Privacy Policy and Privacy Statement

Last Updated: July 2026

STATEMENT

We at Tuio Payments Inc. (“We”, “Tuio”, “our” or “us”) are firmly committed to privacy and transparency. We recognize that the businesses, parents, guardians, and families with whom we work value their privacy and the privacy of their children. Because our Services facilitate the management of student enrollment, tuition payments, school communications, and related administrative functions for schools, daycares, and similar educational facilities (“Facilities”), the collection and use of personal information — including information about children — is necessary in order to provide our Services. We take great care to collect only the information necessary for the provision of our Services and to protect it appropriately.

The following discloses our information gathering, use, and disclosure practices for all users of our Services, including Facilities (our business customers), parents and legal guardians, and all visitors, browsers, and other individuals who interact with our Services (collectively “you” or “your” or the “Users”). Please be advised that this policy applies to all Tuio websites, apps, and platforms made available by Tuio (collectively the “Services”).

By utilizing and accessing the Services you consent to the collection, storage, and use of personal information described herein. You may withdraw your consent to the processing or use of personal information at any time. However, withdrawing such consent may result in your inability to continue using the Services.

Please read this Privacy Policy (this “Privacy Policy”) and our Web Application’s Terms of Service carefully, as they together constitute the agreement between you and us, and you are agreeing to be bound by these documents by using our Services.

If you do not agree with any part of this Privacy Policy, you must not use the Services. Your continued use of the Services will constitute your acceptance of this Privacy Policy. Any new features or tools added to the Services shall also be subject to this Privacy Policy. You can review the most recent version of this Privacy Policy at any time on Tuio’s website. We reserve the right to update, change, or replace any part of this Privacy Policy at any time by posting updates or changes. It is your responsibility to check this Privacy Policy periodically for changes. Your continued use of the Services following the posting of any changes constitutes acceptance of those changes.

PURPOSE OF COLLECTION

Tuio’s processing of your personal information may include using, storing, recording, transferring, sharing, anonymizing, and destroying personal information as necessary for the provision of Services, or as otherwise required by applicable law. Specifically, personal information collected through our Services may be utilized for several purposes, including but not limited to:

1. Providing, maintaining, and improving the Services, including student enrollment management, tuition and fee invoicing, payment processing, attendance tracking, and school-parent communications;
2. Generating analytics for the improvement of the Services;
3. Providing Services to you where we have entered into a contract with you;
4. Processing in accordance with the consent you have provided to Tuio;
5. Maintaining a commercial relationship with you and communicating with you in relation to the Services;
6. Identifying your needs or preferences;
7. Meeting legal and regulatory requirements;
8. Administering the Services and diagnosing and resolving technical problems;
9. Sending you notifications and communications to the email address you have provided in relation to the Services;
10. Generating, creating, and reviewing reports and other data about Users on the Services and conducting research on service usage and patterns; and
11. As otherwise required by law.

Important: Tuio does not use children’s personal information for advertising, marketing to children, or any purpose unrelated to the educational and administrative services provided to the applicable Facility.

CHILDREN’S PRIVACY

Our Role in Processing Children’s Information

Tuio provides software services to Facilities — including schools, daycares, Montessori schools, and after-school programs — that serve children, including children under the age of 13. As part of providing these Services, Tuio processes children’s personal information on behalf of Facilities. Tuio acts as a service provider to these Facilities and processes children’s personal information solely to provide the Services requested by the Facility.

Categories of Children’s Information Collected

In the course of providing Services to Facilities, Tuio may collect and process the following categories of children’s personal information, as provided by the Facility or the child’s parent or legal guardian:

1. Name: First name and last name of the child;
2. Date of birth: Used for enrollment and age-appropriate program placement;
3. Gender: If provided by the Facility or parent;
4. Address: Street address, city, province/state, and postal/zip code;
5. Emergency contact information: Phone numbers for emergency contacts designated by the parent or guardian;
6. Photographs: Student photos or avatars, if uploaded by the Facility or parent for identification and attendance purposes;
7. Enrollment and program information: Details about the child’s enrollment in programs offered by the Facility;
8. Custom form data: Information collected through forms created by the Facility, which may include health and medical information, allergy details, or other information the Facility deems necessary; and
9. Attendance records: Records of a child’s attendance at the Facility, which may include the display of the child’s photograph to authorized Facility staff for identification purposes.

How We Obtain Authorization to Collect Children’s Information

Tuio relies on two mechanisms for authorization to collect and process children’s personal information:

School Authorization. Under applicable law and regulatory guidance, a Facility may authorize the collection of children’s personal information by a service provider when: (a) the information is collected solely for the use and benefit of the Facility and for an educational or administrative purpose authorized by the Facility; (b) the service provider does not use the information for any other commercial purpose; and (c) the service provider does not disclose the information except to the Facility or as directed by the Facility. Tuio’s agreements with Facilities include provisions establishing this authorization. Facilities are responsible for providing notice to parents about Tuio’s data practices and for maintaining their own consent mechanisms as required by applicable law, including FERPA (for US schools).

