Terms of service

1. The agreement

These terms are between Rohit Gupta, a sole trader trading as Coat Peg, of Flat 3, 171a Gipsy Road, London SE27 9QT ("we", "us", "Coat Peg") and the nursery or childcare setting that creates an account ("you", "the nursery"). Creating an account accepts them, including Schedule 1, and we keep a record of which version you accepted and when.

Coat Peg is currently a sole trader rather than a limited company. If the business moves into a company, this agreement moves with it under section 14, and we will tell you before it does. Your rights here do not change when that happens.

They apply to the staff app, the parent app, this website and the nursery account area. Our privacy notice forms part of them.

2. What Coat Peg does

Coat Peg lets your staff post photographs, observations and daily records from a device in the room, and lets each child's own parents see what concerns their child. Parents receive one notification at the end of the day, not one per post. The exceptions are an accident or incident report and a medicine given, which parents are notified of as soon as they are recorded.

It is deliberately not a nursery management platform. It does not collect fees from parents, does not provide two-way messaging, and does not manage staff rotas. If you switch on Fees, it works out invoices for you to share with families, but it does not take, track or record payments. We may add features, but we will not remove one you depend on without notice.

3. Your account, and who may use it

• You are responsible for everything done under your account.
• Every member of staff must have their own PIN. Sharing one defeats the record of who did what, which is the point of it.
• Tell us promptly if you believe an account has been compromised.
• You must be at least 18 and authorised to enter this agreement for the nursery.
• A device left in a room stays signed in to the nursery, by design. Keeping that device physically secure is your responsibility.

4. What the nursery is responsible for

You are the data controller for information about children, their families and your staff. We are your processor. In practice that means you are responsible for:

• having a lawful basis for the records you keep, and telling families about it in your own privacy notice;
• obtaining and recording photo consent, and keeping it current;
• the accuracy of what your staff enter;
• meeting your statutory duties: safeguarding, EYFS record-keeping, Ofsted registration. Coat Peg is a tool that helps you keep those records, not a substitute for them;
• deciding who at your setting has admin access.

In plain terms: we hold the data and keep it safe; you decide what goes in it and why. If a parent asks what is held about their child, that question is yours to answer, and we will help you answer it.

5. Photographs and consent

The product enforces photo consent: a child without recorded consent cannot be tagged in a photograph, and consent is re-checked every time an image is read, so a withdrawal applies to photographs already published.

That enforcement depends entirely on what you record being true. Setting consent for a child whose parents have not given it is a breach of these terms and of your own obligations as controller.

6. Free use, and paying

• Free use: a nursery can use Coat Peg without paying, within the limits shown on our website. It is not a time-limited trial. We may change or withdraw free use on at least 30 days' notice; if we do, you can subscribe or leave under section 7, and nothing you have recorded is deleted because of the change.
• Subscription: the fees, and what they include, are those shown to you when you subscribe, less any discount applied to your nursery.
• Discounts are applied as a coupon to your nursery and last for the period stated when they are given. When a discount ends, the fees in force at that time apply.
• Fees are in pounds sterling. If VAT becomes chargeable we will tell you before it applies.
• Payment is by card through Stripe. We never see or store your full card details.
• Billing is monthly in advance and renews automatically until cancelled.

Changing the fees. We may change our fees. We will give at least 30 days' notice by email before a change applies to you, and it takes effect from your first billing date after that notice ends. If you do not want to continue at the new fee, cancel before then and you will not pay it.

Billing happens on this website, not in the apps. Neither app contains a price or a purchase route.

If a payment fails we will tell you, and your nursery keeps working normally while payment is retried. Nobody is locked out of a child's records mid-morning over a card that needs renewing. If payment is still outstanding 14 days after we first tell you, we may end the subscription. Your nursery then becomes read-only: families can still see everything already shared and new posts are paused, but your staff can still write the records the law requires at the time (accident and incident reports, medicines given and paper medicine consents, the register and absence follow-up, sleep checks, safeguarding concerns and changes to photo consent), and you can still download your records or ask for an export under section 7. Paying restores it.

