Parent Privacy Policy / Aviso de Privacidad

PHASE B — DOCUMENT 2: PARENT PRIVACY POLICY / AVISO DE PRIVACIDAD

Status: draft for review. Controller / responsable: NOXON, LLC, a Texas limited liability company (Texas, United States). The notice address per jurisdiction remains [COUNSEL REVIEW REQUIRED — PRIVACY CONTROLLER / RESPONSIBLE ENTITY ADDRESS]. Publication also requires the Claim-to-Control Matrix to show LIVE for every promise below.

Structure: one English master (§A), a Mexican aviso de privacidad adaptation in Spanish (§B) — an adaptation, because the aviso has its own legally required sections — and a jurisdiction-difference table (§C).

Scope note used throughout: KidChat V1 serves children 6–12, is offered in Mexico (closed Alpha) and later the United States, and is not offered in the UK or EU (C-19).

A. ENGLISH MASTER — PARENT PRIVACY POLICY

Last updated: (date set at publication) · Applies to: kidchat.io and the KidChat application Who we are: NOXON, LLC, a Texas limited liability company (Texas, United States) [COUNSEL REVIEW REQUIRED — PRIVACY CONTROLLER / RESPONSIBLE ENTITY ADDRESS] · Contact: privacy@kidchat.io

1. In one paragraph

KidChat is a subscription service that a parent or guardian buys and controls. You create your child's profile; your child never signs up alone. We collect the least we can, we keep conversations for 30 days, we do not sell personal information, we do not show advertising, and we do not allow our AI providers to train general-purpose models on your child's conversations under the configurations we use. (C-01, C-04, C-08, C-09)

2. Who controls the data

NOXON, LLC decides how and why personal data is processed and is the data controller (responsable under Mexican law). Resolved: KidChat is a technology service operated by NOXON, LLC, a Texas limited liability company. [COUNSEL REVIEW REQUIRED — PRIVACY CONTROLLER / RESPONSIBLE ENTITY ADDRESS]

3. What we collect

From you, the parent/guardian

• Name, email address, password (stored only as a hash).
• Your parental-consent record: the method used, the date, and a reference to the evidence — never a full payment card number. (C-03)
• Account preferences: language, notification settings, parent PIN (stored hashed).
• Support correspondence.

About your child, entered by you

• First name (or nickname), date of birth (used to confirm the 6–12 range and to fit answers to age), an avatar, a companion name, and screen-time rules you set. (C-02)

Generated as your child uses KidChat

• The questions your child types and KidChat's replies.
• Session summaries produced automatically for your Activity view.
• Safety event records: category, severity, timestamp, internal profile ID, action taken — not the sensitive text that triggered them. (C-07)
• Usage records: which feature, when, for how long.
• A technical/cost ledger per AI request: provider, model, tokens, cost, feature, internal profile ID, timestamp, latency, safety result — with no conversation content. (C-18)

We do not collect: your child's last name, address, phone number, photograph, precise location, contacts, or biometric data. We do not ask your child for them, and if your child types something like that, our Privacy Shield removes it before the question reaches the AI and does not keep it. (C-06, C-07) Voice input and audio recording are off; the microphone is disabled by a server-side flag. (C-16)

4. Why we use it (purposes)

We do not use children's data for advertising, profiling for marketing, sale, or any purpose unrelated to running KidChat. (C-09)

5. Who we share it with

We share only with service providers who process data on our instructions, under contract:

We do not sell personal information. We do not share children's data with advertisers, data brokers, or social platforms. (C-09) We may disclose data if legally compelled, and will tell you unless prohibited.

Analytics: no third-party analytics, session replay, heatmaps, advertising identifiers, or cross-site tracking run in Kid Mode. (C-10) Any analytics on the marketing website is described in the Cookie & Tracking Notice.

International transfers: our providers process data in the United States. For Mexican families this is an international transfer of personal data, made under contractual commitments with each provider. [COUNSEL REVIEW REQUIRED]

6. How long we keep it

Deleting a child profile or closing your account starts deletion of that child's data, subject only to narrow, specified legal or security exceptions.

7. Your rights, and your rights as a parent

You may at any time:

• See your child's conversation history in Parent Mode (protected by your PIN, and each access is recorded). (C-12)
• Correct your and your child's profile information.
• Delete individual conversations, a child profile, or your whole account. (C-05)
• Export a readable copy of your account's data.
• Withdraw consent — this ends your child's use of KidChat and triggers deletion.
• Refuse further collection while keeping the account: contact us and we will disable the child's profile.
• Object or restrict, and complain to your regulator (Mexico: INAI. United States: the FTC or your state attorney general).