Parental Consent. When a parent or legal guardian creates a Tuio Account, accepts the Terms of Service, and makes a payment through the Services, this constitutes verifiable parental consent for the collection and processing of their child’s personal information as described in this Privacy Policy. Tuio presents a clear notice about children’s data collection practices to parents as part of this process.

Parental Rights

Parents and legal guardians have the following rights with respect to their child’s personal information processed by Tuio:

1. Right to Review: You may review the personal information Tuio holds about your child by logging into your Tuio Account, or by contacting your child’s Facility.
2. Right to Request Removal: You may request removal of your child’s personal information by submitting your request to your child’s Facility: photographs and uploaded files are deleted, and Tuio’s remaining records are de-identified — your child’s identifying details are removed — except for records Tuio is required by law to retain, such as financial and tax records. While the Facility is an active Tuio client, the Facility administers such requests and Tuio acts on the Facility’s confirmation. If the Facility is no longer a Tuio client, or you cannot obtain a response from the Facility within a reasonable time, you may contact us at [email protected].
3. Right to Refuse Further Collection: You may refuse further collection of your child’s personal information by notifying your child’s Facility. Please note that refusing further collection may result in the inability to continue using certain features of the Services.

The Facility may decline or limit a request where the information is required to provide services to your child, to protect your child’s health or safety (for example, a photograph used to confirm a child’s identity for attendance and authorized pickup), or to meet the Facility’s legal, licensing, or record-keeping obligations. Records that Tuio is required by law to retain, such as financial and tax records, are retained for the legally required period.

How We Use Children’s Information

Tuio uses children’s personal information solely for the following purposes:

1. Providing the Services to the applicable Facility, including enrollment management, invoicing, payment processing, attendance tracking, and school-parent communications;
2. Displaying student information to authorized Facility staff and to the child’s parent or legal guardian through the Services;
3. Generating anonymized or aggregated analytics to improve the Services (no individual child is identifiable in such analytics); and
4. Complying with applicable legal requirements.

Tuio does not use children’s personal information for:

1. Advertising or marketing to children;
2. Creating profiles of children for commercial purposes unrelated to the Services;
3. Selling or renting children’s personal information to third parties; or
4. Training artificial intelligence or machine learning models on identifiable children’s data.

Sharing Children’s Information with Third Parties

Tuio may share children’s personal information with the following categories of third-party service providers, solely to the extent necessary to provide the Services:

1. Payment processors — to process tuition and fee payments initiated by parents;
2. Cloud infrastructure providers — to host and securely store data; and
3. Analytics providers — to understand service usage patterns and improve the Services (only anonymized or aggregated data is shared for analytics purposes).

Tuio requires all third-party service providers to maintain commercially reasonable security standards and to process personal information only as necessary to perform services on Tuio’s behalf. Tuio does not share identifiable children’s personal information with third parties for advertising, marketing, or any purpose unrelated to the provision of the Services.

If you would like to know the specific third parties that have access to your child’s information, you may contact us at [email protected].

Retention of Children’s Information

Tuio retains children’s personal information for as long as it is necessary to provide the Services to the applicable Facility or parent. Inactive records are de-identified in accordance with Tuio’s standard data lifecycle, and following the end of a Facility’s subscription, remaining personal information is de-identified on a defined schedule. When applicable retention periods — including legal and tax retention requirements — expire, records are irreversibly anonymized and permanently unlinkable to any identifiable individual; anonymized records may be retained for legitimate business purposes such as financial reporting and analytics.

Parents may request removal of their child’s information at any time by submitting the request to the child’s Facility, as described in the Parental Rights section above.

Student Photographs and Attendance

Facilities may upload student photographs to the Services for identification and attendance purposes. Photographs may be displayed to authorized Facility staff (including teachers and administrators) through the attendance interface for the purpose of identifying students.

If biometric processing (such as facial recognition or facial matching) is ever used in connection with student photographs, Tuio will obtain enhanced parental consent before any such processing occurs.

Parents may view, request deletion of, or refuse the upload of their child’s photograph by contacting the Facility.

Custom Forms

Facilities may create custom forms through the Services to collect additional information from parents about their children. Tuio’s agreements with Facilities prohibit the use of custom forms to collect government-issued identification numbers (such as Social Insurance Numbers, Social Security Numbers, or passport numbers), payment card or bank account information, biometric data, driver’s license numbers, or login credentials for third-party services. Tuio does not control what information Facilities choose to collect through custom forms beyond these prohibitions. Parents should review any custom form carefully before submitting information and should contact the Facility directly with questions about why specific information is being requested.

