and again every time one is read. So withdrawing consent takes effect on photographs already published, not just future ones.
• A parent sees only what was shared with their child. That is posts about their own child, and posts addressed to their child's room or the whole nursery. A photograph can show other children, and it appears to a parent only if their own child may have photographs shared with their family, and every child in it from another family may appear in photographs other families see. There is no shared gallery, no group chat, and no way to browse another family's posts.
• Location data is stripped. Every image is re-encoded on the device before it is uploaded, which removes EXIF metadata including GPS coordinates. The original never leaves the device.
• Storage is private. Photographs are never publicly accessible. Each view is a separate signed link that expires within the hour.
• Who a post was for is fixed when it is published. A child moving room later never retroactively gains or loses access to an old post.

When a member of staff marks a photograph as having no children in it, the consent checks do not apply to it, so the photograph records who said so.

One honest limitation. A signed link that has already been issued keeps working until it expires, which is up to an hour. If consent is withdrawn, no new links are issued from that moment, but one already open in somebody's app may still load until it times out.

6. How long we keep things

Records about a child fall into two groups, and they are kept for very different lengths of time.

The keepsake record is photographs, posts, observations, reactions, meals and nappy changes, bookings, who pays for the child and which extras the family takes, and the welfare details held on the child: allergies and their action plans, medical and dietary notes, emergency contacts, authorised collectors and the collection password. It is kept while the child is at the nursery and for twelve months after they leave, then deleted automatically, including the photographs themselves from storage. A two-year check that was never shared with the family is a draft, and goes with it. The twelve months give a family time to ask the nursery for a copy (section 10).

Statutory records are kept longer, and survive a deletion request, because a nursery must be able to produce them after a child leaves. Records that a claim or a child protection question may need years later are kept to a birthday; the rest are kept for three years after the child leaves, and no longer. While any of them is kept, so are the child's first name, last name and date of birth, and nothing else that identifies them: a record that no longer says which child it is about is no use to an inspector, or to the child. Names written on a record, such as who gave a dose or the name a parent typed to consent, stay with it.

When a record's date arrives it is deleted automatically, and once the last of a child's statutory records, and the last invoice naming them, has gone, their name and date of birth go too. These periods follow sector guidance: the EYFS itself asks only for "a reasonable period". They are the same for every nursery on Coat Peg.

Keeping these records after a deletion request is permitted by Article 17(3)(b) of the UK GDPR, which disapplies the right to erasure where processing is necessary to comply with a legal obligation. Where no statutory records exist, the child's record is removed entirely.

When a parent deletes their account, their sign-in, notification settings, reactions and links to their children go at once. Their child's record is the nursery's and is not affected. A medicine consent they gave keeps the name they typed to sign it, and that they acknowledged a report or a record stays with it, for that record's period in the table above. Invoices already addressed to them are kept for six years like any other, and a payer the nursery typed in that was linked to them by email stays the nursery's, unlinked.

When a nursery closes its account, everyone is signed out at once. Thirty days later the keepsake record, every account and everything else is deleted, except the statutory records and invoices above. Those are kept, with each child's name and date of birth, the nursery's name, and the names of the staff they cite, until their dates arrive. Nobody can sign in to see them. A nursery can download them before it closes, and afterwards can ask us for a copy of the statutory records at hello@coatpeg.co.uk; we check the request against who ran the nursery before sending anything.

Our own billing records for a nursery's subscription (its invoices and payments to us) are kept for six years after the account closes, as UK tax law requires. They are held by our payment provider, Stripe, and in our accounts. Coat Peg itself removes the nursery's address and its link to Stripe 30 days after the account closes.

7. Who else touches the data

We use the following providers to run the service. Each is bound by a contract that limits them to processing on our instructions. This list is the same one named in the data processing agreement, and we update it when it changes.

Three of these carry data outside the UK, and they are worth naming plainly rather than leaving in a table.

• Expo delivers notifications, so a child's first name and a short summary pass through it. Apple and Google operate the underlying notification networks. There is one notification at the end of the day, and two exceptions the EYFS requires a parent to be told about the same day: an accident or incident report, and a medicine given. Each of those is sent as soon as it is recorded, and says only that a report or a medicine record about the child is ready to read, never what happened, because a lock screen is read by whoever holds the phone. A parent who has turned notifications off gets neither.
• Resend sends account email: password resets, the email confirming a new nursery's sign-in details, and a parent's invitation. Delivery is from the EU, but Resend holds its own sending logs (the recipient address, the subject and the delivery result) in the USA. None of them contains any information about a child: an invitation names the nursery, not the child. No daily update, report or photograph is ever sent by email. Invoices are not emailed by us either: a nursery shares them in the parent app, or downloads them and sends them itself.
• Stripe processes nursery billing and never receives any information about a child. The fees a nursery invoices families for do not go through Stripe or anyone else: an invoice says how to pay in the nursery's own words, and Coat Peg takes and records no payment.

Vercel serves this website from a global network, so a visit to it may be handled outside the UK. It holds no information about a child. These transfers are made under the UK International Data Transfer Addendum or an adequacy decision.

This website counts page visits with Vercel Web Analytics, which sets no cookies and does not identify or follow a visitor from one site to the next. The apps, including their versions in a browser, have no analytics at all.

8. Where the data lives

The database, the application server and every photograph are held in the UK or the EU: the server in London, the database in London, and photographs in EU-jurisdiction storage that cannot be served from outside it. This is a deliberate choice, not a default, and it is the reason the providers above were chosen.

