> DRAFT — NOT LEGAL ADVICE. This document is a draft for review only. It is not legal advice and it is not final or legally sufficient on its own. It must be reviewed and approved by a lawyer before launch. Do not publish this document until that review is complete.
Company: [TO FILL — legal company name]
Service: PrepSprouts
Website: https://prepsprouts.com
Contact for privacy questions: [TO FILL — parent contact route; do not publish without a working contact method]
Effective date: [TO FILL]
This service is for parents and guardians. A parent or guardian registers first and creates a parent account. Children do not create accounts and do not log in directly.
Only a parent or guardian may add a child to a parent account, and only after completing the verifiable parental consent step described in the companion document, `coppa-flow.md`.
When a parent registers, we collect only what is needed to run the parent account, such as the parent's name and email address and the parent's account login information. The exact fields will be confirmed during legal review: [TO FILL — confirm final parent registration fields].
For each child added by a parent, we collect only the following:
We do not collect, and parents must not enter, any of the following for a child:
If a parent accidentally enters information beyond this list, the parent should delete it or contact us using the contact route in the header above, and we will remove it.
We may collect limited technical information needed to operate the service, such as the type of device or browser used, in general, non-identifying form. We do not use this information to identify a child or to target advertising to a child. Specific technical practices will be confirmed during legal review: [TO FILL — confirm analytics, cookies, and hosting practices].
We do not collect any child information before a parent has completed verifiable parental consent. The consent step, what the parent is asked to confirm, and how the consent record is kept are described step by step in `coppa-flow.md`.
A parent may withdraw consent at any time by deleting the child's profile or by contacting us. If consent is withdrawn, we will stop collecting new information for that child and will handle existing information as described in Section 7 below.
We use parent and child information only to:
We do not use children's information for any other purpose without first obtaining further parental consent.
We do not show targeted advertising to children. We do not sell children's personal information. We do not share children's personal information with third parties for advertising or marketing purposes.
Any third-party tools used to operate the service must be limited to operating the service itself, and must not be used to collect children's information for their own advertising purposes. The list of any such service providers will be confirmed during legal review: [TO FILL — confirm whether any third-party service providers are used, and if so, list them and their roles].
We do not share a child's nickname, applying level, test date, or learning progress/results with anyone other than the parent account holder, except:
We do not publish children's information, and we do not make children's profiles public.
A parent may at any time, through the parent account:
A parent may also make these requests by contacting us using the contact route in the header above.
When a parent deletes a child's profile, we will delete that child's nickname, applying level, test date, and learning progress/results from the active service. Backup copies, if any, will be removed on a reasonable schedule as part of routine backup rotation. The exact backup schedule will be confirmed during legal review: [TO FILL — confirm backup retention schedule in general terms].
We keep parent account information for as long as the parent account remains active. We keep a child's nickname, applying level, test date, and learning progress/results only for as long as the parent keeps that child profile on the account, or until the parent deletes it or withdraws consent.
When an account or child profile is deleted, we do not keep the child's learning progress/results for ongoing use. We keep a consent record only as long as needed to show that consent was obtained and, if applicable, withdrawn, as advised by legal counsel. The exact retention period for consent records will be confirmed during legal review: [TO FILL — confirm consent-record retention period].
We do not keep children's information longer than reasonably necessary to provide the service the parent requested.
We protect parent and child information with reasonable administrative, technical, and physical safeguards appropriate to the limited information we collect. In general terms, this includes access controls so that only the parent account holder can view that account's children, and reasonable protections for information in transit and at rest.
This draft does not claim any specific security certification, audit, or vendor, and none should be added without verification. Specific security measures will be confirmed during legal review: [TO FILL — confirm security measures in general, verifiable terms only].
No method of transmission or storage is completely secure. If a parent believes an account has been accessed without permission, the parent should change the parent account password promptly and contact us using the contact route in the header above.
If we change this policy in a way that affects how children's information is collected, used, or shared, we will notify parents through the parent account or by email to the parent's registered email address before the change takes effect, and we will obtain new parental consent where required by law. The method and timing of notice will be confirmed during legal review: [TO FILL — confirm change-notice method and timing].
Parents with questions about this policy, or who wish to review, correct, or delete their children's information, may contact us at: [TO FILL — parent contact route].