ACCOUNT CREATION

Full use of the Services requires that you create an account by providing Tuio with certain information, which may include your full name, a valid email address, company name, mobile number, a password, other personal information, and any information that you provide to us voluntarily. You are responsible for all activity that occurs in association with your account. If you are creating an account as a business User on behalf of your employer or any third-party company or entity, you represent and warrant that you have the authority to act on such party’s behalf and to provide all applicable information to Tuio. Tuio is not liable for any loss or damages caused by your failure to maintain the confidentiality of your account credentials. Please contact us if you discover or suspect any security breach related to the Services or your Account.

INFORMATION PRACTICES

What Information is Collected

We may collect personal information that is relevant for the provision of the Services and that is otherwise permitted by applicable law. Such information may include:

1. From Facilities (business customers): Company name, administrator names, email addresses, phone numbers, physical addresses, bank account or payment information, tax identification numbers, and other information necessary to provide the Services;
2. From parents and legal guardians: Names, email addresses, phone numbers, physical addresses, payment method information, and other information necessary to facilitate payments and communications;
3. About children (as described in the Children’s Privacy section above): Names, dates of birth, gender, addresses, emergency contact information, photographs, enrollment information, attendance records, and custom form data as provided by the Facility or parent; and
4. From all Users: Information provided voluntarily through communications with Tuio.

Information Collected Automatically

Whenever you use our Services, we collect certain types of information automatically, such as your IP address, referring URL, operating system, cookie information, information about your operating environment, and Internet Service Provider. We may also gather information regarding the date and time of your visit or access to the Services and your activity on the Services.

Mobile Information Collection

When you download or access the Services via a mobile device, we may receive information about your mobile device, including various unique identifiers associated with your device, hardware type, and the version of your operating system.

We also use mobile analytics software to allow us to better understand the functionality of our applications on your mobile device. This software may record information such as how often you use an application, the events that occur within an application, aggregated usage, performance data, and where an application was downloaded from.

Business Information

For certain Users, Tuio collects “Business Information.” The collection of Business Information is necessary for Tuio to provide the Services to its business Users and to enable Tuio to respond to requests for Services. “Business Information” is defined as any information that identifies or may identify a company or an individual contact at a company, or that allows others to contact a company or an individual contact at a company. When any business User utilizes the Services, they may be asked to submit information such as email address, company name, address, or phone number.

Location Information

We collect information about your location when you use our Services. Your location can be determined with varying degrees of accuracy by GPS, IP address, sensor data from your device, and information about things near your device such as Wi-Fi access points, cell towers, and Bluetooth-enabled devices. The types of location data we collect depend in part on your device and its settings.

Payment Information

For certain portions of our Services, payment information will be required or provided to Tuio. Tuio does not store or directly access any of your payment card information. Instead, Tuio utilizes third-party payment processors to process your payment information.

By engaging in any kind of activity or transaction on the Services that utilizes your financial information, you consent to our providing such financial information to our third-party payment processors, and to such other third parties as we determine necessary to support and process your activities and transactions.

Tuio’s agreements with third-party service providers that receive your payment information require them to keep the information secure and confidential.

Tuio cannot guarantee that the transmission of your payment information will always be secured against access from unauthorized third parties. Tuio makes no representations or warranties and assumes no liability or responsibility for improper access to or disclosure of your payment information due to unauthorized third-party access, errors in transmission, or other causes beyond Tuio’s control.

Aggregated and De-Identified Information

Tuio may aggregate and de-identify collected information, including personal information. Tuio may use, process, or disclose any such aggregated or de-identified information in accordance with applicable law. Aggregated or de-identified information that has been irreversibly rendered unlinkable to any identifiable individual is not personal information and may be used without restriction. For clarity, children’s personal information will only be included in aggregated or de-identified data sets after being irreversibly anonymized such that no individual child is identifiable.

How Your Information is Shared

We do not rent, sell, or share personal information with third parties except to provide the Services you have requested, when we have your permission, as disclosed in this Privacy Policy, or under the following circumstances:

1. We may share your personal information with third-party service providers for payment processing, cloud infrastructure and hosting, cybersecurity, fraud analytics, analytics, customer support, and similar operational functions. These third parties are contractually required to maintain commercially reasonable security standards and to process personal information only as necessary to perform services on Tuio’s behalf;
2. We may share your personal information with our affiliates;
3. We may share your personal information if required by law or if we believe that disclosure is required or necessary to protect our rights or comply with a judicial proceeding or legal process served on our Services;
4. We may share personal information if we believe it is required in order to investigate, prevent, or take action regarding illegal activities, suspected fraud, a potential threat to the physical safety of a third party, or as otherwise required by law;
5. We may share your personal information in connection with any company transaction, such as a merger, sale of all or a substantial portion of our assets or shares, reorganization, or in the event of bankruptcy, dissolution, or similar proceedings, provided that the information disclosed continues to be used for the purposes permitted in this Privacy Policy by the entity acquiring the information;
6. We may share personal information with our legal, financial, and other professional advisors; or
7. We may share personal information with third parties upon receiving your consent as required by law.

