This policy explains how Logiciel Candy Inc., a corporation incorporated under the laws of Quebec doing business as MonGardy ("we", "us"), handles personal information, with the expectations of Quebec's Law 25 (Act to modernize legislative provisions as regards the protection of personal information) in mind.
Scope and our role
MonGardy plays two distinct roles:
- Data controller — for our marketing site (mongardy.com), the registration/contact form, and business communications with daycares and prospects.
- Data processor — for the data inside the MonGardy app (children, daily reports, observations, progress reports, messages, photos, attendance). Each daycare is the controller of that data; we process it on the daycare's instructions.
Parents and educators wishing to exercise rights over information held inside the app should contact their daycare, which controls that data.
Information we collect
- Registration / contact form (as controller): full name, daycare name, work email, phone (optional), address, city, and postal code, plus your consent to be contacted. We also record the language of the page you submitted from so we can reply in French or English.
- Business communications (as controller): the content of emails or messages you send us.
- Application data (as processor, on behalf of daycares): accounts and roles, children's profiles, daily reports, educator observations, progress reports, parent–educator messages, attendance, and photos. The daycare decides what is entered and who may access it.
- Collected automatically (marketing site): server logs (such as IP address, browser/user-agent, timestamps, pages visited) for security and reliability. We do not use web analytics, advertising, or cross-site tracking cookies.
How we use information
- Respond to registration and contact requests, and set up daycares.
- Provide, maintain, and secure the marketing site and the app.
- Communicate about MonGardy with people who asked to be contacted.
- Meet our legal obligations.
We do not sell or rent personal information.
Data residency and sub-processors
MonGardy's core application components are hosted in Canada. Some strictly necessary functional services, such as authentication email delivery, may be processed by sub-processors outside Canada. Each component is documented below.
| Component | Region | What it processes |
|---|---|---|
| Frontend (marketing site & lead form) | Montreal | Lead-form submissions (name, daycare, contact, message) |
| Backend (application API) | Montreal | App requests for daily reports, messages, and photo metadata |
| Database | Toronto or Montreal | Accounts, roles, daily reports, messages, parent-educator links |
| Cloud storage | Montreal | Child photos/media only; no report text, message text, observations, or parent contact details |
| Authentication emails | United States | Email address, password reset or invitation link, and minimal delivery metadata; no child information, reports, observations, messages, or photos |
Each sub-processor is bound by written confidentiality and data-processing terms, and receives only the data needed for its function. The specific list of sub-processor companies is available to daycares on request.
Cookies and analytics
The marketing site does not use web analytics, advertising, or cross-site tracking cookies. The app uses only the tokens strictly necessary to keep you signed in.
Sharing of personal information
We share personal information only with the service providers described above, when required by law (for example, a court order), or in connection with a business transfer — in which case the same protections continue to apply. We do not sell or rent personal information.
Data retention and deletion
We keep personal information only for as long as necessary for the purposes described above or as required by law, after which we delete or anonymize it. Daycares may request an export or deletion of their data, which we action within a reasonable time. Backups are purged on our regular rotation cycle. Registration-form leads are kept only as long as needed to follow up.
Security
- Encryption in transit (TLS) and at rest.
- Role-based access with least-privilege; child- and classroom-scoped access in the app.
- Audit logging of sensitive actions.
- A written incident-response plan and regular review of security measures.
No method of transmission or storage is completely secure. While we take reasonable measures to protect personal information, we cannot guarantee absolute security.
Security incident notification
If a confidentiality incident creates a risk of serious injury, we notify the affected daycare and, where required, Quebec's Commission d'accès à l'information and affected individuals, in accordance with applicable law. Our internal process covers containment, risk assessment, logging, and communication.
Consent management
Parent photo consent is captured and stored at the per-child level. Any linked parent or guardian may grant or revoke consent. No photo can be attached to a message or report without an active, system-validated consent.
Children's data
Children's information in the app is sensitive and is controlled by the daycare. Daycares are responsible for obtaining the necessary parental consent; under Quebec law, consent for a child under 14 is given by the person having parental authority. We never send children's data to web analytics.
Artificial intelligence
We do not use artificial intelligence to process personal information at this time. If we introduce AI-assisted features, we will update this policy and disclose the processing — including any cross-border transfer — before it begins.
Your rights
- Access to your personal information.
- Correction of inaccurate or incomplete information.
- Withdrawal of consent.
- Portability of your personal information, where the law provides.
- De-indexing and cessation of dissemination where the law provides.
- Complaint to Quebec's Commission d'accès à l'information.
To exercise these rights for marketing-site or business data, contact us below. For data held inside the app, contact your daycare, which controls that data.
Privacy officer and contact
The Privacy Officer, MonGardy is the person responsible for personal information handled by Logiciel Candy Inc., designated under Quebec's Law 25 art. 3.1.
Privacy requests: privacy@mongardy.com.
General contact: bonjour@mongardy.com.
Data processing agreement (DPA)
Our data processing terms are set out in our Terms of Use and form part of the agreement with each daycare, so no separate signature is required. A countersigned copy for your compliance file is available on request at privacy@mongardy.com.
Changes to this policy
We may update this policy from time to time. Material changes will be posted here with a new effective date and communicated to affected daycares; where the law requires consent for a change, we will obtain it before the change applies to you.
Governing law
This policy is governed by the laws of Quebec and Canada, including Quebec's Law 25 and, where applicable, PIPEDA.
Effective: May 2026.