Security and data
What Toddly stores for nurseries and parents, how long we keep it, who processes it for us, and how the AI assistant is kept to the facts.
Last updated 14 November 2026
This page sets out the facts about how Toddly handles data for nurseries and the parents who contact them. Our privacy notice has the full legal detail.
What we store
- Enquiries parents send to a nursery: their name, email or phone, their child’s age, start date and days, and their message. We never ask for a child’s name.
- Chats with a nursery’s assistant: what was typed and the answers.
- Show-round bookings: the time, and the enquiry they belong to.
- Accounts: the email address people sign in with, and when they last signed in. Sign-in is a one-time link by email, so parents and nursery staff have no password for us to store.
- What a nursery adds: its page details, fee table, opening hours, photos, its own answers and files for the assistant, its reply templates and, on Pro, its webhook address.
What we never store
- Card details. Payments are taken on Stripe’s own page; we keep only the subscription status Stripe sends us.
- The words typed into AI search. We keep a salted one-way hash of each search, with counts and cost, not what was typed.
- A readable webhook secret. A nursery’s webhook signing secret is stored encrypted and shown to the nursery once, when it is made.
How long we keep it
| What | How long |
|---|---|
| Chats | 12 months after the last message, then deleted |
| Enquiries passed to a nursery | 24 months, then deleted (the nursery keeps its own copy under its own policy) |
| Enquiries we could not pass on, and area requests | 12 months, then deleted |
| Demo requests from nursery staff | 12 months, then deleted |
| Queued emails and webhook events | 30 days after sending |
| Database backups | 7 days |
| Accounts | Until they are deleted |
These periods are applied automatically by a daily job.
Where it runs
The site runs on one server at Amazon Web Services, as our privacy notice sets out. Visitors reach the site through Cloudflare’s network.
Who processes data for us
| Role | Provider |
|---|---|
| Payments | Stripe |
| AI model for the assistant and AI search | Set for each deployment: Amazon Bedrock (running Anthropic’s Claude), Anthropic’s own API or OpenRouter. Our privacy notice names the one in use |
| Email delivery | Our email delivery provider, which sends sign-in links, enquiry emails, confirmations and reminders |
| Bot check | Cloudflare Turnstile, on the “Get the Ofsted report” button only |
| Content delivery and network security | Cloudflare |
| Reading a web page a nursery adds to its assistant | Cloudflare Browser Rendering, then Firecrawl, when switched on. They fetch public pages only |
| Text messages and call answering | Twilio, when switched on: show-round reminders to a parent’s mobile, enquiry alerts to a nursery’s own mobile, and one text to a caller the nursery missed. We keep no caller’s number: only a one-way code of it, for two days, so nobody is texted twice |
How the assistant is kept to the facts
- It answers only from the nursery’s details, its website pages and the answers the nursery added. It uses no outside knowledge about the nursery and never guesses.
- A factual answer ends with a link to where it came from.
- When it does not know, it says so and passes the parent to the nursery’s enquiry form.
- It never names individual staff members and never gives out email addresses.
- It never says a place is available, reserved or confirmed: availability and offers come only from the nursery.
- It never asks for personal details in the chat: parents type them into the form themselves.
- It gives no safeguarding, medical or legal advice, and points to the right service instead.
- Text in web pages and in parents’ messages is treated as information, never as instructions to it.
- Through Amazon Bedrock, what is typed is sent to the model to produce an answer and is not used to train the model.
Parents’ rights
Parents can download everything linked to their account, or delete the account, from their account page. Deleting takes effect straight away and removes their name and contact details from enquiries they sent. For anything else, such as an enquiry sent without an account, they can contact us.
What nurseries control
- Switch the assistant off under Profile in the dashboard, on the nursery’s page and its own website.
- Hide what we took from the nursery’s website, our written summary, the feature chips, published fees or the exact map location.
- Choose what the assistant reads: switch single website pages off, and edit or delete the nursery’s own answers, files and photos.
- Choose who manages the page: invite up to five managers and remove them.
- Switch off the reminder emails, and remove the webhook, in Settings.
- Cancel Pro any time from Plan and billing, through Stripe’s billing page. Pro stays on to the end of the paid month, and nothing is deleted.
Questions about data, or need a data processing agreement for your nursery? Contact us.
Frequently asked questions
Do you see or store card details?
No. Nurseries pay on Stripe's own secure page. We keep only the subscription status Stripe sends us.
Can a nursery switch the assistant off?
Yes, at any time, under Profile in the dashboard. It stops answering on the nursery's page and on its own website.
How do I cancel Pro?
From Plan and billing in the dashboard, which opens Stripe's billing page. Pro stays on to the end of the month you paid for, and nothing you added is deleted.