Verifiable Parental Consent Form

Document version: [CONSENT_FORM_VERSION] Effective date: [EFFECTIVE_DATE]

This form is presented to a parent or legal guardian during account creation, before any data is collected from a child. It satisfies the verifiable parental consent ("VPC") requirements of the U.S. Children's Online Privacy Protection Act (COPPA) and equivalent obligations under GDPR Art. 8.

The text below is the canonical consent text. The implementing system uses this text verbatim in the product UI and stores a timestamped record of acceptance for each parent and each child profile.

Notice to parent or legal guardian

[COMPANY_LEGAL_NAME] (we, us, our) operates [PRODUCT_NAME] — a learning service for children. Before your child uses [PRODUCT_NAME] we need your consent.

This notice tells you:

• What we will collect from your child
• How we will use it
• How you can review or delete it at any time
• What we promise we will not do

Please read this carefully. By checking the boxes below you give us legally-binding consent.

1. Who we are

• Company: [COMPANY_LEGAL_NAME]
• Address: [REGISTERED_ADDRESS]
• Privacy email: [PRIVACY_EMAIL]
• Phone (for verification): [PRIVACY_PHONE]

2. What we will collect from your child

We collect only what is needed to deliver the learning service you have configured:

• First name or nickname (no last name)
• Age
• Primary language and learning language
• Reading level and maths level (you choose)
• Favourite topics and any topics you block
• Persona and homework strictness you select
• Tutoring activity — mode, duration, message count, short summaries of each turn
• Safety events — category, severity, short excerpt, action taken
• Learning progress signals — subject, skill, level
• Voice/text input during a session (see below)

We will not ask for: your child's last name, home address, phone number, photographs, video, school name, or geolocation.

3. Voice and message content

• The audio of what your child says is processed on the device (in the browser). It is not sent to our servers in the current product.
• The text of what your child types or says is sent to our servers to produce a tutor reply.
• By default we store only a short summary of each turn — not the full message text. You can change this in the child's settings.
• Message text is sent to our AI provider to generate a response. Our agreements prohibit them from using it to train models.

4. How we will use it

• To deliver the tutoring experience you have configured
• To enforce safety guardrails on every turn
• To show you activity summaries and safety events in your dashboard
• To keep the service secure

5. What we will not do

• We will not show your child advertising
• We will not sell or rent your child's data
• We will not allow third parties to advertise inside the product
• We will not use your child's data to train AI models
• We will not encourage your child to keep secrets from you
• We will not condition your child's use of the service on giving us more data than is needed

6. Who else may see the data

Only service providers that help us run [PRODUCT_NAME] (cloud hosting, AI provider, etc.) — each is contractually bound to use the data only to provide their service to us. Our full Subprocessor List is at [SUBPROCESSORS_URL].

7. Your rights

At any time, by emailing [PRIVACY_EMAIL] or writing to [COMPANY_POSTAL_ADDRESS], you can:

• Review the personal information we have collected from your child
• Delete your child's profile and all related data
• Refuse to permit any further collection or use
• Export your data in a structured format
• Withdraw this consent (the service will become unusable for your child after withdrawal)

We will verify your identity (typically by confirming you are the account holder) and respond within 30 days.

8. Changes

If we ever materially change the categories of data we collect from your child, or the purposes, we will obtain your renewed consent before the change applies to your child.

9. Verification of your consent

To meet COPPA's "verifiable parental consent" requirement we use one or more of the following methods, depending on your situation. The method used for your account is logged with your account.

• Method A — Payment verification. When you start a paid subscription, your payment method confirms you are an adult.
• Method B — Email-plus. We send a confirmation email to you, and a follow-up confirmation step (or delayed reconfirmation) before child data collection begins.
• Method C — Government-issued ID. You upload a photo of a government-issued ID; it is checked against records by [ID_VERIFICATION_PROVIDER]; the image is then deleted.
• Method D — Signed form. You print and return this form by mail or email scan.
• Method E — Video call or phone callback with trained staff.

10. Your declarations

By signing below (or by checking the equivalent boxes in the product) you confirm:

• [ ] I am the parent or legal guardian of every child profile I will create in this account.
• [ ] I am at least the age of legal majority in my country.
• [ ] I have read the Privacy Policy and the Children's Privacy Notice.
• [ ] I consent to the collection and use of my child's personal information as described above.
• [ ] I consent to my child's data being transferred to and processed in [PRIMARY_JURISDICTION] and other countries described in the Privacy Policy.
• [ ] I understand I can withdraw this consent at any time by emailing [PRIVACY_EMAIL].

Signature (mail / scan)

For each child profile, also indicate:

Office use only

How we store this record

Each successful consent acceptance is recorded as a database row with:

• Parent user ID
• Child profile IDs covered
• Consent form version (so we can prove which text the parent saw)
• Timestamp
• Method of verification
• IP address
• (For payment-verified consent) last 4 digits of the card used

We do not store the consent form text inline; we link to the immutable, versioned policy document at [CONSENT_VERSIONS_URL]. This allows us to demonstrate the exact text a parent agreed to at any past date.