7. Cancelling, and what happens to your data

You can cancel at any time from your nursery account. Cancellation takes effect at the end of the period you have paid for; we do not refund part months, and we do not require notice.

Cancelling does not delete anything. Your nursery becomes read-only, as described in section 6. Deleting the nursery's data is a separate step: an admin closes the account from Admin › Settings in the staff app.

Take your records with you. Your admins can download the nursery's statutory records at any time, as CSV files, from Admin › Settings, including just before closing the account. On request within 30 days of cancelling we will also provide your nursery's data, including photographs, in a machine-readable form.

When you close the account, everyone at the nursery is signed out at once, and 30 days later we delete its data in line with section 6 of the privacy notice. The keepsake record goes. The statutory records described there (accidents and incidents, medicines, the register, sleep checks, photo consent history, two-year progress checks and safeguarding concerns) are kept, with each child's name and date of birth, until the retention date for each, and are then deleted. Invoices and credit notes you issued through Coat Peg are kept for six years in the same way; download the finance export before you close if you need them. Nobody at the nursery can sign in to any of these during that time. If you need a copy, ask us, and we will send one once we have checked that the request comes from the nursery.

We may suspend or end an account for non-payment after telling you, or immediately for a serious breach of section 10. If we discontinue the service entirely we will give at least 90 days' notice and an export.

8. Availability, and what we do not promise

We work to keep Coat Peg available and we will tell you about planned maintenance, but we do not offer a contractual uptime guarantee at this price and it would be dishonest to imply one.

The staff app works offline: observations, posts and photographs queue on the device and send when connectivity returns. Nursery wifi is genuinely bad, and the product is built for that.

Do not let Coat Peg be your only copy of anything you are legally required to hold. Our database provider lets us restore to a point within the last few hours, but we do not yet keep longer-term backups, so a problem found later may not be recoverable. A nursery's statutory records are the nursery's responsibility: if our service ended tomorrow you should still be able to satisfy Ofsted. The records download in section 7 is there so that you can keep your own copy.

9. Our liability

Nothing in these terms limits liability for death or personal injury caused by negligence, for fraud, or for anything else that cannot lawfully be limited. Nothing here reduces either party's duties under data protection law; this section limits only the money payable if one is breached.

Subject to that, in any twelve-month period our total liability to you is limited as follows.

• Claims about personal data, including a personal data breach or a breach of Schedule 1: the greater of £2,500 or the fees you paid us in the eighteen months before the claim.
• All other claims: the greater of £500 or the fees you paid us in the four months before the claim.

The two limits are separate and do not add together for the same loss. We are not liable for lost profits, lost business or indirect losses.

Why the limits are set where they are. Coat Peg is a small business charging a small fee. The limits are sized to what we can actually pay, so that a single problem does not end the service for every other nursery relying on it. The fixed amounts mean a nursery using Coat Peg for free is still covered.

We are providing software, not childcare. We are not liable for decisions made about a child's care, nor for a nursery's compliance with its statutory duties.

10. Acceptable use

You must not:

• upload anything unlawful, or any image of a child you do not have authority to hold;
• use the service to reach families other than those enrolled at your setting;
• attempt to reach another nursery's data, or probe the service for weaknesses without our written agreement;
• resell or white-label the service without our agreement;
• use it to store records it is plainly unsuited to, such as medical records beyond a child's care needs, for instance.

Responsible security research is welcome. Tell us at security@coatpeg.co.uk before you test anything, and we will not pursue you for it.

11. Changes to these terms

We may change these terms. For a material change we will give at least 30 days' notice by email to the nursery's admin address, and you may cancel before it takes effect. If you carry on using Coat Peg after that date, the changed terms apply. Minor corrections take effect when published. Changes to fees are covered by section 6.

12. Law and jurisdiction

These terms are governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction. If any clause is unenforceable the rest stands.

