Parent Consent Disclosures

PHASE B — DOCUMENT 3: PARENT CONSENT DISCLOSURES (direct notice + consent flow)

Status: draft for review. This is the operative consent architecture: the words a parent sees before any child data is collected, the record we keep, and the withdrawal path. Under COPPA this is the "direct notice"; under the LFPDPPP it is the moment the consentimiento expreso is obtained.

Publication gate: Resolved: KidChat is a technology service operated by NOXON, LLC, a Texas limited liability company. [COUNSEL REVIEW REQUIRED — PRIVACY CONTROLLER / RESPONSIBLE ENTITY ADDRESS] (the notice must name the controller) and the narrow open item on the VPC method used for the closed Alpha (card-with-nominal-charge was decided as the target method, but subscription billing is deferred past Alpha — see Addendum A3, D-13).

A. WHERE CONSENT SITS IN THE FLOW

1  Parent creates account (email + password)
2  Parent verifies email address
3  DIRECT NOTICE shown in full — §B below           <- before ANY child data is typed
4  Parent completes VERIFIABLE PARENTAL CONSENT      <- method per D-03 / Alpha open item
5  Consent record written (method, timestamp, evidence ref, notice version)
6  Child profile creation unlocked (age gate 6-12)
7  Kid Mode reachable

Hard rule: steps 6 and 7 are unreachable until step 5 has written a record. No child name, no birthdate, no conversation may be collected before that. (C-01, C-02, C-03)

B. DIRECT NOTICE TO THE PARENT — ENGLISH MASTER

### Before your child uses KidChat Who is asking. NOXON, LLC, a Texas limited liability company (Texas, United States) [COUNSEL REVIEW REQUIRED — PRIVACY CONTROLLER / RESPONSIBLE ENTITY ADDRESS]. Questions: privacy@kidchat.io. We need your permission. KidChat is for children aged 6 to 12. The law requires us to get your permission before we collect anything about your child, and we want it anyway. What we will collect about your child - The first name or nickname you enter, and their date of birth. - The questions your child types and the answers KidChat gives. - How long and how often they use it, and the limits you set. - Safety and technical records — categories and timings, not the sensitive words themselves. What we will not collect. We do not ask your child for a last name, address, phone number, photo, precise location, or contacts. If your child types something like that, we remove it before the question reaches our AI provider, and we do not keep it. (C-06, C-07) Voice and microphone features are turned off. (C-16) How we use it. To answer your child's questions at their reading level, to spot and respond to safety concerns, to show you their history, to enforce the screen-time rules you set, and to keep the service running. Nothing else. Who else sees it. Our AI provider receives the question after we remove personal details, so it can generate an answer. Our hosting provider stores the data. That is the whole list for your child's data. We do not sell it, we do not use it for advertising, and under the configurations we use, our AI providers do not train general-purpose models on it. (C-08, C-09) You can read everything. You can see your child's full conversation history in Parent Mode, protected by your PIN. Your child is told, permanently and in words they understand, that you can read it. (C-11, C-12) How long we keep it. Conversations are deleted after 30 days. You can delete them sooner, delete a child profile, or delete your account at any time. (C-04, C-05) Your choices at any time. Review your child's information · delete it · refuse any further collection while keeping your account · withdraw this permission entirely, which ends your child's use of KidChat and deletes their data. What KidChat is not. KidChat uses AI and can be wrong. It is not a teacher, tutor, doctor, therapist, or counselor, and it gives no professional advice. It does not monitor conversations in real time, and it cannot call emergency services or send help. If your child shows signs of distress, we respond with age-appropriate guidance and real crisis resources, and the most serious cases are reviewed by a named person at KidChat. (C-13, C-14, C-15, C-20) One thing we want you to read twice. We do not automatically notify you about every safety event. In particular, if what a child says suggests they may be at risk from a parent or caregiver, we do not send an automatic alert to the account holder, because that could put the child in more danger. Those cases go to human review instead. Our Child Safety Policy explains each level. Where KidChat is available. Mexico, and later the United States. KidChat is not offered to children in the UK or EU. (C-19) ☐ I am the parent or legal guardian of the child I am about to add. ☐ I have read this notice and I give my permission for KidChat to collect and use my child's information as described. [ Verify and continue ] · Full policy: kidchat.io/trust/privacy

Verification step copy (method-neutral master)

KidChat obtains Verifiable Parental Consent through an approved payment-method verification flow or another legally accepted verification mechanism. No charge amount, refund behavior, or provider is fixed in these documents. The final wording shown to a parent must describe, in specific terms, exactly what happens and exactly what is stored under the mechanism actually selected.

To confirm you are an adult, we use {{VERIFICATION_METHOD}}. We store only a confirmation reference from our verification provider — never your card number and never a copy of an identity document. This step verifies that a parent or guardian is giving permission; it is not a subscription. (C-03)

Candidate mechanisms, none pre-selected:

• qualifying payment-method verification;
• identity verification through a specialized provider;
• another FTC-recognized or otherwise legally appropriate mechanism for the jurisdiction.

Rules that bind whichever mechanism is chosen:

• Government ID is not collected unless that verification method is deliberately selected, documented, and disclosed.
• Verification information is minimized and deleted promptly once it is no longer necessary; only a non-reversible confirmation reference is retained as evidence.
• The production implementation is reviewed against the current COPPA Rule and against the payment/verification provider's actual behavior before any U.S. launch.
• Mexico is assessed separately: a mechanism that satisfies COPPA is not assumed to satisfy the LFPDPPP requirement of consentimiento expreso from the holder of patria potestad.

