Privacy Policy

Puffin Enterprises Ltd., doing business as "Puffin Services", operates puffinservices.com from British Columbia, Canada, holding an intermunicipal business licence covering 16 Lower Mainland and Fraser Valley municipalities. For anything in this policy, our privacy contact is admin@puffinservices.com.

We collect only what we need to deliver care coordination. By category:

• Contact details — your name, email address, and phone number, so we can respond to inquiries, confirm bookings, and reach you about your care.
• Home address — so caregivers can be dispatched to the right place and so we can confirm you're within our licensed service area.
• Care details — the information you provide in booking and inquiry forms (schedules, preferences, special instructions), used solely to match and brief the right caregiver.
• Children's information — see section 4 below.
• Photo ID — see section 3 below.
• Payment information — payments are processed by Square. Your card number never touches our servers and we do not store it; we hold only Square's payment references (for example a payment ID and card brand/last four) needed to manage your booking.
• Consent records — when you create an account we store whether you accepted our Terms, whether you opted into marketing email, the date and time, and the version of the consent text you saw.
• Messages — what you and your caregiver write to each other, stored encrypted (see section 10).
• Reports — if you report a conversation, the reason you chose and any details you add, stored encrypted.
• Waitlist emails — if you join a "Notify Me" list, we store your email and the service you asked about, only to tell you when it launches.
• Job applications — if you apply to work with Puffin: your name, contact details, the first three characters of your postal code, your availability, experience and the answers you choose, and a photo of your face. We use them only to consider you for work and, if you're hired, to set up your caregiver profile. We may show your photo, first name and answers (never your last name or contact details) to families considering you for a placement, and to families you're placed with or assigned to; otherwise only the Puffin team sees it. It is stored privately, never published on the website, and the hidden information a phone adds to a photo (such as location) is removed. A résumé, if you attach one, is stored privately with your application; only the Puffin team can open it, and it is deleted with your application.
• Caregiver clock-in location — when a Puffin caregiver clocks in or out of a shift in My shifts, we ask their phone for its location and record it with the time, to confirm the shift took place at the family's address and to work out pay. We record it only at those two moments, never in between. If the caregiver doesn't allow it, the clock-in still works and we note that no location was shared. Only Puffin staff can see it, and we delete the location after 12 months.
• Notifications. If you turn on notifications in My shifts or in your Puffin account, we store a technical address for your browser or phone so we can alert you about your shifts or your caregiver. It contains no name or message history. You can turn notifications off at any time, and we delete the address when you do or when it stops working.
• Feedback about a caregiver. If you leave feedback about a caregiver, we may show your comment and your first name to that caregiver. Puffin sees all feedback.
• Family stories. If you agree, Puffin may show your story and first name on its website, including the homepage. You can withdraw this at any time and we remove it.
• Moments you share in the LookBook. If you share a moment in the LookBook, we keep your photos and caption, check them before they appear, remove location data from photos, and delete them when you remove the post.
• Messages to the Puffin team. If you write to us in Messages, we keep the conversation so we can help you with your bookings. Only Puffin staff can read it.
• Shift reports. At the end of a shift your caregiver may write a short report (for example meals, naps and activities). Only you, that caregiver and Puffin can read it.
• Shift to-do lists. If you add tasks for a shift, your caregiver sees them for that shift and can tick them off, and you see when each was done. They are kept with the booking.
• Emergency details. On the day of a shift, your caregiver can open your children's allergy and medical notes and your emergency contact in one place, in case of an emergency. It is the information you gave us; we never email it.
• Handover notes. A caregiver may leave a short note about your family's routine for the next caregiver on your booking. Only those caregivers and Puffin can read it, and it is kept with the booking.
• Shift times. When your caregiver clocks in and out, we show you those times on your booking — never their location — so you can see when care started and finished.
• Routine card. If you fill in a routine card for your children, we show it to your caregiver for their shifts with you, in the same way as your booking details. You can change or delete it at any time, and it is deleted with your account.
• Caregiver emergency contact. Your emergency contact's name and phone number are used only if something happens to you during a shift. Only Puffin can see them.
• Caregiver certificates. Caregivers can upload certificates (such as first aid) in My shifts. Only Puffin staff can see them, and they are stored separately from photo ID.

Before a caregiver is dispatched to a family's home for the first time, we ask the booking adult to upload a piece of photo identification. Why: our caregivers work alone inside private homes, and verifying who they are meeting is a safety measure that protects both your family and them.

• Who sees it: your ID is reviewed by a Puffin administrator only. It is never shared with caregivers, other families, or third parties.
• Where it's stored: in Google Firebase Cloud Storage under access rules that restrict it to your account and our administrator. Administrator access to view it uses short-lived, expiring links.
• What we record: the outcome of the review (verified / needs resubmission) and the review date on your profile.
• Retention and deletion: government-issued photo ID is collected strictly for identity verification purposes. We retain the record securely while your account is active so you don't need to re-verify for future bookings. ID records are manually deleted by platform administration — either upon your request (section 9) or at administration's discretion during routine data audits. If your ID record is deleted, re-verification will be required before a future booking.

We collect information about children only from a parent or guardian, and only what is needed to provide safe, appropriate care: age or date of birth, feeding and sleep routines, allergies and medical notes, temperament, and similar care details you choose to share. This information is used exclusively to match caregivers and brief them for your booking. We never use children's information for marketing, never sell it, and never collect information directly from a child. Our website and services are directed at adults.

