Privacy policy
Last updated:
Clever Nursery is designed and operated with the applicable data protection requirements in mind, in particular Algerian Law No. 18-07 of 10 June 2018 as amended and supplemented by Law No. 25-11 of 24 July 2025, the EU General Data Protection Regulation (Regulation 2016/679) and the UK GDPR, where they apply. This policy explains what data we process, why, on what basis, where it is hosted and what your rights are.
1. Who we are
Clever Nursery is management software for nurseries, crèches, daycares and kindergartens, published and operated by CIRTA AGENCY LTD, a private limited company registered in the United Kingdom under number 15480678, with its registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom (cirta-agency.co.uk).
For Clever Nursery's activities in Algeria, CIRTA AGENCY LTD is represented by AMGHAR Abdenour, director and representative of the company for those activities. This is not a separate Algerian legal entity.
Contact for any personal data question: legal@clevernursery.com. Other contacts: hello@clevernursery.com, support@clevernursery.com, +213 783 90 60 75.
Data protection officer (DPO): TODO — INFORMATION TO BE CONFIRMED. Representative in the European Union under Article 27 GDPR: TODO — INFORMATION TO BE CONFIRMED.
2. Two services, two infrastructures
| Service | Address | What it does | Hosting |
|---|---|---|---|
| Marketing website | clevernursery.com | Product, pricing, blog, contact and demo form | Vercel |
| SaaS application | app.clevernursery.com | Running the nursery: children, families, staff, attendance, billing… | Contabo (server), behind the Cloudflare network |
Data entered in the application is not hosted on Vercel: it is stored on the application's Contabo infrastructure.
3. Who decides what: controller and processor
The customer nursery is the controller of the data it records in the application about children, their families, authorised persons and its staff. It decides what it records, why, who in its team can see it and how long it keeps it. For this data, CIRTA AGENCY LTD acts as a processor: it hosts and processes the data only to provide the service, on the nursery's instructions and under the data processing agreement (DPA).
CIRTA AGENCY LTD is the controller for its own purposes: the marketing website, contact requests, creating and managing user accounts, reviewing sign-up requests, the subscription and its billing, support, the security of the service and administrative communications.
Are you a parent or a member of a nursery's staff? Please send your questions and requests to that nursery first: it manages your data in Clever Nursery. We will help it answer. You can also write to legal@clevernursery.com; we will pass your request on to the nursery concerned.
4. Data processed on the marketing website (clevernursery.com)
- Contact, demo and sales requests: name, email and, if you give them, phone, organisation, number of children, topic, message and language. They are emailed to our team through Resend.
- Technical logs: IP address, date, page requested and browser, processed by Vercel to serve and protect the site. The contact form also limits the number of submissions per IP address (in memory, not stored).
- Preferences: your light or dark theme choice is kept in your browser's local storage, with no cookie and nothing sent to our servers.
- Analytics and advertising: no analytics tool or advertising pixel is currently enabled on the website. If we enable one, it will only load after you agree (see the cookie policy).
5. Data processed in the application (app.clevernursery.com)
Depending on the modules used and what the nursery chooses to record, the application may hold the following data.
5.1 User accounts (directors, office staff, educators, accountants, parents)
- Name, email address, language, role in the nursery, profile picture if any.
- Authentication data: password (stored only as a hash), two-factor authentication (TOTP) and passkeys if you enable them, temporary verification codes.
- Sessions: session identifier, IP address and browser (user agent) of the sign-in.
- Account request (a nursery signing up): name, email, nursery name and size, country, wilaya or region, city, phone. This is used to review the request before the account is opened.
5.2 The nursery
Name, legal name, address, phone, email, website, logo, currency, time zone, tax identifiers and the details printed on invoices issued to families.
5.3 Children
- Identity: last name, first name, preferred name, date and place of birth, sex, national identification number if the nursery records it, photo.
- Life at the nursery: status, admission and leaving dates and reason, classroom, attendance (arrival, departure, person who picked the child up, reason for absence), daily care (meals, naps, nappy changes…), activities and activity photos, notes, documents.
