Children's Privacy Notice

v2.0

Effective Date: [EFFECTIVE DATE] Last Updated: [LAST UPDATED] Version: 2.0 Contact: [PRIVACY EMAIL]

KidStarter supports fundraising for students' educational needs, primarily managed by verified adults. We take the privacy and safety of children extremely seriously. This Children's Privacy Notice supplements our general Privacy Notice and explains how we handle information relating to minors (anyone under 18, or under the applicable age of majority in their jurisdiction).

Key Commitment: KidStarter does not sell children's Personal Data. We do not use children's Personal Data for advertising, profiling, behavioral targeting, or any commercial purpose unrelated to the educational Campaign.

1. Design Principles

Our platform is built with the following principles for children's data:

1.1. Adult-Managed Model: Campaigns involving minors are created and managed exclusively by verified adults (teachers, legal guardians, or authorized school representatives). Minors do not create accounts, make donations, or manage Campaigns.

1.2. Data Minimization by Default: We collect and display the absolute minimum student information necessary to operate Campaigns.

1.3. Privacy by Default and by Design: All privacy settings for minors default to the highest protection level. No opt-in action is required from guardians for protective measures — protections are automatic.

1.4. No Profiling or Behavioral Targeting: We do not build profiles of minors, serve targeted advertisements to or based on minors, or use algorithms to recommend content to minors.

1.5. Best Interests of the Child: In all decisions regarding children's data, we prioritize the best interests of the child.

2. What We Show Publicly (Minors)

For Campaigns involving minors, public-facing pages display only:

First name and last initial (or a nickname/alias chosen by the Creator);
Grade band (e.g., elementary, middle, high school) — never specific grade or age;
Broad geographic region (city or area only) — never specific address;
Category of educational need (e.g., books, laptop, tuition, assistive technology);
A narrative story written by the Creator that must not contain identifying details.

2.1 Strictly Prohibited in Public Content

The following information about minors must never appear in public Campaign content, and our systems are designed to detect and prevent it:

Full last names;
Home addresses, GPS coordinates, or directions to the child's location;
Phone numbers, personal email addresses, or instant messaging handles;
Social media handles or usernames intended to enable contact;
Government-issued identification numbers (e.g., Social Security Number, National Insurance Number, SIN, passport number);
School ID numbers, student numbers, or enrollment IDs;
School name, school logo, school address, or campus identifiers (unless explicitly approved under safety review with appropriate consents);
Classroom rosters, class schedules, bus routes, or extracurricular schedules;
Medical, psychological, or behavioral health information;
Disciplinary or academic records;
Information about other students;
Financial details of the student's family;
Any photograph, video, or image containing visible identifying information (see Section 4 below).

3. What We May Collect Privately

We may process limited additional information about students privately (not publicly visible) to:

Verify creator authority and eligibility (guardian/school authorization);
Coordinate school/vendor disbursements (invoice details, purchase orders, enrollment confirmation);
Prevent fraud and protect children from exploitation;
Comply with legal obligations;
Respond to safety reports.

This private data is stored with restricted access (accessible only to authorized personnel with a legitimate need), encrypted at rest, and subject to the retention limits in Section 7 below.

4. Image Safety

4.1. Where images of minors are used in Campaigns, Creators must ensure they have all necessary consents (guardian consent and, where applicable, school consent).

4.2. Images should preferably be head-and-shoulders only. Backgrounds must not show classroom boards, rosters, name badges, documents, mail, street signage, school signage, or other identifying information.

4.3. KidStarter may, at its discretion: (a) blur or remove backgrounds; (b) crop images; (c) offer avatar/cartoonization options as an alternative; (d) reject images that pose safety risks.

4.4. We never use children's images for advertising, marketing, or commercial purposes beyond the Campaign itself and related platform communications (e.g., share-card previews for the specific Campaign).

5. Guardian Consent and Authorization

5.1 Creator Responsibility

Creators represent and warrant that they have obtained all legally required consents and authorizations before creating a Campaign for a minor, including guardian consent where required by applicable law.

5.2 KidStarter Verification

KidStarter may require documentary evidence of authorization, including:

Signed guardian consent/authorization forms;
School authorization letters on official letterhead;
Email confirmation from an institutional email address;
Other documentation reasonably necessary to verify authority.

5.3 Verifiable Parental Consent Methods (COPPA — US)

Where KidStarter has actual knowledge of collecting Personal Data directly from a child under 13 (which our adult-managed model is designed to prevent), we will obtain verifiable parental consent using one or more of the following methods:

Signed consent form (physical or electronic);
Credit card, debit card, or other online payment system verification providing notification of the transaction;
Government-issued ID verification (checked and deleted);
Video call or live conference verification;
Knowledge-based authentication;
Any other method permitted by the FTC under COPPA.

5.4 EU/EEA Age of Digital Consent

Where consent is the legal basis for processing a child's data in the EU/EEA, we comply with the age of digital consent in the relevant Member State (ranging from 13 to 16 years). For children below the applicable age, we require holder of parental responsibility consent.

5.5 UK Age of Digital Consent

The UK applies an age of digital consent of 13 under the Data Protection Act 2018. For children under 13, we require parental consent where consent is the legal basis.

5.6 Canada

We follow PIPEDA's requirement for meaningful consent and recognize that children's capacity to provide consent increases with age. For younger children, we require parental or guardian consent.