We use a small number of well-established providers to run the platform. Each receives only what it needs for its function:

• Google Firebase / Google Cloud — our database, sign-in, and file storage (including photo ID uploads).
• Square — payment processing, card storage, and invoicing. Card data is handled entirely by Square under its own privacy policy.
• Resend — sending our transactional and marketing email. Emails about a new message say only that you have one; they never contain its text.
• Vercel — website hosting and the server functions behind our forms and messaging.
• Google Analytics — if enabled, anonymized usage analytics (see section 7).

These providers may store data on servers outside Canada (typically in the United States). Where that happens, your information is subject to the laws of those jurisdictions while stored there.

• Marketing email is optional and opt-in. The marketing checkbox at account creation is never pre-ticked, and declining it has no effect on your service.
• Every marketing email we send includes a one-click unsubscribe link (and supports your mail app's built-in unsubscribe button). Unsubscribing takes effect immediately.
• Transactional emails — booking confirmations, verification status, receipts, and similar service messages — are sent regardless of marketing preference, because they are part of delivering the service you asked for.
• We record when and how you gave or withdrew consent, as CASL requires.

We use a small amount of browser storage to keep you signed in (Firebase Authentication) and to remember preferences like a dismissed banner. If Google Analytics is enabled, it sets its own cookies and we configure it with IP anonymization; we use it only in aggregate to understand which pages and features are used. We may also use an error-monitoring service (Sentry) that receives technical details of errors (browser type, the page involved) to help us fix problems — not for advertising. We do not run third-party advertising cookies.

Some videos on our LookBook page are hosted on YouTube or Instagram. They load only when you press play — until then, the page makes no request to either site. Once you play one, YouTube or Instagram may set their own cookies, and their privacy policies apply to that video.

We keep personal information only as long as needed for the purposes above or as the law requires (for example, financial records connected to payments). Booking and inquiry records are retained while your account is active and for a reasonable period afterward to handle follow-ups, disputes, and legal obligations. For the newer parts of the service, the schedule is fixed:

• Messages — kept for 2 years after the last day of the booking, then destroyed: first the conversation's own encryption key, then the messages. A conversation under review is kept until the review is resolved, and for 2 years after that.
• Reports, flags and the record of who opened a conversation — kept for 1 year after the conversation is destroyed. Report details are destroyed with the conversation.
• Your caregiver's photo, as shown to you — available until 7 days after their last day with you.
• Caregiver photos — deleted 30 days after a caregiver leaves Puffin, or immediately if they withdraw their consent.
• Sign-in and photo links — deleted a day after they expire.
• Job applications — if you aren't hired, your application and photo are deleted 12 months after we last updated it. If you're hired, your photo moves to your caregiver profile and the caregiver photo rule above applies.
• Photos in messages — deleted 90 days after the last day of the booking.
• Shift reports — kept for 2 years after the last day of the booking, then deleted.
• Caregiver certificates — we keep the latest of each, and delete them 30 days after a caregiver leaves Puffin.
• Saved answers — if you ask us to email you a link to finish the nanny placement form later, we keep your answers for 30 days, or until you send the form, and then delete them.

Access to systems holding your information is restricted, administrator actions on sensitive data (like photo ID review, payment capture and opening a conversation under review) are authenticated and recorded, and data is encrypted in transit and when stored. Messages carry a further layer of encryption of their own (section 10).

Under PIPA and PIPEDA you may ask us: what personal information we hold about you, to correct it if it's inaccurate, or to delete it. Send any request to admin@puffinservices.com from the email address on your account, and we will respond within 30 days. We may need to keep certain records where the law requires it (for example payment records), and we'll tell you if that applies. Messages are also kept on their schedule (section 8) even if you delete your account, so that a conversation stays an intact record if a safety question ever arises. You can also update most profile information yourself from your member portal. If you're not satisfied with our response, you may contact the Office of the Information and Privacy Commissioner for British Columbia.

• How they are stored: every message is encrypted (AES-256) before it is saved, with a key that belongs to that one conversation. Our database holds only the encrypted text.
• Who reads them: you and your caregiver, and Puffin staff, who may read any conversation to keep everyone safe and to make sure arrangements stay with Puffin. Each time, the staff member, the time and their reason are recorded, and that record cannot be edited or deleted.
• Automatic flags: when a message is sent, our own servers check it for contact details, payment outside Puffin, or arranging work outside Puffin. No outside service and no AI is involved. Only the kind of thing found is recorded, never the words, and the message is still delivered.
• Contact details in messages: phone numbers, email addresses, links and social media handles are hidden from the other person. Puffin keeps what was hidden, encrypted and for Puffin staff only, so we can reach you about a booking, and emails it to our office.
• Photos: if you turn on photos for a booking, your caregiver can send you photos during their shifts. Photos are encrypted like messages, seen only by you, your caregiver and Puffin staff, and deleted 90 days after the last day of the booking. Caregivers may not keep, share or post them anywhere.
• Notifications: emails tell you that you have a new message, never what it says.
• How long: see section 8.

Once your caregivers are confirmed, we show you each one's first name, the credentials we have on record for them, and their photo if they have agreed to share it. The photo is shown only to the family whose booking they are on, through links that work once and expire within minutes, and only until 7 days after their last day with you. Caregivers can withdraw their consent to sharing their photo at any time, and it is then deleted.

If a caregiver chooses to, we also show you a short intro they wrote, whether they have finished Puffin's training, and, once they have cared for at least 3 Puffin families, how many. Caregivers can stop sharing their intro at any time. When your caregivers clock in and out, we can notify you of the time, never their location.

If we change this policy in a meaningful way, we'll update the "last updated" date above and, for significant changes, notify account holders by email. Continued use of the service after a change takes effect means the updated policy applies.