- Consents collected by the nursery: photo consent, outings consent.
- QR card: a random identifier, unrelated to the child's data.
- Online pre-registration: the child's and guardian's details entered in the nursery's public form, with the date of consent.
5.4 Children's health data (special category)
The application lets the nursery record health data: allergies and allergens, dietary restrictions, medical conditions, medication, blood type, doctor, vaccination status, special needs, and incident reports (circumstances, care given, medical follow-up, witnesses, when and how the family was told).
This is special-category data (Article 9 GDPR where it applies; sensitive data under Law No. 18-07). The nursery, as controller, must have an appropriate legal basis (for example the explicit consent of the person with parental responsibility, or a legal obligation specific to early-years care) and record only what is needed for the child's safety and care.
Technical measures in place: health data is never available to the accountant role; educators only see children in their classrooms; health data is never written to technical logs nor put in notifications; a closed incident report can no longer be edited or deleted, only supplemented by a dated amendment.
5.5 Families, guardians and authorised persons
Last name, first name, relationship to the child, phones, email, address, occupation, employer, preferred language, identity document if the nursery records it, custody, permission to pick the child up, emergency contact, receiving notifications; for people authorised to pick up the child: name, relationship, phone, identity document if any.
5.6 Staff
Last name, first name, position, phone, email, address, date of birth, start and end dates, contract type, status, notes, assignments, attendance, absence or leave requests, documents (identity, diplomas, contracts).
5.7 Running and billing the nursery
Invoices, lines, discounts, family payments (amount, method, reference, receipts), reminders, expenses, suppliers (name, contact details, tax identifiers) and receipts.
5.8 Communication and traceability
Announcements, in-app and email notifications (recipient address, sending status), an audit log of significant actions (who, what, when, changes), import history.
5.9 Clever Nursery subscription
Plan, currency, periods, status, amounts, payment provider and transaction references; for payment by transfer (BaridiMob, CCP, bank), the receipt you upload and its reference. We never receive or store full card numbers: they are handled directly by the payment provider.
5.10 Analytics in the application
The application uses Google Analytics 4 to measure which screens are used. The addresses sent to Google are cleaned: record identifiers are replaced by ":id", invitation tokens by ":token", search parameters are removed, and no name, amount or description is sent. See the cookie policy for the related cookies.
6. Purposes and legal bases
| Purpose | Data | Role of CIRTA AGENCY LTD | Legal basis (GDPR / UK GDPR, where applicable) |
|---|---|---|---|
| Answering contact and demo requests | Contact form | Controller | Pre-contractual steps (Art. 6(1)(b)) or legitimate interest in answering requests (Art. 6(1)(f)) |
| Creating, reviewing and managing accounts | Accounts, sign-up request | Controller | Performance of the contract (Art. 6(1)(b)) |
| Providing the application to the nursery | Data in sections 5.2 to 5.8 | Processor | The basis chosen by the nursery; for us, the customer's instructions (Art. 28) |
| Subscription, billing, payments | Section 5.9 | Controller | Contract (Art. 6(1)(b)) and accounting obligations (Art. 6(1)(c)) |
| Support | Messages, data needed for the request | Controller or processor, as the case may be | Contract (Art. 6(1)(b)) |
| Security, abuse prevention, logs | Sessions, IP, logs, audit | Controller | Legitimate interest in protecting the service and the data (Art. 6(1)(f)) |
| Service emails (codes, resets, billing, notifications) | Email, message content | Controller or processor, depending on the message | Contract (Art. 6(1)(b)) |
| Marketing website analytics (if enabled) | Browsing data | Controller | Consent (Art. 6(1)(a)) |
| Application analytics | Cleaned browsing data | Controller | Consent where required (Art. 6(1)(a)); see section 13 |
| Marketing communications | Controller | Consent or, for existing customers, legitimate interest within legal limits; no marketing communications are currently sent |
Under Algerian Law No. 18-07 as amended, processing relies on the data subject's consent or on one of the exceptions the law provides (performance of a contract, legal obligation, legitimate interest, etc.); prior formalities with the National Authority for the Protection of Personal Data (ANPDP): TODO — INFORMATION TO BE CONFIRMED.