Questions: hello@coatpeg.co.uk, or see support for what to expect and how quickly.

13. Your content

Everything your nursery puts into Coat Peg (photographs, posts, records) stays yours. You give us permission to store it, copy it and show it to the people you have authorised, only as far as running the service needs, and that permission ends when the data is deleted under section 7. The software, the apps and the Coat Peg name are ours.

If anyone makes a claim against us because of content your nursery uploaded without the right to (most obviously a photograph of a child whose family had not consented), you will cover our reasonable costs of dealing with it. This does not apply where the problem was caused by us.

14. Transferring this agreement

We may transfer this agreement, including Schedule 1, to a company or other business that we control, or to whoever takes over the Coat Peg service. We will tell you by email before it happens. The new provider will be bound by these terms in our place, and your rights will not be reduced. If you do not want to continue with them, you may cancel and receive a refund of any fees paid for time after the transfer.

You may not transfer this agreement without our written agreement, which we will not unreasonably refuse, for example when a nursery is sold.

15. Events outside our control

Neither of us is responsible for a delay or failure caused by something outside our reasonable control (a failure at a hosting or network provider, a power cut, or an event of that kind), provided we tell the other promptly and do what we reasonably can to limit the effect. This does not excuse our security or breach-notification duties under Schedule 1.

16. Notices

We send notices under these terms by email to your nursery's admin address, so keep it up to date. You can send notices to hello@coatpeg.co.uk, or for data protection matters to privacy@coatpeg.co.uk. An email counts as received on the next working day after it is sent.

17. The whole agreement

These terms, their schedules and the privacy notice are the whole agreement between us about Coat Peg, and replace anything said or written before. Nobody other than you and us has any right to enforce them, including under the Contracts (Rights of Third Parties) Act 1999. If either of us is slow to enforce a right, we have not given it up.

Schedule 1: Data processing agreement

This schedule is the written contract required by Article 28(3) of the UK GDPR. It forms part of these terms and takes effect when you create an account. You are the controller; we are the processor.

1. Subject matter and duration

We process personal data on your behalf so that you can run Coat Peg. This lasts for as long as your account is open, plus the retention periods in clause 8.

2. Nature and purpose

Storing, organising, retrieving and displaying records and photographs of children to the parents you have authorised; sending notifications, which are one at the end of the day and a same-day notice of an accident or incident report or a medicine given; keeping the welfare and statutory records your setting enters; and, if you use Fees, working out invoices and credit notes and showing them to the payers you choose.

3. Types of personal data

Names, dates of birth, photographs, room and key worker, and the history of who the key worker was; attendance, absence reasons and the calls made about absences; meals and who checked the food, nappies, sleeps and sleep checks; observations and posts; two-year progress checks and parents' comments on them; photo permissions and their history; bookings, emergency contacts and authorised collectors; parents' acknowledgements; contact details for parents and staff; if you use Fees, funded hours (including eligibility codes), extras, payers' names, email and postal addresses, and invoices and credit notes; and authentication credentials in hashed form.

Special category data: allergies and allergy action plans, medical and dietary notes, medicine consents (including the name a parent types to sign one, and paper consent forms typed in by the nursery with any photograph of the form), medicines administered and doses given at home, accident and incident reports, and safeguarding concerns and their updates.

4. Categories of data subject

Children at your setting; their parents, guardians, emergency contacts and authorised collectors; anyone who pays your fees, if you use Fees; your staff.

5. Our obligations

We will:

1. process personal data only on your documented instructions, including on transfers, unless we are required by law to do otherwise, in which case we will tell you first unless the law forbids it;
2. ensure everyone authorised to process the data is under a duty of confidentiality;
3. take the technical and organisational measures required by Article 32, described in section 9 of the privacy notice;
4. engage sub-processors only as set out in clause 6;
5. help you respond to requests from parents, staff or others exercising their rights;
6. help you with data protection impact assessments, security obligations and breach notification, taking account of what we know;
7. delete or return the data at the end of the agreement as set out in clause 8;
8. make available the information needed to demonstrate compliance, and allow audits (see clause 9).