Requests go to privacy@kidchat.io. We respond within 20 business days in Mexico and within 30 days in the United States.

8. Your child can be read by you — and knows it

KidChat is not private from you. Your child sees a permanent, age-appropriate notice saying that a parent or guardian can read their conversations. We consider this non-negotiable: it is oversight, not surveillance, only when the child knows. (C-11)

9. Safety — what we do and what we cannot do

KidChat detects signs of distress or danger and responds with age-appropriate guidance and real, verified crisis resources for your country. (C-13) The most serious events are reviewed by a named person at KidChat. (C-14)

We do not notify you automatically for every safety event; we describe when we do, and when we do not, in the Child Safety Policy. There is one deliberate exception: where a disclosure suggests that a child may be at risk from a parent or caregiver, we do not send an automatic notification to the account holder, because doing so could increase the risk to the child. Those cases go to human review.

KidChat cannot call emergency services, cannot send help to your home, and does not monitor conversations in real time. (C-15)

10. Security

Data is encrypted in transit and at rest, access is limited to people who need it, and parent access to transcripts is protected by PIN and logged. (C-12, C-17) No system is perfectly secure. If a breach affects your family's data, we will notify you and the relevant regulator as required by law.

11. AI, honestly

KidChat uses AI models from third-party providers, reached through a gateway. We restrict which providers and models may see children's content, and we require configurations where that content is not used to train general-purpose models. (C-08) AI can be wrong. KidChat is a thinking companion, not a teacher, tutor, doctor, or counselor, and gives no professional advice. (C-20)

12. Where KidChat is offered

Mexico first, the United States next. KidChat is not offered to children in the United Kingdom or the European Union, and registration from those regions is blocked. (C-19)

13. Changes

We will email you before any change that materially affects your child's privacy, and where the change expands what we collect or share, we will ask for your consent again.

14. Contact

privacy@kidchat.io · NOXON, LLC, a Texas limited liability company (Texas, United States) [COUNSEL REVIEW REQUIRED — PRIVACY CONTROLLER / RESPONSIBLE ENTITY ADDRESS] · Trust Center: kidchat.io/trust

B. AVISO DE PRIVACIDAD INTEGRAL (México) — español

Adaptación conforme a la LFPDPPP y su Reglamento. Secciones obligatorias marcadas.

Identidad y domicilio del responsable (obligatorio)

NOXON, LLC, con domicilio en Texas, United States [COUNSEL REVIEW REQUIRED — PRIVACY CONTROLLER / RESPONSIBLE ENTITY ADDRESS], es responsable del tratamiento de sus datos personales y de los de su hija o hijo. Resuelto: KidChat es un servicio tecnológico operado por NOXON, LLC, sociedad de responsabilidad limitada constituida en Texas, Estados Unidos. [COUNSEL REVIEW REQUIRED — PRIVACY CONTROLLER / RESPONSIBLE ENTITY ADDRESS]

Datos personales que se recaban (obligatorio)

Del padre, madre o tutor: nombre, correo electrónico, contraseña (cifrada), NIP parental (cifrado), preferencias de la cuenta, registro del consentimiento otorgado y, cuando exista facturación, un identificador de pago (nunca el número completo de la tarjeta).

De la niña o el niño, capturados por usted: nombre o apodo, fecha de nacimiento (para confirmar el rango de 6 a 12 años y adecuar las respuestas), avatar, nombre del compañero y las reglas de tiempo de uso que usted defina.

Generados por el uso: las preguntas escritas y las respuestas de KidChat, resúmenes automáticos de sesión, registros de eventos de seguridad (categoría, severidad, fecha, identificador interno y acción tomada, sin el texto sensible), registros de uso y una bitácora técnica de costo por solicitud de IA sin contenido de la conversación.

Datos sensibles. No solicitamos datos sensibles. Una conversación infantil puede contenerlos de forma espontánea (por ejemplo, referencias a salud o estado emocional). Cuando nuestro sistema de protección detecta un dato personal innecesario, lo elimina antes de enviarlo al proveedor de IA y no lo conserva. El consentimiento expreso del padre, madre o tutor cubre este tratamiento incidental. [COUNSEL REVIEW REQUIRED]

Finalidades del tratamiento (obligatorio, separando primarias y secundarias)

Primarias (necesarias): prestar el servicio y responder las preguntas de la niña o el niño; adecuar las respuestas a la edad; detectar y atender situaciones de seguridad; permitir al padre, madre o tutor consultar el historial; aplicar los límites de tiempo configurados; operar, depurar y controlar los costos del servicio; facturar cuando exista cobro.

