Your family's data and safety

What Befundo keeps about your family, who can see it, and what we decided never to do with it — in plain words. The privacy policy is the legal version.

The short version

Nothing about your child is public or in search results.
Saying no to photos never costs your child their place.
A child's private diary is theirs. Nobody reads an entry they haven't shared.
A class is only recorded if you agree, and you can change your mind.
We don't sell your information, and a child's is never used for ads or suggestions.
You can delete your account, and your children's, yourself.

Your child's information

A child's profile is created and managed by a parent or guardian. Nothing about a child appears on a public page, in search results or in the information we give search engines.

Other families in a class see your child's first name and last initial — never a full name or an email address — and a business can hide the list entirely.
The people teaching see what they need for the class they teach: names, contact details, attendance and what you agreed to — and at a camp, the emergency contact, pickup list and allergies you gave it, which only that business's admins and your child's own session teachers see. An instructor sees nothing of your child's other classes.
You can see everything recorded about your child's classes.

Photos

A business that photographs or films a class asks one clear question when you register: Photos and video, with the full wording of where they may use them. It is always optional, and saying no never affects your child's place. The class list shows staff who hasn't agreed, so they can keep that child out of shot.

When you add a photo — to your diary, a profile or a message — the app removes the hidden details a phone stores in it, such as where and when it was taken, before it is uploaded. This happens on the website, the iPhone and iPad app and the Android app.
Children can't send photos or videos in direct messages.
A class's group conversation isn't private in the way a diary is. Assume anything posted there can travel.

When your child has their own login

A child can have a login of their own from 13, and only if a parent sets it up. Under 13, you manage their profile and their classes and messages stay with you.

Their diary is theirs. No parent can read an entry unless the child chooses to share it.
Their messages aren't. A parent can see their conversations and block someone.
Anything on a class board or in a message can be reported. Reporting a message also blocks the person who sent it.

Recordings and AI summaries

A class is only recorded if the business has turned it on and you have agreed. You can withdraw from the class page at any time. The recording is turned into a written summary and then deleted — no video or audio is kept — and a summary never quotes a child.

Befundo's AI does not form a view about a child. It does not predict who will struggle, score children against each other or tell you what your child is good at. The assistant answers questions about your own household only.

What we do with your data

We use it to run Befundo — your classes, messages and schedule. We don't sell it.
Using your data to improve the product, to suggest things or for ads are three separate choices. Each is off until you turn it on, and none can ever apply to a child. Change them at any time under Account → Your agreements.
We count page visits without cookies, and never on a child's account. The phone apps count nothing.
Our newsletter goes only to adults who ask for it.
A business can never agree to anything on your family's behalf.
Befundo support never signs in as you or reads your messages. It can change something in your account only while you have turned on Let support fix this — for up to 72 hours — and you are told each time.

Checking the businesses that teach

A business can choose to verify its registration, its address, its email and its owner's identity. Identity checks are done by Stripe, and Befundo never sees the ID or the selfie. A registration document is deleted once a person here has checked it.

These checks are not a background check. They say who runs a business, not anything about the adults in the room — that is the business's responsibility, and a fair question to ask them.

Where your data lives, and how it's protected

Befundo runs on Vercel, and our database is Neon, a Postgres service hosted on Amazon Web Services in the United States (Oregon).

Both companies hold SOC 2 Type 2 and ISO 27001 certifications. These are their certifications, covering the systems Befundo runs on — not a certification of Befundo.
Your data is encrypted when it is stored (AES-256) and whenever it travels between your device, our servers and the database (TLS).
Vercel automatically defends the site against denial-of-service attacks.
Every request is checked against the person signed in, and each family's information is only ever read for that family.

You can read what they say for themselves: Vercel security, Vercel trust center, Neon security and Neon trust center.

Leaving, or telling us about a concern

You can delete your account yourself, on the website or under Me in the apps. It deletes the children you added too — and if another parent also looks after a child, you choose first whether to hand the child's account to them. A child can't delete their own account.

If a message worried you, report it from the conversation: it goes to Befundo's own moderators, not to the business. If a child's safety is at risk, go straight to the relevant authority where you live — you don't need proof. For anything else, email support@befundo.ai and a person will answer.