6. Sub-processors

You give general authorisation for the sub-processors listed in section 7 of the privacy notice. Each is bound by terms no less protective than these. We will give at least 30 days' notice before adding or replacing one, and you may object; if we cannot resolve your objection, you may cancel without penalty and receive a refund of any unused prepaid fees.

If this agreement is transferred under section 14, this schedule transfers with it, and the new provider becomes your processor on the same terms.

7. International transfers

The database, the application server and all photographs are held in the UK or the EU. Three sub-processors carry limited data outside, as described in section 7 of the privacy notice: Expo, which delivers notifications; Resend, which sends account email (invitations and password resets) and holds its delivery logs in the USA; and Stripe, which processes nursery billing. Neither Stripe nor Resend receives any data about a child. Those transfers are made under the UK International Data Transfer Addendum or an adequacy decision.

8. Deletion and return

On request within 30 days of the agreement ending we will provide an export of your data in a machine-readable form, including photographs. While the account is open you can also download the statutory records yourself. When the account is closed we delete the data 30 days later, except the statutory records in section 6 of the privacy notice, which are retained under Article 17(3)(b), with each child's name and date of birth, until the retention date stated there for each, and then deleted, and issued invoices and credit notes, which are kept for the six years stated there. While we hold them they remain subject to this schedule, nobody can sign in to them, and we will provide you with a copy on request.

9. Audit

We will provide the information reasonably needed to demonstrate compliance with this schedule. You may audit no more than once a year, on 30 days' notice, at your cost, unless an audit follows a personal data breach, in which case it is at ours.

10. Personal data breach

We will tell you without undue delay and in any event within 48 hours of becoming aware of a personal data breach affecting your data, with the information you need for your own 72-hour notification duty to the ICO. Reaching that decision is yours as controller; getting you the facts in time is ours.

11. Precedence

Where this schedule conflicts with the rest of these terms, this schedule prevails for anything concerning personal data, except that liability under this schedule is subject to the limits in section 9.

Schedule 2: Terms for parents using the app

This part is for parents and carers who use the parent app because a nursery has invited them. Creating your account accepts it. It is between you and Rohit Gupta, a sole trader trading as Coat Peg, of Flat 3, 171a Gipsy Road, London SE27 9QT.

Staff use the staff app on the nursery's behalf, so the nursery is responsible for their use under section 3, but section 2 below applies to them just the same.

1. Your access comes from the nursery

The nursery decides who is invited, what you can see and when access ends. What is posted about a child is the nursery's record, not ours; questions about it are best asked of the nursery first. Coat Peg itself is free to you, because the nursery pays for it.

2. Looking after what you see

• Photographs and records are shared with you because of your connection to a child. Please do not repost or forward images that show other children, as their families may not have agreed to it.
• Keep your password to yourself, and tell the nursery or us if you think someone else has used it.
• Do not try to reach anything you have not been given, or interfere with the service.

3. Ending your access

You can delete your account from the app at any time. That removes your login, your notifications and your reactions; it does not delete the nursery's record of your child, which the nursery holds, or the records the law requires it to keep, such as a medicine consent you gave or invoices addressed to you (see section 6 of the privacy notice). We or the nursery may suspend an account that breaks this schedule.

4. What we promise, and what we do not

We work to keep the apps available and your data safe, as described in the privacy notice, but the apps are provided as they are and without a guarantee they will always be available. Because the service is free to you, our liability to you is limited to £100, except for anything that cannot lawfully be limited, including death or personal injury caused by negligence, fraud, and your rights under data protection law. If you use the app as a consumer, this does not affect your statutory rights.

5. Changes and law

We may update this schedule, and will email you before a change that matters takes effect. It is governed by the law of England and Wales, but if you live elsewhere in the UK you may also bring a claim in your own courts.