Privacy Policy

Last updated: the date shown at the bottom of this page. This policy explains what PTO Moms collects, why, and what choices you have.

1. Who We Are

PTO Moms ("we", "us", "our") is a community platform connecting school Parent-Teacher Organizations (PTOs), parents, teachers, school and district staff, and local businesses that support schools. If you have questions about this policy or how your information is handled, contact us at marciab80@gmail.com or via our Contact page.

2. Information We Collect

Account information

When you register, we collect your name, email address, and a password (stored as a one-way cryptographic hash — we never store or can see your plain-text password). You may optionally add a profile photo, cover photo, short bio, and select which school(s) and role(s) you're affiliated with (parent, PTO member/officer, teacher, business owner, community supporter, etc.).

Information about your children

If you add a student under your account (for example, to see grade-specific supply lists), we collect that student's first name, last name, and grade. This information is entered by you, the parent or guardian — never by the child directly — is visible only to you in your own account, and is used only to match your child's grade against supply-list content a teacher has published for that grade. We do not publicly display student names, do not use facial recognition, and do not allow tagging or identifying a child in any photo or video anywhere on the platform.

Content you contribute

Anything you choose to post is stored and, depending on the visibility you or an organization manager selects, may be shown publicly: forum posts and replies, business directory listings and reviews, PTO/school/district news posts, event details, photos you upload to a Media gallery, and links to third-party videos/posts you choose to embed.

Business directory information

If you list a business, we collect the business name, description, category, contact details, logo, and any promotions or certificates you create, along with reviews left by other members.

Payment information

If a PTO you belong to accepts memberships or donations through the platform, payment is completed directly on Stripe's or PayPal's own secure, hosted payment page. We never receive, see, transmit, or store your full card number or bank details — we only receive confirmation of payment status (e.g., succeeded, refunded) and the amount, which we store so the relevant PTO can keep accurate records.

Contact form submissions

When you contact us, a school, a PTO, or a district through a Contact form, we collect the name, email address, organization (if provided), message, and the IP address you submitted from, so we can respond and guard against abuse.

Technical and log information

Like virtually every website, our server automatically logs your IP address, browser type, and access times for security, fraud prevention, and troubleshooting.

Push notifications

If the site operator has enabled push notifications and you explicitly grant your browser permission, a device push-subscription identifier is stored via our notification provider (OneSignal) so we can deliver notifications you've opted into. You can revoke this at any time from your browser's own notification settings.

Cookies

We use a small number of cookies, described in full in our Cookie Policy, and — where required — ask for your consent before any non-essential cookie is set.

3. How We Use Your Information

• To create and maintain your account, and to show you content relevant to your school(s), PTO(s), and role(s);
• To operate features you use directly: the community forum, business directory, events, supply lists, and photo/video galleries;
• To process membership payments and donations through our payment processors, and to send related receipts;
• To respond to messages sent through Contact forms;
• To send account-related and, if you've opted in, notification emails or push notifications;
• To detect and prevent spam, fraud, and abuse (including checking a contact submission's IP/email against a shared spam-reporting service, and using a bot-detection challenge on public forms);
• To comply with legal obligations and to enforce our Terms & Conditions.

We do not sell your personal information, and we do not use your data to build advertising profiles.

4. Legal Bases for Processing (GDPR)

Where the GDPR applies, we rely on: contract (to provide the account and features you've signed up for), consent (for optional cookies and push notifications), legitimate interest (to keep the platform secure and functioning, and for the limited internal analytics needed to do so), and legal obligation (where we must retain or disclose information to comply with the law).

5. How We Share Information

We do not sell your personal information. We share it only with:

• Other members, as intended by the feature — e.g., your name and role are visible to people in your school/PTO's directory if you've opted in; content you post publicly is visible to visitors;
• Service providers who process data on our behalf, under contract, and only to the extent needed to provide their service: our email delivery provider, Stripe and/or PayPal (payments), OneSignal (push notifications, if enabled), Cloudflare (bot/spam protection), a shared spam-reporting service used only to check an IP/email's reputation on the Contact form, Google (Maps and web fonts, only if the site operator has enabled them), and our web hosting provider;
• Video/social platforms (YouTube, Vimeo, TikTok, X/Twitter, Instagram, Facebook) — only when a manager has added a link to their content and only once you actively click to play it; see Section 9 below;
• Legal authorities, if required by law, court order, or to protect the rights, safety, or property of PTO Moms, our members, or the public.

6. Children's Privacy

PTO Moms is intended for use by parents, guardians, teachers, PTO members, and school/district staff — it is not directed at children, and children do not create their own accounts. Any information about a student is entered by a parent or guardian for their own reference, is never publicly displayed, and is never used to identify a child in a photo, video, or any automated system (we do not use facial recognition anywhere on this platform). If you believe a child has provided us with personal information directly, please contact us at marciab80@gmail.com and we will delete it.

7. Cookies and Tracking

See our Cookie Policy for the full list of cookies we use, why, and how to manage your preferences at any time via the "Manage Cookie Settings" link in the site footer.

8. Data Retention

We keep your account information for as long as your account is active. Expired content (past events, expired business promotions, and similar time-bound items) is archived immediately and permanently deleted after the retention period the site operator has configured (visible in Admin > Settings, default 30 days). If you'd like your account and associated personal data deleted sooner, contact us — see Section 10.

9. Third-Party Links and Embedded Content

Pages on this site may embed content from third-party platforms (YouTube, Vimeo, TikTok, X/Twitter, Instagram, Facebook) that a school, PTO, or district manager has chosen to share. That content is never loaded automatically — you must actively click to play it — and once you do, you are interacting directly with that provider, subject to that provider's own privacy policy and cookies, which we do not control. Business directory listings and any external links members post are likewise outside our control; we are not responsible for the content or privacy practices of external sites.

10. Your Rights

Depending on where you live, you may have the right to: access the personal data we hold about you; correct inaccurate data; request deletion of your data; restrict or object to certain processing; receive a copy of your data in a portable format; and withdraw consent at any time where processing is based on consent (this won't affect processing that already happened). You can update most of your own information directly from your Account settings. For anything else — including a full account deletion request, since this platform does not currently offer a self-service "delete my account" button — contact us at marciab80@gmail.com and we will action your request within a reasonable time and in line with applicable law. If you are in the EU/EEA or UK, you also have the right to lodge a complaint with your local data protection supervisory authority.

11. International Data Transfers

Depending on where our hosting provider and the service providers listed in Section 5 operate, your information may be processed in a country other than your own. Where required, we rely on the safeguards those providers make available (such as standard contractual clauses) to protect your data in such transfers.

12. Data Security

We use industry-standard measures to protect your information, including encrypted connections (HTTPS), hashed passwords, and access controls limiting who can see what. No method of transmission or storage is perfectly secure, and we cannot guarantee absolute security.

13. Changes to This Policy

We may update this policy from time to time. We'll update the "Last updated" date at the top, and where changes are significant, we'll take reasonable steps to let members know (such as a notice on the site).

14. Contact Us

Questions about this policy or your data? Email marciab80@gmail.com or use our Contact page.