Privacy Policy

1. About This Policy

This Privacy Policy explains how Prime Horizon Inc. ("Prime Horizon," "we," "our," or "us"), operating as Sprout & Vine, collects, uses, discloses, and protects personal information when you use our platform, website at sproutandvine.ca, and related services (collectively, the "Services").

By accessing or using our Services, you agree to the collection and use of your information as described in this policy. If you do not agree, please discontinue use of the Services.

2. Who We Are

Prime Horizon Inc. is a Canadian corporation. Sprout & Vine is our childcare management platform designed for Canadian childcare operators. Our registered address and privacy inquiries may be directed to privacy@sproutandvine.ca.

We are subject to the Personal Information Protection and Electronic Documents Act (PIPEDA) and, for operators and users in Québec, An Act Respecting the Protection of Personal Information in the Private Sector (Law 25 / Bill 64).

3. Information We Collect

Information you provide directly

• Account information: your name, email address, phone number, and the name of your childcare centre when you register or contact us.
• Organization details: centre name, province, number of children enrolled, and similar operational details you enter during onboarding.
• Payment information: billing details collected via our payment processor (Stripe). We do not store raw credit card numbers on our servers.
• Communications: messages you send us via email, the contact form, or in-app support channels.
• Operational data: information you enter about your centre, including attendance records, enrollment data, daily reports, and communication logs with families, as part of using the platform.

Information collected automatically

• Usage data: pages visited, features used, time spent, and actions taken within the platform, collected through analytics tools.
• Log data: IP address, browser type, device type, referring URLs, and access timestamps.
• Cookies: small data files placed on your device. See Section 9 for details.

Information about children in your care

As an operator using our platform, you may enter information about the children enrolled at your centre (such as names, dates of birth, attendance records, and developmental milestones). This information is entered and controlled by you, the operator. We process this data strictly on your behalf as a data processor. You are responsible for obtaining appropriate consent from families as required under applicable law.

4. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain the Sprout & Vine platform and Services.
• Process payments and manage your subscription.
• Respond to your support requests, questions, and feedback.
• Send you service-related communications (account notices, security alerts, billing receipts).
• Send you product updates, feature announcements, and occasional promotional content. You may opt out at any time.
• Monitor and improve the performance, security, and functionality of the Services.
• Comply with legal obligations, including tax and regulatory requirements.
• Enforce our Terms of Service and protect the rights of our users.

We do not sell your personal information to third parties. We do not use your data to train AI or machine learning models without your explicit consent.

5. How We Share Your Information

We share personal information only in the following limited circumstances:

• Service providers: we share data with trusted vendors who help us operate the platform (hosting, payment processing, email delivery). These vendors are contractually required to protect your data and may only use it as directed by us. See Section 10 for a list of key third parties.
• Legal requirements: we may disclose information when required by law, court order, or government authority, or when we believe disclosure is necessary to protect our legal rights or prevent harm.
• Business transfers: if Prime Horizon Inc. is involved in a merger, acquisition, or sale of assets, your information may be transferred. We will notify you before your personal information is transferred and becomes subject to a different privacy policy.
• With your consent: we may share information for any other purpose with your explicit consent.

We do not share personal information with advertisers or data brokers.

6. Storage & Security

All personal information processed by Sprout & Vine is stored on servers located in Canada. We use cloud infrastructure hosted on Canadian data centre regions.

We protect your data using:

• Encryption in transit (TLS 1.2+) and encryption at rest.
• Role-based access controls limiting who within Prime Horizon can access user data.
• Regular security assessments and vulnerability monitoring.
• Secure, audited access logs for administrative actions.

No method of transmission over the internet is 100% secure. While we use commercially reasonable safeguards, we cannot guarantee absolute security. If you become aware of any security issue, please contact us immediately at security@sproutandvine.ca.

7. Retention

We retain your personal information for as long as your account is active, plus a period of seven (7) years following account termination to comply with Canadian tax, accounting, and regulatory obligations (Income Tax Act, applicable provincial regulations).

Operational data entered about children in your care (attendance records, daily reports, development milestones) is retained for the duration of your subscription, plus an additional period as required by applicable childcare regulations in your province. You may request earlier deletion where permitted by law.

You may request deletion of your account and associated personal information by emailing privacy@sproutandvine.ca. We will action your request within 30 days, subject to legal retention requirements.

8. Your Privacy Rights

Under PIPEDA (all provinces except Québec)

You have the right to:

• Access: request a copy of the personal information we hold about you.
• Correction: request correction of inaccurate or incomplete information.
• Withdrawal of consent: withdraw consent to certain uses, subject to legal and contractual constraints.
• Complaint: file a complaint with the Office of the Privacy Commissioner of Canada at priv.gc.ca.

Under Québec Law 25 (for Québec residents)

In addition to PIPEDA rights, Québec residents have the right to:

• Data portability: receive a structured, machine-readable copy of personal information you provided to us.
• Erasure: request deletion of your personal information where it is no longer necessary for the purposes for which it was collected.
• Restrict processing: request that we limit how we process your data in certain circumstances.
• Lodge a complaint: with the Commission d'accès à l'information du Québec (CAI) at cai.gouv.qc.ca.

To exercise any of these rights, email us at privacy@sproutandvine.ca. We will respond within 30 days of receiving your request.

9. Cookies & Tracking

We use cookies and similar technologies for the following purposes:

• Essential cookies: required for the platform to function (authentication sessions, security tokens). These cannot be disabled.
• Analytics cookies: help us understand how the platform is used so we can improve it (Vercel Analytics). These collect anonymised, aggregated data.

We do not use advertising cookies or behavioural tracking cookies. You can control cookie preferences through your browser settings. Disabling essential cookies will prevent you from using the platform.

Our analytics implementation does not use cookies that require consent under Canadian privacy law as it collects only anonymised, non-identifying data.

10. Third-Party Services

We use the following key third-party service providers. Each is bound by its own privacy policy:

• Vercel Inc.: website hosting and edge network delivery. Privacy Policy
• Stripe Inc.: payment processing. Stripe handles all payment card data under PCI-DSS compliance. Privacy Policy
• Google LLC: transactional email delivery via Gmail SMTP (contact form submissions). Privacy Policy

We review the privacy practices of our service providers before engagement and where possible select vendors with Canadian or EU-standard data protections.

11. Children's Data

Our Services are intended for use by childcare operators and their staff, specifically adults operating licensed childcare facilities. We do not knowingly collect personal information directly from children under the age of 13. Information about children enrolled in a childcare centre is entered by the centre operator and processed on their behalf.

Operators are responsible for ensuring they have appropriate consent from parents and guardians to enter and process information about children in their care, as required by their provincial childcare licensing regulations and PIPEDA.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will notify you by email (to the address on your account) and by posting a prominent notice on the platform at least 30 days before the changes take effect.

Your continued use of the Services after the effective date of any update constitutes your acceptance of the revised policy.

13. Contact Us

For privacy-related questions, requests, or complaints, contact us at:

Privacy Officer
Prime Horizon Inc. (operating as Sprout & Vine)
privacy@sproutandvine.ca

We will acknowledge your inquiry within 2 business days and respond fully within 30 calendar days. If you are not satisfied with our response, you have the right to contact the Office of the Privacy Commissioner of Canada or, for Québec residents, the Commission d'accès à l'information du Québec.