Privacy Policy

Last Updated: May 23, 2026

1. Introduction

Root Skills ("we," "us," or "our") is committed to protecting the privacy and personal information of every user of our platform. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you access or use the Root Skills platform, including our website at rootskills.ca and related services (collectively, the "Services").

Root Skills is operated by Canada's Sunshine Inc. (Business Number 735974735), a Canadian corporation based in Richmond Hill, Ontario. We built Root Skills specifically for Ontario Early Childhood Education (ECE) centres, and we take privacy seriously — especially because the work involves children.

By using our Services, you acknowledge and agree to the practices described in this Privacy Policy. Your use of Root Skills is also subject to our Terms of Service.

2. Important Notes

Customer Data

This Privacy Policy does not apply to personal information that we process on behalf of our customers (childcare centres, supervisors, and educators) through their use of our Services ("Customer Data"). Our customers' respective privacy policies govern their collection and use of Customer Data — including any information centres collect from parents about their children. Our processing of Customer Data is governed by our agreements with those customers.

Questions or requests relating to Customer Data — such as a parent's request to access or delete information about their child on the Root Skills platform — should be directed to the applicable childcare centre. If you are unable to reach your centre, you may contact us at privacy@rootskills.ca and we will coordinate a response with the applicable centre.

Children's Information

Root Skills is a software platform designed for use by licensed Ontario childcare centres, supervisors, and registered early childhood educators. The Services process personal information about children — including names, dates of birth, attendance records, and learning observations — but this information is always entered by authorized adults, never collected directly from children.

  • We do not knowingly permit children to create accounts.
  • We do not knowingly collect personal information directly from children.
  • We rely on centres to obtain and manage all necessary parental or guardian consents required under the Child Care and Early Years Act, 2014 (CCEYA) and applicable privacy law before entering child-related information into the Services. Root Skills does not verify or record individual consents.
  • We comply with applicable Canadian privacy laws, including the Personal Information Protection and Electronic Documents Act (PIPEDA), as well as CCEYA requirements for licensed childcare operators in Ontario.
  • We do not use child data for advertising, profiling, model training, or any purpose unrelated to providing the Services.

If you believe a child has provided personal information without appropriate adult consent, contact us at privacy@rootskills.ca.

3. Information We Collect

Information You Provide

  • Account Information. Name, email address, role (Supervisor or Educator), the centre you work at, and authentication credentials when you register or are invited to the platform. Passwords are stored as one-way hashes — we cannot see them.
  • Centre Information. Centre name, address, licensing details, room configuration, and age groups served, provided by supervisors during onboarding.
  • Child Records. Children's first names, dates of birth, attendance schedules, dietary or care notes, and learning observations — entered by authorized centre staff.
  • Observation and Program Data. Notes educators write about children's learning and development, weekly program plans, and AQI (Assess / Improve / Track) assessments generated or edited in Root Skills.
  • Payment Information. Subscription billing is handled by our payment processor. We do not see or store full credit card numbers — only a customer identifier and subscription status.
  • Communications. Support requests and messages you send us directly.

Information Collected Automatically

  • Device and Usage Data. Browser type, device identifiers, operating system, IP address, pages visited, features used, and interaction patterns.
  • Log Data. Server logs recording access times, errors, and API requests for security monitoring and debugging.
  • Cookies. We use essential cookies for authentication and session management. We do not use advertising or third-party tracking cookies.

4. How We Use Your Information

We use the information we collect to:

  • Provide, operate, and maintain the Root Skills platform for your centre.
  • Power core features including program planning, observation scheduling, observation note generation, and AQI assessments.
  • Power AI-assisted features as described in Section 5 below.
  • Process subscription payments and manage billing.
  • Send transactional emails (sign-in confirmations, receipts, important account notices) and respond to support requests.
  • Improve platform functionality, fix bugs, and enhance the user experience.
  • Comply with applicable childcare regulations, licensing requirements, and legal obligations.
  • Detect, prevent, and respond to security incidents and fraud.

We do not sell, rent, or trade personal information. We do not use Customer Data, child data, or observation data to train any AI models.

5. Artificial Intelligence Features

Root Skills uses AI to power two optional features. When you use an AI-powered feature:

  • Weekly Program Plan Generation. When you generate a program plan, only non-identifying class-level metadata is sent to our AI provider: the centre's age group, your chosen theme, the ELECT learning areas you are focusing on, and any carry-over flags from past observations (which themselves contain no identifying child information). No child names, dates of birth, or other personal identifiers are transmitted.

  • AI-Assisted Observation Notes. When you turn a raw observation jot into a formal portfolio note, the text — which may include children's first names and other observation details — is sent to our AI provider for processing. Our AI provider operates under commercial terms that prohibit the use of customer data to train AI models, require automatic deletion of inputs and outputs within 30 days, and apply enterprise-grade security controls during processing. We are evaluating additional privacy measures — including name pseudonymization at the AI boundary and Canadian-region AI processing — as Root Skills scales.