[COUNSEL REVIEW REQUIRED — VPC IMPLEMENTATION] [LEGAL DECISION REQUIRED — VPC METHOD FOR CLOSED ALPHA MEXICO]

C. AVISO Y CONSENTIMIENTO AL PADRE, MADRE O TUTOR — español (México)

### Antes de que su hija o hijo use KidChat Quién le pide permiso. NOXON, LLC, a Texas limited liability company (Texas, United States) [COUNSEL REVIEW REQUIRED — PRIVACY CONTROLLER / RESPONSIBLE ENTITY ADDRESS]. Dudas: privacy@kidchat.io. Necesitamos su consentimiento expreso. KidChat es para niñas y niños de 6 a 12 años. No recabamos ningún dato de su hija o hijo antes de que usted lo autorice. Qué vamos a recabar - El nombre o apodo que usted escriba y la fecha de nacimiento. - Las preguntas que escriba su hija o hijo y las respuestas de KidChat. - Cuánto y con qué frecuencia lo usa, y los límites que usted configure. - Registros de seguridad y técnicos: categorías y horarios, no las palabras sensibles. Qué no vamos a recabar. No le pedimos apellido, domicilio, teléfono, fotografía, ubicación precisa ni contactos. Si su hija o hijo escribe algo así, lo eliminamos antes de que la pregunta llegue al proveedor de inteligencia artificial y no lo conservamos. Las funciones de voz y micrófono están apagadas. Para qué lo usamos. Para responder al nivel de lectura de su hija o hijo, detectar y atender situaciones de seguridad, mostrarle a usted el historial, aplicar los límites de tiempo que configure y operar el servicio. Nada más. Quién más lo ve. El proveedor de inteligencia artificial recibe la pregunta ya sin datos personales; el proveedor de alojamiento almacena la información. Esa es toda la lista. No vendemos los datos, no los usamos para publicidad y, con las configuraciones que empleamos, los proveedores de IA no entrenan modelos de propósito general con ellos. Estos proveedores están en Estados Unidos, por lo que existe una transferencia internacional. Usted puede leer todo. Puede consultar el historial completo en el Modo Padres, protegido con su NIP. Su hija o hijo lo sabe: KidChat se lo dice de forma permanente y en palabras que entiende. Cuánto tiempo lo guardamos. Las conversaciones se eliminan a los 30 días. Usted puede borrarlas antes, eliminar el perfil o cerrar la cuenta cuando quiera. Sus derechos. Acceder, rectificar, cancelar y oponerse (derechos ARCO), así como revocar este consentimiento en cualquier momento; revocarlo da de baja el perfil y elimina los datos. Escriba a privacy@kidchat.io; respondemos en un máximo de 20 días hábiles. Puede acudir al INAI si considera vulnerado su derecho. Lo que KidChat no es. KidChat usa inteligencia artificial y puede equivocarse. No es maestro, tutor, médico, terapeuta ni consejero, y no da asesoría profesional. No vigila las conversaciones en tiempo real y no puede llamar a servicios de emergencia ni enviar ayuda. Ante señales de riesgo mostramos orientación adecuada a la edad y líneas de ayuda reales, y los casos más graves los revisa una persona designada de KidChat. Léalo dos veces. No le avisamos automáticamente de cada evento de seguridad. En particular, si lo que dice una niña o un niño sugiere que podría estar en riesgo por parte de su padre, madre o cuidador, no enviamos un aviso automático al titular de la cuenta, porque eso podría aumentar el riesgo. Esos casos pasan a revisión humana. La Política de Seguridad Infantil explica cada nivel. ☐ Soy el padre, la madre o el tutor legal de la niña o el niño que voy a registrar. ☐ He leído este aviso y otorgo mi consentimiento expreso para que KidChat recabe y trate los datos personales de mi hija o hijo en los términos descritos. [ Verificar y continuar ] · Aviso completo: kidchat.io/trust/privacy

D. THE CONSENT RECORD (minimum sufficient evidence)

Stored per consent event; nothing more:

Never stored: full card number, government ID image, full IP address, or a copy of the parent's identity document.

Every version of the notice text is archived; a material change requires re-consent, and the new record carries the new notice_version.

E. WITHDRAWAL

One control in Parent Mode: "Withdraw permission and delete my child's data." It ends the child's access immediately, starts the deletion workflow, writes withdrawn_at, and confirms by email with the completion window. Withdrawal must not be harder than consent, must not require a phone call, and must not be buried under billing settings.

F. JURISDICTION DIFFERENCES

G. OPEN ITEMS

• Resolved: KidChat is a technology service operated by NOXON, LLC, a Texas limited liability company. [COUNSEL REVIEW REQUIRED — PRIVACY CONTROLLER / RESPONSIBLE ENTITY ADDRESS] — the notice cannot ship unnamed.
• [LEGAL DECISION REQUIRED — VPC METHOD FOR CLOSED ALPHA MEXICO] — mechanism selection, kept separate from the U.S. mechanism.
• [COUNSEL REVIEW REQUIRED — VPC IMPLEMENTATION] — mechanism reviewed against the current COPPA Rule and the provider's actual behavior before U.S. launch.
• [COUNSEL REVIEW REQUIRED] — Mexican wording on incidental sensitive data and on the international transfer paragraph.
• [TECHNICAL VALIDATION REQUIRED — BACKUP RETENTION] — backup purge window shared with document 2 and document 7; no "deleted from all systems" wording until measured.
• Backup purge window figure, shared with document 2.