Privacy statement

What Surfaced is

Surfaced is a documentation tool used by early childhood centres. The centre your child attends is the agency responsible for your child’s information under the Privacy Act 2020; Surfaced processes it on the centre’s behalf.

What we collect

• Photos, short videos and dictated notes, as text taken by kaiako inside the app (never from the camera roll).
• Learning stories and notes drafted with AI assistance and approved by kaiako.
• Names, email addresses and roles of staff and whānau; children’s names, dates of birth and rooms.
• Consent decisions, notices shown, and an audit trail of who did what.

Face recognition

Where whānau opt in, faces are matched on the centre’s devices to suggest which child appears. The face templates are shared between that centre’s devices so every kaiako’s phone can make the same suggestion — encrypted end to end, with the key held only by approved devices. Surfaced carries those bytes and cannot read them, and no readable face template or landmark is ever stored on our servers. Face templates, and the small face samples that refresh them, are kept by Surfaced only encrypted, under a key only your centre’s approved phones hold. The samples are deleted when consent is withdrawn. See your centre’s biometric notice for the full Rule 3 disclosure.

Who processes data and where

• Supabase (database and media storage): Sydney, Australia.
• Vercel (application hosting): Sydney, Australia. The background jobs that write AI drafts keep their working records in the United States; those records hold only reference numbers and counts, never a draft, a note or a child’s name.
• Anthropic (AI drafting): receives the kaiako’s words and the context listed at surfaced.co.nz/trust, never photos, video or audio; commercial terms, no training on your data; requests may be processed outside New Zealand.
• Resend (sign-in emails): receives your email address to send your sign-in code.

Your rights

In the app you can see what the centre has shared about your child, and you can delete your account there or via account deletion. To get a copy of your child’s record, or to have it corrected or deleted, ask the centre: its head teacher, administrator or owner can export the record as a ZIP file. Complaints: the centre’s privacy officer, then the Office of the Privacy Commissioner (privacy.org.nz).