Data residency & sub-processors
Last updated: July 27, 2026
This page exists because every licensed childcare operator asks the same question during due diligence: where does the data actually live, and who else touches it? The short answer — program data (children, guardians, attendance, daily records, photos, invoices) is hosted in Canada. A short list of specialized providers handle narrower jobs like card payments, crash reporting, and email delivery, each receiving only what their job requires. See our Privacy Policy for the full legal document — this page is the specific, technical version of the same answer.
Where program data lives
All account and program data — child profiles, attendance, daily activity records, messages, menus, lesson plans, invoices, and photos — is hosted on Supabase, in Supabase's Canada Central (ca-central-1) region. Photos are stored in a private bucket, never public, and served only through short-lived signed links. Access is enforced at the database level with row-level security, not only in the app's interface.
Sub-processors
These are the only third parties any personal information passes through, and what each one receives:
| Provider | What it receives | Purpose | Region |
|---|---|---|---|
| Supabase | All program & account data, photos | Database, auth, file storage | Canada (ca-central-1) |
| Stripe | Card details — never touch Nestlings' servers | Payment processing | Global, PCI-DSS Level 1 |
| Amazon SES | Recipient address + content of transactional emails (invites, password resets, receipts) | Outbound transactional email | United States |
| Brevo | Same as above — fallback only if Amazon SES is unavailable | Transactional email fallback | European Union |
| Sentry | Crash reports and error diagnostics, configured to exclude personal data by default (sendDefaultPii: false) | Crash & performance monitoring | United States |
| PostHog | Anonymized product-usage events; an internal account ID once signed in, never child data, photos, or message content | Product analytics | United States |
| Apple & Google | A device push token only — never message or record content | Push notification delivery | Per platform |
What never leaves our primary database
Health card numbers, medical notes, allergies, incident reports, medication records, and emergency contacts are stored only in Supabase — the same Canadian-hosted database as everything else. None of the sub-processors above receive this data. We do not use any data, from any source, for advertising, and we do not sell personal information to anyone.
Questions for your own review
If your licensing body or board asks for something this page doesn't cover — a signed data processing agreement, a specific retention figure, or confirmation for a sub-processor not listed above — contact us and we'll answer directly rather than pointing you at boilerplate. See account deletion for how to remove data if you ever need to.