Parental Consent and Child Data Flow — DRAFT

> DRAFT — NOT LEGAL ADVICE. This document is a draft for review only. It is not legal advice and it is not final or legally sufficient on its own. It must be reviewed and approved by a lawyer before launch. Do not publish this document until that review is complete.

Company: [TO FILL — legal company name]

Service: PrepSprouts

Website: https://prepsprouts.com

Contact for parents: [TO FILL — parent contact route; do not publish without a working contact method]

Purpose

This document explains, in plain English and step by step, how a parent creates an account, gives verifiable parental consent, adds a child, and later reviews or deletes the child's information. It is written for parents, and it is also the internal flow that the service must follow at launch.

Core rules that apply at every step:

• Parent-only accounts: a parent registers first, then adds children.
• Verifiable parental consent comes BEFORE any child data is collected.
• Child data is limited to nickname, applying level, test date, and learning progress/results only — never child email, password, date of birth, or address. The child's digital pet (pet nickname, stars earned by learning, and accessories earned and equipped) is stored per child as part of learning progress; it is earned by learning only, never bought with real money, and is not a score or a learning measure.
• No targeted advertising to children and no selling of children's data.
• Parents can review, correct, and delete their children's data at any time.

Step 1 — Parent account creation

1. The parent visits the service website: https://prepsprouts.com.

2. The parent chooses to create a parent account and provides only the parent's own information needed for the account, such as the parent's name and email address and a parent password. The exact parent registration fields will be confirmed during legal review: [TO FILL — confirm final parent registration fields].

3. The parent confirms the parent email address, if email confirmation is required at launch: [TO FILL — confirm whether email confirmation is required and how it works].

4. At this point, no child has been added and no child information has been collected.

No child account is created in this step. There is no child signup form and no child login.

Step 2 — Consent step and consent record

Before any child can be added, the parent must complete a verifiable parental consent step. This step must happen first, and the child-add form must not be available until consent is complete.

What the parent is shown

Before consenting, the parent is shown, in plain English:

• What child information will be collected: nickname, applying level, test date (if entered), and learning progress/results only
• What will NOT be collected: child email, password, date of birth, or address
• How the information will be used: to provide practice and to show the parent the child's progress
• That there is no targeted advertising to children and no sale of children's data
• That the parent can review, correct, and delete the child's information at any time
• How to contact the service: [TO FILL — parent contact route]

How the parent gives consent

The parent gives consent by a clear, affirmative action in the parent account, such as checking a consent box and confirming. The exact consent method must be verifiable — that is, it must reasonably confirm that the person consenting is the parent — and it must be confirmed by legal counsel before launch: [TO FILL — confirm the verifiable parental consent method, for example, the specific verification step used].

Consent given by a child, or by anyone other than the parent account holder, does not count.

Consent record

When consent is completed, the service records:

• That consent was given
• The date and time consent was given
• Which parent account gave consent
• What the parent consented to, in the terms shown at the time

This record is kept only as long as needed to show that consent was obtained and, if applicable, withdrawn, as advised by legal counsel. The exact retention period will be confirmed during legal review: [TO FILL — confirm consent-record retention period].

If consent is not completed, the parent cannot add a child, and no child information is collected.

Step 3 — Child added only after consent

Only after Step 2 is complete may the parent add a child:

1. From inside the parent account, the parent chooses to add a child.

2. The parent enters only the permitted information:

- Child's nickname

- Child's applying level

- Child's test date, if the parent chooses to enter one

3. The parent saves the child profile.

4. Learning progress and results are then generated as the child practices through the parent account, and are shown to the parent.

The parent must not enter a child's email address, password, date of birth, or home address. If the form at launch contains any field beyond the permitted list, that field must be removed before launch, and this document must be updated to match the actual form.

A parent may add more than one child, if that is offered at launch: [TO FILL — confirm whether multiple children per parent account are supported, and any limit].

Step 4 — Child access only through the parent account

• The child does not receive a login, username, or password.
• The child does not log in directly.
• The child uses the service only while signed in to the parent's account, under the parent's supervision.
• The parent remains responsible for the child's use and for keeping the parent account login private.

If a child tries to create an account or log in directly, that path must not exist. Any direct child signup or login screen found during testing must be removed before launch.

Step 5 — How a parent reviews data

At any time, the parent may, from inside the parent account:

1. Open the parent dashboard.

2. Select a child profile.

3. Review that child's nickname, applying level, test date, and learning progress/results.

The parent may also ask for a copy or summary of the child's information by contacting the service at: [TO FILL — parent contact route]. The method and timing for responding to such requests will be confirmed during legal review: [TO FILL — confirm parent-request response method and timing].

Step 6 — How a parent corrects data

At any time, the parent may, from inside the parent account:

1. Open the child profile.

2. Correct the nickname, applying level, or test date.

3. Save the change.

The parent may also request a correction by contacting the service at: [TO FILL — parent contact route].

Learning progress/results are generated by practice activity. If a parent believes a result is wrong, the parent may contact the service to ask about it, and the service will explain or correct it where appropriate.

Step 7 — How a parent deletes data

Delete one child's profile

1. From inside the parent account, the parent opens the child profile.

2. The parent chooses to delete that child.

3. The parent confirms the deletion.

4. The child's nickname, applying level, test date, and learning progress/results are deleted from the active service.

Withdraw consent

Withdrawing consent for a child has the same effect as deleting that child's profile: new information for that child is no longer collected, and existing information for that child is deleted from the active service as described above. A parent withdraws consent by deleting the child profile or by contacting the service at: [TO FILL — parent contact route].

Delete the parent account

Deleting the parent account deletes all child profiles on that account and their associated learning progress/results, subject to the backup and consent-record notes below.

Backups and consent records after deletion

Backup copies, if any, are removed on a reasonable schedule as part of routine backup rotation, not kept for ongoing use. A consent record may be kept only as long as needed to show that consent was obtained and withdrawn, as advised by legal counsel. Both schedules will be confirmed during legal review: [TO FILL — confirm backup rotation and consent-record retention in general terms].

Step 8 — What happens if a parent does not consent, or withdraws consent

• If a parent does not complete consent, no child profile can be created and no child information is collected.
• If a parent withdraws consent, the service stops collecting new information for that child and deletes existing information for that child from the active service as described in Step 7.
• Withdrawing consent for one child does not automatically delete other children's profiles or the parent account, unless the parent also chooses to delete those.

Summary flow

Parent creates parent account → Parent reads the consent notice → Parent gives verifiable consent → Consent is recorded → Parent adds a child (nickname, applying level, test date only) → Child practices only through the parent account → Parent reviews, corrects, or deletes the child's data at any time.

Items for lawyer and product review before launch

• Confirm the verifiable parental consent method is sufficient and matches how the service actually verifies the parent.
• Confirm the parent registration fields, email-confirmation step, and multiple-children support.
• Confirm that no child signup or child login path exists in the live service.
• Confirm that the child-add form contains only nickname, applying level, and test date, and collects no child email, password, date of birth, or address.
• Confirm consent-record retention, backup rotation, and parent-request response timing.
• Confirm that this flow, the Privacy Policy, and the Terms of Service all describe the same steps, and that all three match the live service before launch.
• Confirm pricing is not stated in this flow: pricing, if any, belongs in the Terms of Service and on the signup page, and must not be invented in this draft.