COPPA Compliance Statement

The Children's Online Privacy Protection Act (COPPA) applies to the online collection of personal information from children under the age of 13 in the United States. Pebblhub is designed to help licensed childcare providers manage their operations, and our platform handles children's data exclusively on behalf of and under the instruction of those providers.

This statement explains how Pebblhub complies with COPPA when its platform is used by US childcare centers, daycares, and preschools.

Pebblhub does not directly collect personal information from children. All data entered into the platform about children — including name, date of birth, health records, activity logs, and photos — is entered by:

•Nursery administrators or staff — as part of daily childcare management.

•Parents or guardians — via the parent-facing app, after their nursery has provided them access.

The nursery operator (the childcare center) acts as the data controller and is responsible for obtaining verifiable parental consent before enrolling a child on the platform.

Before a child's information is entered into Pebblhub, the childcare center is responsible for:

•Obtaining written consent from a parent or legal guardian.

•Informing parents of what information will be collected and how it will be used.

•Providing parents with the ability to review, update, or delete their child's information.

Pebblhub provides nurseries with a standard parental consent template that covers data collection practices within the platform. Nurseries are required to complete this process as part of their onboarding.

The following types of data may be stored in Pebblhub on behalf of childcare centers:

•Identity data — child's name, date of birth, photo (optional).

•Health data — allergies, medical conditions, medication records, nurse logs.

•Activity data — daily reports, meals, sleep, nappies, learning activities.

•Incident data — incident reports, photos, severity levels.

•Attendance data — check-in and check-out records.

This data is collected solely to deliver childcare management services to the nursery. It is not used for advertising, sold to third parties, or shared beyond the nursery's authorised users.

Parents and guardians have the right to:

•Review all personal information collected about their child — via the parent app or by contacting the nursery.

•Correct inaccurate information by contacting their nursery administrator.

•Delete their child's information by requesting removal from the nursery, which will instruct Pebblhub to delete the data.

•Refuse further collection by withdrawing consent — the nursery will be notified and access will be restricted accordingly.

To exercise these rights, contact your child's nursery in the first instance. For platform-level enquiries, email support@pebblhub.com.

When a childcare center requests deletion of a child's record — or when a parent exercises their right to erasure — Pebblhub will permanently delete all associated personal data within 30 days of the request.

Upon account closure, all data is retained for a 90-day export window and then permanently deleted. No personal data is retained beyond this period unless required by applicable law.

Pebblhub implements the following measures to protect children's data:

•Encryption in transit (TLS 1.2+) and at rest (AES-256).

•Role-based access controls — only authorised staff can view a child's records.

•Audit logs for all data access and modifications.

•Regular security assessments and vulnerability testing.

For any COPPA-related requests or questions:

Email: support@pebblhub.com

Subject line: "COPPA Request"

We will respond within 10 business days.