Except as provided above, we will not share any of your personal information with any third party without your permission.

DATA RETENTION

Tuio retains personal information for as long as it is necessary to provide the Services and to fulfill the purposes described in this Privacy Policy, unless a longer retention period is required by applicable law (for example, for tax, accounting, or other legal requirements).

For children’s personal information specifically, please see the “Retention of Children’s Information” section above.

When personal information is no longer necessary for the purposes for which it was collected, Tuio will either delete or irreversibly anonymize it. Anonymized information — which is permanently unlinkable to any identifiable individual — may be retained for legitimate business purposes.

DATA STORAGE AND CROSS-BORDER TRANSFERS

Tuio is a Canadian company headquartered in Toronto, Ontario. The Services are hosted on cloud infrastructure located in North America. If you are accessing the Services from outside of Canada or the United States, please be aware that your personal information may be transferred to, stored, and processed in Canada or the United States, where data protection laws may differ from those in your jurisdiction.

By using the Services, you consent to the transfer of your personal information to Canada and the United States as described in this Privacy Policy. Tuio will take commercially reasonable steps to ensure that your personal information is treated securely and in accordance with this Privacy Policy regardless of where it is stored or processed.

DO NOT TRACK SIGNALS

Please note that your browser setting may allow you to automatically transmit a “Do Not Track” signal to websites and online services you visit. There is no consensus among industry participants as to what “Do Not Track” means in this context. Like many websites and online services, Tuio does not alter its practices when it receives a “Do Not Track” signal from a visitor’s browser. To find out more about “Do Not Track,” please visit http://www.allaboutdnt.com.

LINKS TO THIRD-PARTY WEBSITES

The Services may, from time to time, contain links to websites owned or operated by third-party companies or service providers. If you follow a link to any of these third-party websites, please note that these services have their own privacy policies and that Tuio does not accept any responsibility or liability for those companies or their privacy practices. You should review the individual privacy policies before you submit any information to those websites or services.

COOKIES

Cookies and other tracking mechanisms may be used to track information about your use of our Services. We may combine this information with other personal information we collect from you to track content usage and traffic. A cookie is an identifier that we (or a third party acting on our behalf) transfer to your computer’s hard drive through your web browser for record-keeping purposes. We may use cookies to help compile aggregate statistics about usage of our Services. You can set your browser to notify you when you are sent a cookie, giving you the chance to decide whether or not to accept it.

For children’s accounts: Tuio does not use cookies or tracking mechanisms to track or profile children. Any cookies used in connection with children’s accounts are strictly necessary for the operation of the Services (such as session authentication).

SECURITY OF PERSONAL INFORMATION

The security of your personal information is very important to us and we take it seriously. We have implemented commercially reasonable technical and organizational measures to protect against accidental or unlawful destruction, unauthorized disclosure, or access. These measures include encryption of data in transit and at rest, access controls and least-privilege policies, and regular security reviews.

Notwithstanding the foregoing, please be aware that no data security measures can guarantee 100% security and no method of transmission over the internet or method of electronic storage is 100% secure. Therefore, we cannot guarantee absolute security.

In the event of a data breach affecting personal information, Tuio will notify affected Facilities and, where required by applicable law, affected individuals, without unreasonable delay and in accordance with applicable breach notification requirements.

DATA SUBJECT ACCESS REQUESTS

You have the right to request access to the personal information Tuio holds about you, to request correction of inaccurate information, and to request deletion or anonymization of your personal information, subject to applicable legal requirements and legitimate business needs.

To submit a request, please contact us at [email protected]. We will respond to your request within 30 business days. We may ask you to verify your identity before processing your request.

For requests related to children’s personal information, please see the “Parental Rights” section above.

COMPLIANCE WITH LAWS

Canadian law, at the federal and provincial level, has enacted personal information and protection legislation, including the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy statutes (collectively “Privacy Legislation”). The Privacy Legislation outlines the way personal information may be used in Canada, and Tuio shall comply with applicable Privacy Legislation.

For Users located in the United States, Tuio complies with the Children’s Online Privacy Protection Act (COPPA) with respect to the collection and processing of children’s personal information. Tuio also complies with applicable state privacy laws.

You may at any time contact us regarding our collection, use, and disclosure of your personal information.

CONTACT US

If you have any questions or concerns about this Privacy Policy, if you need further information regarding the access to your personal information or how your personal information is used, or if you wish to exercise any of your rights described in this Privacy Policy, you may contact us at:

[email protected]
1 (888) 540-0160