9. How it is kept safe

• Separation between nurseries is enforced on every read and write. It is not left to a link being hard to guess, and the database itself refuses a reference that crosses between two nurseries.
• Passwords, PINs, invite codes and reset codes are only ever stored hashed. We cannot read them.
• Photograph storage is private, served only by short-lived signed links.
• Rate limiting on every sign-in, PIN entry, invite and reset, so credentials cannot be guessed by repetition.
• Encryption in transit everywhere, and at rest by our storage providers.
• Staff sign in with a PIN so that every post, register mark and accident report carries a name. On a device shared in a room, the person signed in is signed out after 15 minutes untouched, unless something is unsaved; the device itself stays signed in to the nursery until an admin removes it.
• Safeguarding concerns are read only by the nursery's safeguarding lead and its admins. Not by other staff, not by the person who raised the concern once it is sent, and never by a parent.
• Downloads are recorded. When an admin downloads the nursery's records, the nursery's own audit log says who, when and what was in it. Safeguarding concerns are included only for someone who may read them.

Who at Coat Peg can see the data

Administrator access to our hosting, database and photo storage providers is limited to the people who run Coat Peg and need it to keep the service working. Like any hosted service, that access can reach everything stored there, and access made directly through it is not logged by Coat Peg's own tools. The data processing agreement in our terms limits what we may do with the data to what the nursery instructs.

Day to day, we use a back-office tool. It shows each nursery's name and contact details, its staff (names, email addresses and roles), and counts: children, staff, recent posts, photographs and storage used. It does not show children's names, records or photographs. Every change made through it is written to an audit log with who made it and when.

Two things in that tool reach further, and both are recorded in the audit log. It can add an admin to a nursery, which is how a nursery whose only admin is locked out gets back in; an admin can see everything in their nursery. And it can export the statutory records of a nursery that has closed its account, so that we can send them a copy when they ask. That export refuses a nursery that is still open, and leaves out safeguarding concerns unless they are specifically asked for.

We keep a written security review, including what is not yet fixed, and share it with any nursery that asks. If you find a vulnerability, write to security@coatpeg.co.uk and we will respond.

10. Your rights

You have the right to ask for:

• a copy of the personal data held about you or your child;
• correction of anything inaccurate;
• erasure, subject to the statutory records in section 6;
• restriction of processing, or to object to it;
• a portable copy of data you provided;
• withdrawal of consent, including photo consent, at any time.

Some of this you can do yourself. A parent can see their child's posts, photographs, learning, two-year check, accident reports and medicine records, and invoices addressed to them, in the parent app, or in a browser at /family, and can save a copy of the two-year check. A parent can also change their child's photo permissions, and delete their own account, in the app. A nursery's admins can download its statutory records at any time, as CSV files, from Admin › Settings in the staff app. For a copy of your child's data, ask your nursery.

Ask your nursery first. For anything about a child, the nursery is the controller and holds the decision. If you contact us directly we will pass the request on and support them in answering it, normally within one month.

For the nursery's own account data, where we are the controller, write to privacy@coatpeg.co.uk.

11. Children and this notice

The children whose records are held here are too young to exercise these rights themselves, and the app is not designed for them to use. Rights are exercised on their behalf by a person with parental responsibility. As a child grows older their own view carries increasing weight, and a nursery should take it into account.

12. Changes, and how to complain

If we change this notice in a way that affects how data is handled, we will tell nurseries before it takes effect rather than only updating the date at the top of the page.

If you are unhappy with how your data has been handled, tell us first at privacy@coatpeg.co.uk and we will try to put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk, or by calling 0303 123 1113. Our ICO registration number is ZC268121.

13. Nurseries we contact about Coat Peg

We email a small number of nurseries to ask whether Coat Peg would be useful to them. Every one of those emails links here, so this section is written for the person who received one.

What we hold: the business email address we wrote to, the setting's name, operator, town and region, where we found the address, which parent-communication app the setting's own website mentions, if any, and our emails with you and what came of them. Nothing about children, parents or staff.

Where it came from: public sources only. These are the Ofsted and Care Inspectorate registers, the Charity Commission register, council Family Information Service directories, and the setting's own website. Every email says which one applied to you.

Why we are allowed to: legitimate interests in telling nurseries about a service built for them. We only email addresses belonging to companies, charities and public bodies. We do not cold-email sole traders or partnerships, who under the Privacy and Electronic Communications Regulations have to agree first.

Who else touches it: Google Workspace, where the email and our tracking sheet live, and Anthropic, whose Claude model reads replies so that they are sorted and answered promptly. Neither uses it for anything of its own.

Stopping it: reply "no thanks", or write to privacy@coatpeg.co.uk, and we will not email you again. To make sure of that, your address, the date and the reason go on a do-not-contact list, and that is all we keep. Everything else is removed 30 days later, and our emails with you are gone from our mailbox's bin 30 days after that, so within 60 days in all. The first 30 days exist only so that a reply we misread can be put right.

How long we keep it otherwise: if you did not reply, or replied without becoming a customer, your details and our emails are deleted 12 months after we last wrote to each other (the emails leave our mailbox's bin a month later). If you do become a customer, the rest of this notice applies instead. Deletion is automatic, not a job someone has to remember.

14. Free templates from this website

Our free templates ask for an email address before they open.

What we hold: the email address, which templates you took and when, the website or link that brought you here (the site name only, never a full address), and whether you ticked the box asking for emails from us, with the exact words that box said.

Why we are allowed to: if you ticked the box, consent, and we email you about new templates, guides and Coat Peg. If you did not, legitimate interests in knowing who uses the templates, and we do not send you marketing.

Where it lives: on our own server in London, with the rest of Coat Peg. Before we send the first of these emails, we will name the service that sends them here.

How long we keep it: without the box ticked, 12 months after you last took a template, then it is deleted automatically. With it ticked, until you unsubscribe (every email has a link) or write to privacy@coatpeg.co.uk, and then it is removed.