  • AQI Assessments are scored and stored within Root Skills only. No AQI data is sent to any AI provider.

  • AI-generated content is always presented as a draft for human review. Supervisors and educators must edit and approve any AI suggestion before saving, sharing, or relying on it.

  • No data submitted to AI features is used to train AI models.

  • AI features are optional and may be disabled at the centre level.

6. Data Sharing and Disclosure

We do not sell, rent, or trade personal information. We may share data only in these limited circumstances:

  • Within Your Centre. Supervisors and educators within the same centre access information relevant to their role, as configured by the centre supervisor.
  • Service Providers. We rely on a limited number of trusted infrastructure providers to host, store, secure, and deliver the Services — including application hosting, database storage, subscription billing, transactional email delivery, and AI inference. These providers are bound by confidentiality and data-protection obligations. A current list of our service providers is available on request at privacy@rootskills.ca.
  • Legal Requirements. We may disclose information if required by law, regulation, subpoena, court order, or legal process.
  • Child Safety. We will cooperate with law enforcement and child protection authorities if we become aware of, or are notified of, potential child safety concerns.
  • Business Transfers. In the event of a merger, acquisition, or sale of assets, user data may be transferred as part of the transaction. We will notify affected users before their data becomes subject to a different privacy policy.

7. Data Storage, Security, and Residency

Root Skills uses industry-standard cloud infrastructure providers to deliver the Services. Where personal information is processed or stored outside Canada, it may be subject to the laws of the receiving jurisdiction, including lawful government access requests. We select providers that offer contractual data-protection safeguards and limit cross-border processing to what is necessary to deliver the Services.

We employ industry-standard security measures, including:

  • Encryption in transit (TLS 1.2+)
  • Database access restricted by Row-Level Security so a centre's data is only visible to that centre's authenticated users
  • Role-based access controls separating Supervisor and Educator permissions
  • One-way password hashing
  • Production access restricted to the Root Skills technical team and logged
  • API key rotation on a schedule and immediately if exposure is suspected

No system is completely secure. In the event of a security incident involving real risk of significant harm, we will notify affected centres and the Office of the Privacy Commissioner of Canada as required by PIPEDA.

8. Your Rights

Root Skills is designed to align with the ten fair information principles under PIPEDA. You have the right to:

  • Access the personal information we hold about you.
  • Correct information that is inaccurate or incomplete.
  • Withdraw consent for non-essential processing (e.g., product update emails).
  • Delete your account and associated data.
  • Export your centre's data in a portable format.
  • File a complaint if you believe we have handled your data improperly.

To exercise these rights, contact your centre supervisor or email us at privacy@rootskills.ca. We respond to verifiable requests within 30 days.

If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada at priv.gc.ca or 1-800-282-1376.

9. Data Retention

We retain personal information for as long as necessary to provide the Services, comply with legal obligations, resolve disputes, and enforce our agreements.

  • Active subscriptions: data is retained while the centre's account is active.
  • Cancelled subscriptions: centre and child records are retained for one (1) year after cancellation, then hard-deleted. The one-year buffer aligns with CCEYA record-keeping expectations and gives centres time to retrieve records if they re-subscribe.
  • Billing records: retained for seven (7) years as required by Canadian tax law.
  • Backups: rolling 30-day backups, after which deleted data is purged from backups as well.
  • Legal holds: data subject to a legal hold, preservation order, or investigation is retained for the period required.
  • Aggregated data: de-identified and aggregated data that cannot be linked to any individual may be retained for service improvement purposes.

If a centre wants their data deleted sooner than one year after cancellation, they can request it from privacy@rootskills.ca.

10. Security Incidents

No system is completely secure. In the event of a security incident affecting personal information under our control, we will notify affected customers and, where applicable, affected individuals and regulatory authorities, in accordance with applicable Canadian privacy laws. We maintain an internal incident response process and review it periodically.

11. Cookies

We use essential cookies for authentication and session management. We do not use advertising cookies or third-party tracking cookies. We do not sell or share data with ad networks.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify registered users of material changes via email or in-app notification at least 30 days before they take effect, except where a shorter period is required by law. Continued use of the platform after changes constitutes acceptance of the updated policy. Previous versions of this policy are available upon request.

13. Privacy Officer

Root Skills has designated a Privacy Officer responsible for our compliance with this Privacy Policy and applicable Canadian privacy laws.

Root Skills — Privacy Officer Mansoor Mahzoonhaghighi Canada's Sunshine Inc. 238 Montiel Road, Richmond Hill, Ontario, L4C 4T5, Canada Email: privacy@rootskills.ca

Individuals may also file a complaint with the Office of the Privacy Commissioner of Canada at priv.gc.ca.

14. Contact Us

If you have questions about this Privacy Policy or our data practices, contact us at:

Canada's Sunshine Inc. (operator of Root Skills) 238 Montiel Road, Richmond Hill, Ontario, L4C 4T5, Canada Privacy: privacy@rootskills.ca General: support@rootskills.ca

← Back to home