Version 2 · effective October 20, 2026 · Español
Privacy Policy
Effective date: October 20, 2026
This Privacy Policy explains how ACED | Advanced Concepts in Educational Design LLC ("ACED," "we," "us") collects, uses, shares and protects information through Incident Ally (the "Service"), including our website at incident-ally.com.
We built the Service to keep as little information as possible, for as short a time as possible.
1. Who is responsible for what
- Child care facilities (our customers) decide what information about children, families and staff to put into the Service, and why. For that information, the facility is in charge (the "controller" or "business"), and we process it on the facility's behalf and under its instructions, as a service provider. Questions or requests about a child's information should go to the facility first; we will help them answer.
- ACED is in charge of information about our customers' account holders and about visitors to our website, as described below.
2. Information we collect
Account and facility information. Names, email addresses, role (manager or staff), language preference, password (stored only as a one-way hash, if you choose to set one), sign-in times; the facility's name, license number, county, type, licensed capacity, consultant name and email, and settings.
Children and families (entered by the facility). Children's names, dates of birth and classrooms; parents' or guardians' names, relationship, email and phone number. These fields are encrypted in our database.
Incident reports. What staff say or type about an incident; the information filled into the official forms (for example: date, time, place, the injury and body part, cause, treatment, witnesses, prevention steps and parent notification); a written transcript of what was said; staff and parent signatures (as images); and, for each signature, the signer's name, time, method, internet (IP) address, browser information and a fingerprint (hash) of the report that was signed. Report details are encrypted in our database.
Voice recordings. When staff record, the audio is sent to our speech-to-text provider and deleted from our servers as soon as the transcript comes back, whether or not transcription succeeds. We do not keep recordings.
Incident log lines. For each finished report: the child's name, the incident date, the date sent to DCDEE (if any) and the name of the person who completed the report. This is the cumulative log facilities must keep, so we keep it while the account is active.
Billing. Our payment processor, Stripe, collects your payment details. We receive the plan, billing status, and limited card details (such as brand and last four digits). We never receive or store full card numbers.
Email and communications. Messages you send us; whether marketing emails were delivered, bounced or marked as spam; your email preferences.
Website and device information. Our servers record standard technical information (IP address, browser type, pages requested and time) in security logs. We use only the cookies and browser storage described in our Cookie Notice. We do not use third-party analytics, advertising or tracking tools.
Leads. If you ask to hear from us on our website or at an event, we collect your name, email, and how you asked.
3. How we use information
We use information to:
- provide the Service: transcribe, fill out forms, collect signatures, send emails, keep the incident log, and show reports to the right people;
- secure the Service, prevent abuse and fraud, and keep audit records;
- process payments and manage subscriptions;
- provide support and send service messages (for example, sign-in links, signature requests, report copies, payment notices);
- send marketing emails to account managers and leads, which anyone can unsubscribe from at any time;
- improve the Service using de-identified, aggregated information (for example, counts with no names);
- comply with law and enforce our terms.
We do not sell personal information. We do not share it for cross-context behavioral advertising. We do not use Customer Data to build advertising profiles.
4. Artificial intelligence providers
To turn speech into text and to fill out forms, the Service sends the relevant audio or text to our AI providers (currently OpenAI for speech-to-text and Anthropic for reading the account and filling out the form, translations and interpreting spoken answers). We use these providers' commercial API services. Under their commercial terms as of the effective date of this policy, they do not use data sent through these services to train their models, and they may keep it for a limited period (for example, up to 30 days) for safety and abuse monitoring, as described in their own policies. We send only what is needed for the task. Pre-recorded voice prompts contain no personal information.
5. How we share information
We share information only:
- with the facility and its authorized users, according to their roles;
- with people the facility directs us to send to, such as a parent who signs, the facility's chosen report recipients, printer or licensing consultant;
- with our service providers ("subprocessors") who help us run the Service under written agreements that protect the data, listed on our Subprocessors page;
- when the law requires (for example, a valid subpoena or court order), or to protect the rights, safety or property of anyone, after reviewing the request and, where allowed, telling the facility;
- in a business transfer (such as a merger or sale), subject to this policy.
6. How long we keep information
| Information | How long |
|---|---|
| Voice recordings | Deleted right after transcription |
| Report details, signatures, final PDF | Deleted after the facility's retention period (default 30 days; 7 to 90 days) after the report is completed; unfinished reports after 90 days |
| Incident log lines | While the account is active; then as in "after an account closes" |
| Children's roster | Until the facility removes it, or the account closes |
| Account, billing and audit records | While the account is active, then as long as needed for legal, tax, accounting and dispute purposes |
| Security logs | Up to 30 days, unless needed to investigate an incident |
| Marketing contacts | Until you unsubscribe (we keep a minimal record to honor the request) |
After an account closes, the facility may request an export within 30 days. We then delete Customer Data within 90 days, except where we must keep it by law, and except routine backups, which are deleted on their normal schedule.
The facility's emailed PDFs are its record. The facility is responsible for keeping the records its license requires.
7. Information on the device
Staff phones keep a few preferences (such as language, voice on or off and how the staff member prefers to record). If a recording cannot be sent because there is no internet connection, it is kept encrypted on that device until it can be sent, and then deleted from the device. The app also stores its own program files on the device so it can open without a connection. It never stores reports, PDFs or children's lists on the device for offline use.
8. Security
We use measures designed to protect information, including encryption in transit (HTTPS), encryption at rest of sensitive fields, short-lived single-use sign-in links, signed links for parents, access limited by role, logging of administrative actions, and short retention. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
If we learn of a security breach affecting personal information we hold for a facility, we will notify the facility without unreasonable delay and help it meet any duty it has to notify affected people, consistent with North Carolina law (including the Identity Theft Protection Act) and other applicable law.
9. Children's privacy
The Service is for child care businesses and their adult staff. It is not directed to children, and we do not knowingly collect personal information directly from children. Information about children is entered by the facility, which is responsible for any notices and consents its families require. If you believe a child has given us information directly, contact privacy@incident-ally.com and we will delete it.
10. Your choices and rights
- Families and staff: please contact your facility to see, correct or delete information. We will help the facility respond.
- Account holders: you can see and update your name, language and password in My account. Managers can update facility information, the children's roster and staff accounts.
- Marketing email: use the unsubscribe link in any marketing email. Service messages (such as sign-in links and payment notices) are still sent while you have an account.
- Depending on where you live, you may have other rights under law. Contact privacy@incident-ally.com. We will verify requests and respond within the time the law requires. We will not discriminate against you for exercising a right.
11. Where information is processed
We and our providers process information in the United States.
12. Changes to this policy
We may update this policy. We will post the new version with its effective date and version number and, for material changes, notify account managers by email or in the Service before the change takes effect.
13. Contact
ACED | Advanced Concepts in Educational Design LLC
65 Merrimon Avenue, #1199
Asheville, NC 28806
privacy@incident-ally.com