7. Children's data: particular care
- Clever Nursery is a tool used by professionals. Children do not use the application and have no account.
- A child's data is entered by the nursery or by the child's legal guardians through the parent space.
- A guardian without custody receives no information about the child.
- Photos of a child without photo consent are never shown to other families.
- Each nursery is isolated from all others: a user can never reach another nursery's data.
- We do not sell any data, do not use children's data for advertising and carry out no profiling of children.
8. Recipients and providers
Data is available, within the limits of their duties, to the nursery's authorised members according to their role, and to authorised CIRTA AGENCY LTD staff where needed for support, security or maintenance.
We use the following providers (details, location and safeguards on the subprocessors page):
| Provider | Service | Concerns |
|---|---|---|
| Vercel Inc. | Marketing website hosting | clevernursery.com |
| Contabo GmbH | Hosting of the application server and its database | app.clevernursery.com |
| Cloudflare, Inc. | DNS, routing and protection of traffic, routing of incoming @clevernursery.com email | Both |
| Resend, Inc. | Sending email (contact form, sign-in codes, notifications, billing) | Both |
| Stripe | Card payment of subscriptions in euros (EUR) | Subscription |
| Chargily | Online payment of subscriptions in Algerian dinars (DZD): CIB, Edahabia | Subscription |
| Google (Google Analytics 4) | Application analytics | app.clevernursery.com |
We may also disclose data where the law requires it or at the request of a competent authority, within the limits set by law.
9. Marketing website hosting: Vercel
The clevernursery.com website is hosted by Vercel Inc. (United States). Pages are served from Vercel's global network; the site's server functions (including the contact form) run in the United States. Vercel provides a Data Processing Addendum covering in particular the GDPR and UK GDPR, with the European Commission's standard contractual clauses and the UK addendum for transfers (vercel.com/legal/dpa).
10. Application hosting: Contabo
The hosting infrastructure of the Clever Nursery application is provided by Contabo GmbH (Munich, Germany). The server hosts the application, the PostgreSQL database and uploaded files (photos, documents, receipts). Contabo states that it applies data protection measures in line with GDPR requirements and provides a data processing agreement (DPA) for the processing concerned (docs.contabo.com).
Server location: TODO — CONFIRM THE CONTABO DATA CENTRE USED BY CLEVER NURSERY. Contabo offers data centres in several regions; the exact location depends on the configuration of the service subscribed.
Clever Nursery's compliance is not reduced to that of its hosting providers: CIRTA AGENCY LTD remains responsible for its own obligations.
11. Payments
Online payments are handled directly by the payment providers: Stripe for cards in euros (auto-renewing subscriptions), Chargily Pay for payments in dinars (CIB, Edahabia). We only receive the payment status, the amount and technical references. For transfers (BaridiMob, CCP, bank), you upload a receipt, which our team reviews and then keeps with the payment record.
12. Email
Transactional emails (sign-in codes, password resets, sign-up request reviews, billing reminders, the nursery's notifications to families) and contact form messages are sent through Resend. Notifications never contain health data. Email sent to our @clevernursery.com addresses is routed by Cloudflare's email routing service.
13. Cookies and local storage
See the cookie policy. In short: the marketing website sets no analytics cookie as long as no tool is enabled and you have not agreed; the application uses necessary cookies (session, selected nursery, preferences) and Google Analytics cookies. A banner to accept or refuse the application's Google Analytics cookies is being put in place; in the meantime, you can block them in your browser settings or with the Google Analytics opt-out add-on.
14. Security
Measures actually in place:
- Encrypted HTTPS (TLS) connections with HSTS; server firewall limited to web and SSH access.
- Passwords hashed, never stored in clear; two-factor authentication (TOTP) and passkeys available; one-time verification codes valid for 5 minutes.
- Rate limiting on sign-in, codes and public forms.
- Role-based access control checked by the server on every request; strict isolation between nurseries, covered by automated tests.
- Private files (photos, documents, receipts) served only after an access check.