6. Safety Controls

KidStarter employs multiple layers of safety controls:

6.1. Pre-Publication Review: All Campaigns involving minors undergo human review before publication.

6.2. Automated PII Detection: Text content is scanned for patterns matching phone numbers, email addresses, full names, Social Security/National Insurance numbers, addresses, and other PII. Flagged content is held for human review.

6.3. Image/OCR Scanning: Uploaded images are scanned for visible text, documents, badges, and identifying information.

6.4. Rapid Takedown: Content that may endanger a child is removed immediately upon detection or report — review occurs before reinstatement, not before removal.

6.5. Audit Logging: All moderation and administrative actions on Campaigns involving minors are logged with timestamps and responsible personnel for accountability.

6.6. Access Restrictions: Private student data is accessible only by authorized personnel with a documented need, subject to role-based access controls and audit trails.

6.7. Mandatory Reporting: Where KidStarter becomes aware of child exploitation material (CSAM) or reasonable suspicion of child abuse, we report to the relevant authorities, including NCMEC (US), IWF (UK), and applicable local law enforcement.

7. Retention of Children's Data

We apply the shortest retention periods we can for children's data:

Data Category	Retention Period
Public Campaign content (first name, initial, story)	Duration of active Campaign; archived on completion; deleted on guardian request where legally permitted
Private verification data (consent forms, authorization)	Duration of Campaign + 12 months for fraud prevention and audit, then deleted
Private student information (enrollment, need category)	Deleted or anonymized within 12 months after Campaign completion or disbursement
Images of minors	Duration of active Campaign; deleted within 30 days of Campaign completion or guardian request
Moderation/safety logs	Up to 24 months (for safety investigations and regulatory compliance)

Legal Holds: If data is subject to a legal hold, regulatory investigation, or ongoing dispute, it may be retained beyond these periods but only to the extent required and with appropriate access restrictions.

8. No Sale, No Advertising, No Profiling

8.1. We do not sell children's Personal Data under any definition, including the CCPA/CPRA definition of "sell."

8.2. We do not share children's Personal Data for cross-context behavioral advertising.

8.3. We do not serve targeted advertisements to children or based on children's data.

8.4. We do not build profiles of children for any commercial, behavioral, or algorithmic purpose.

8.5. We do not use children's data for machine learning training except for safety/moderation systems designed to protect children (e.g., PII detection).

9. Regional Compliance

9.1 United States — COPPA

Our Service is designed so that verified adults are the primary account holders and Campaign managers. Children do not interact with the Service directly.
If we obtain actual knowledge that we have collected Personal Data directly from a child under 13 without verifiable parental consent, we will promptly delete that data and notify the parent/guardian.
Parents may review, request deletion of, and refuse further collection of their child's information by contacting [PRIVACY EMAIL].
We do not condition a child's participation on the collection of more data than is reasonably necessary.

9.2 United Kingdom — ICO Children's Code (Age Appropriate Design Code)

We implement the following AADC standards:

Best interests of the child are a primary consideration in all design decisions;
Data minimization by default — we collect only what is necessary;
High privacy settings by default — no opt-in required for protections;
No detrimental use of children's data — no profiling, targeting, or nudge techniques;
Age-appropriate application — our adult-gated model prevents direct child interaction;
Transparency — this Notice is written in clear language;
No profiling of children for commercial or non-educational purposes;
Geolocation — we do not collect or use precise geolocation of children.

9.3 EU/EEA — GDPR

We comply with GDPR data minimization, purpose limitation, and lawful basis requirements.
Where consent is relied upon for children's data, we comply with Article 8 (age of digital consent) requirements.
Children (via their guardians) have full GDPR rights including access, rectification, erasure, restriction, portability, and objection.
DPIAs have been or will be conducted for high-risk processing involving children's data.

9.4 Canada — PIPEDA and Provincial Laws

We apply meaningful consent requirements, recognizing children's evolving capacity.
Guardian consent is required for younger children.
Guardians have full access, correction, and deletion rights.
Where required by Quebec Law 25, we conduct privacy impact assessments for processing involving children's data.

10. Guardian and Student Rights

Guardians (and students who have reached the age of majority) may:

Access the student's Personal Data held by KidStarter;
Correct inaccurate or incomplete data;
Delete the student's Personal Data (subject to legal retention obligations);
Object to specific processing;
Withdraw consent previously given;
Request data portability (where applicable under GDPR/UK GDPR);
Request removal of a Campaign or specific content featuring the student.

To exercise any right, contact [PRIVACY EMAIL]. We will verify the requester's identity and authority before acting. We aim to respond within the timeframes required by applicable law.

11. Report a Concern

If you believe a Campaign exposes identifying information about a minor, or if you have any safety concern regarding a child on the Service, report it immediately:

Report: [REPORT LINK OR EMAIL]
Email: [PRIVACY EMAIL]
Emergency: If a child is in immediate danger, contact your local emergency services first, then notify us.

We operate a rapid-response protocol for child safety reports. Content is removed first and reviewed second.

12. Changes to This Notice

We may update this Notice from time to time. Material changes will be communicated with at least 30 days' notice via email to Creators/guardians and prominent notice on the Service. The "Last Updated" date will be revised.

13. Contact

Privacy Inquiries: [PRIVACY EMAIL] Safety Reports: [REPORT LINK OR EMAIL] General Support: [SUPPORT EMAIL] Mailing Address: [ADDRESS]