Secundarias (usted puede negarse sin afectar el servicio): enviarle el resumen semanal por correo y comunicaciones sobre mejoras del producto. Para negarse, escriba a privacy@kidchat.io o desactive las notificaciones en Ajustes de la cuenta.

No utilizamos datos de menores para publicidad, mercadotecnia, elaboración de perfiles comerciales ni los comercializamos.

Transferencias (obligatorio)

Compartimos datos con encargados que los tratan por cuenta nuestra: proveedores de inteligencia artificial autorizados a través de una pasarela, alojamiento y base de datos, envío de correo (solo datos del adulto) y, en su momento, procesamiento de pagos. Estos proveedores tratan la información en Estados Unidos, por lo que existe una transferencia internacional, realizada bajo compromisos contractuales. No realizamos transferencias que requieran su consentimiento adicional; si ello cambiara, se lo solicitaremos previamente. [COUNSEL REVIEW REQUIRED]

Plazos de conservación

Conversaciones y resúmenes: 30 días, con posibilidad de borrado anticipado por usted. Perfil de la niña o el niño: hasta que usted lo elimine. Metadatos de seguridad: el mínimo necesario para la protección del menor, sin el contenido sensible. Registro de consentimiento: mientras exista la cuenta y el plazo necesario para acreditarlo. Bitácora de costos: como dato operativo seudonimizado, desvinculada al eliminar el perfil.

Derechos ARCO y revocación (obligatorio)

Usted puede acceder, rectificar, cancelar u oponerse al tratamiento, así como revocar su consentimiento y limitar el uso o divulgación de los datos. Envíe su solicitud a privacy@kidchat.io indicando su nombre, correo de la cuenta, el derecho que ejerce y la descripción de los datos. Responderemos en un plazo máximo de 20 días hábiles. Revocar el consentimiento implica dar de baja el perfil de la niña o el niño y eliminar sus datos.

Si considera que su derecho a la protección de datos ha sido vulnerado, puede acudir al INAI.

Medios para limitar el uso o divulgación

Ajustes de la cuenta permiten desactivar los correos y eliminar conversaciones o perfiles. El acceso al historial requiere NIP parental y queda registrado.

Seguridad

Los datos viajan y se almacenan cifrados, el acceso está limitado al personal necesario y todo acceso del adulto al historial queda registrado. Ningún sistema es infalible; en caso de vulneración se lo notificaremos conforme a la ley.

Aviso a la niña o el niño

KidChat muestra de forma permanente, en lenguaje adecuado a su edad, que su papá, mamá o tutor puede leer sus conversaciones. KidChat no es privado frente al titular de la cuenta.

Limitaciones de KidChat

KidChat usa inteligencia artificial y puede equivocarse. No es maestro, médico, psicólogo ni consejero, y no da asesoría profesional. KidChat no puede llamar a servicios de emergencia ni enviar ayuda, y no vigila las conversaciones en tiempo real.

Cambios al aviso (obligatorio)

Publicaremos cualquier cambio en kidchat.io/trust/privacy y le avisaremos por correo. Si el cambio amplía lo que recabamos o con quién lo compartimos, solicitaremos su consentimiento nuevamente.

Fecha de última actualización: (date set at publication)

C. JURISDICTION DIFFERENCES

Conflict rule to include in the final Terms: for Mexican families the Spanish aviso governs; for US families the English policy governs. [COUNSEL REVIEW REQUIRED — GOVERNING LAW / DISPUTE RESOLUTION]

D. PUBLICATION GATE

Do not publish until: NOXON, LLC/Texas, United States [COUNSEL REVIEW REQUIRED — PRIVACY CONTROLLER / RESPONSIBLE ENTITY ADDRESS]`` resolved; privacy@kidchat.io live and monitored; C-03, C-04, C-05, C-06, C-07, C-08, C-10, C-12, C-13, C-19 all LIVE in the Claim-to-Control Matrix; backup purge window measured, not estimated; and counsel review of the transfer and sensitive-data paragraphs.