- HTTP security headers, an audit log of sensitive actions, rotation of technical logs.
- A full backup downloadable by the director, with optional password-based AES-256 encryption.
No system is invulnerable: we cannot guarantee absolute security, but we keep improving these measures. Database encryption at rest and automatic off-server backups: TODO — INFORMATION TO BE CONFIRMED.
15. Retention periods
| Data | Period |
|---|---|
| The nursery's data in the application | As long as the nursery's account exists, subject to deletions made by the nursery. Changing or ending a plan deletes no data. Period after termination: TODO — DEFINE THE RETENTION PERIOD |
| Rejected or withdrawn pre-registrations | Deleted automatically 12 months after the decision |
| Verification codes and reset tokens | Deleted daily once expired |
| Deleted files | Erased from disk within the hour after the record is deleted |
| Application technical logs | Automatic rotation (at most 14 files of 50 MB) |
| Contact requests | TODO — DEFINE THE RETENTION PERIOD |
| Subscription billing data | Period required by applicable accounting obligations: TODO — DEFINE THE RETENTION PERIOD |
| Server backups | TODO — DEFINE THE RETENTION PERIOD |
| Audit log | TODO — DEFINE THE RETENTION PERIOD |
16. Export, deletion and return
- Export: the nursery's director can export lists (children, families, staff, attendance, invoices, payments, expenses, classrooms) and download a full backup of the nursery at any time, in clear or encrypted.
- Deleting records: the nursery can delete records (children, families, staff, documents…) in the application. A family linked to invoices or payments is archived rather than deleted, to keep the accounts consistent.
- Nursery: the director can archive a nursery from its settings.
- User account: there is currently no self-service deletion. To delete your account, write to legal@clevernursery.com; deleting an account also deletes the nurseries of which it is the only member, with their files.
17. Your rights
Depending on the applicable law, you have in particular the rights of access, rectification, erasure, restriction, objection and portability, and the right to withdraw consent at any time (without affecting earlier processing); under Law No. 18-07, the rights to information, access, rectification and objection.
To exercise them: legal@clevernursery.com. We may ask you to prove your identity. We answer within the legal time limits (in principle one month under the GDPR). For data that a nursery manages in the application, we pass your request on to the nursery and help it answer.
18. International transfers
CIRTA AGENCY LTD is established in the United Kingdom; some of our users are in Algeria, France and the European Union; some providers are in the United States (Vercel, Cloudflare, Resend, Google, Stripe). Data may therefore be transferred between these countries.
- European Union → United Kingdom: the United Kingdom benefits from an adequacy decision of the European Commission.
- To the United States: European Commission standard contractual clauses and the UK addendum provided in the providers' data processing agreements, or certification under the EU-US Data Privacy Framework where the provider holds it.
- From Algeria: transfers are made in accordance with the conditions of Law No. 18-07 as amended; any formalities required with the ANPDP: TODO — INFORMATION TO BE CONFIRMED.
19. Data breaches
If a personal data breach occurs, we act without delay to contain it. Where we act as a processor, we inform the nursery concerned as soon as possible so that it can meet its own obligations. Where we are the controller, we notify the competent authority and, if the risk is high, the people concerned, within the time limits of the applicable law (no later than 72 hours after becoming aware of it under the GDPR; the time limits of Law No. 18-07 as amended for the ANPDP).
20. Complaints
You can lodge a complaint with the competent data protection authority, in particular:
- Algeria: National Authority for the Protection of Personal Data (ANPDP);
- France: Commission nationale de l'informatique et des libertés (cnil.fr);
- United Kingdom: Information Commissioner's Office (ico.org.uk);
- another EU Member State: the authority of the country where you live or work.
We invite you to contact us first at legal@clevernursery.com so that we can look for a solution.
21. Changes
We will update this policy if our practices or the law change. The date of the last update is shown at the top of the page; for significant changes, we will inform customers by email or in the application.
22. Contact
CIRTA AGENCY LTD — Clever Nursery, 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom. Personal data: legal@clevernursery.com. Support: support@clevernursery.com.