Parent consent policy

WonderPath ("we", "us", "our") is a learning platform for children aged four to eleven. It is operated by Clove9, whose business address is Office 128, 18 Young Street, Unit LGE, Edinburgh, EH2 4JB, Scotland, United Kingdom. Because our service processes children's personal data and uses artificial intelligence in an educational context, we take parental consent extremely seriously. This policy explains how we obtain consent, what it covers, how we record it and how you can withdraw it.

1. Who must give consent

Only a parent or legal guardian ("the parent") may create a WonderPath account and add a child profile. Children cannot create accounts themselves. The parent is the sole data controller decision-maker for their child's use of the service.

By "parent" we mean: a biological parent, an adoptive parent, a legal guardian, or any person with parental responsibility as defined under the Children Act 1989.

2. What we ask consent for

At account creation, the parent is asked to provide explicit, informed, specific and freely given consent for the following:

Consent 1: Terms and Privacy

The parent confirms that they have read and accept our Terms of Service and Privacy Policy, including the processing of their child's personal data as described in those documents.

Consent 2: AI-powered learning

The parent gives specific consent for their child to interact with AI-powered features, including the AI tutor, AI-generated lessons, voice synthesis and AI-based progress analysis. This consent is separate from the general terms consent because AI processing of children's data represents high-risk processing under UK GDPR Article 35, and we believe parents should make an informed, specific decision about it.

3. How consent is presented

Consent is presented through clear, unambiguous checkboxes during account registration. Each checkbox is:

• Unchecked by default. The parent must actively tick each box. Pre-ticked boxes or implied consent are not used.
• Clearly labelled. Each checkbox plainly states what the parent is agreeing to, with a link to the full policy document.
• Mandatory for account creation. The registration cannot proceed without both consents being given, whether you sign up with an email address or with Google. If a record is missing for the current version of our policies, for example because you confirmed your email later, you are asked to confirm the next time you sign in before continuing.
• Granular. Terms/Privacy consent and AI consent are presented as separate checkboxes so the parent understands each commitment individually.

4. How consent is recorded

Every consent action is recorded in our consent_records database with the following information:

• The user's account identifier.
• The type of consent given: terms_of_service, privacy_policy or ai_usage.
• The version of the policy document that was consented to.
• The date, time and timezone of consent.
• The user agent string (browser and device information) at the time of consent.

Records are never edited; a withdrawal is recorded as a new entry with a timestamp. They are retained for the life of the account plus thirty days after deletion, in line with our Data Retention Policy.

5. Withdrawing consent

Parents have the right to withdraw consent at any time, as required by UK GDPR Article 7(3). Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

• Withdrawing AI consent: Parents can disable all AI features for any child from the parent dashboard. When AI is disabled, the child can still access pre-built curriculum content but cannot use the AI tutor, AI-generated lessons or voice features.
• Withdrawing all consent: Parents can request deletion of their account and all associated child data at any time. See our Data Retention Policy for the deletion process and timelines.
• To withdraw consent, parents may use the in-app controls or email us at info@wonderpath.co.uk.

6. Re-consent on policy changes

If we make a material change to our Terms, Privacy Policy or AI Safety Policy, we will:

• Notify the parent by email at least fourteen days before the change takes effect.
• Display a clear banner on the parent dashboard explaining the change.
• Where the change materially affects the processing of children's data or AI usage, require the parent to actively re-consent before the child can continue using the affected features.
• Record the new consent with the updated policy version number.

7. Children's understanding

While consent is obtained from the parent (not the child), we also take steps to ensure children understand what the platform does in age-appropriate language:

• The helper is a computer program and says so if a child asks. It is not a friend or companion.
• The helper explains, in simple language appropriate to the child's age, that a grown-up can see what they talk about.
• The platform does not ask children for personal information, and the AI is instructed to redirect any such disclosure.

8. Regulatory framework

This consent policy is designed to comply with:

• UK General Data Protection Regulation (UK GDPR), particularly Articles 6, 7, 8 and 35.
• Data Protection Act 2018, Section 9 (child's consent in relation to information society services).
• ICO Age Appropriate Design Code (the Children's Code), Standards 1 (Best interests), 2 (Data protection impact assessments), 4 (Transparency), 7 (Default settings) and 14 (Parental controls).
• ICO guidance on children's data and consent, including the requirement that consent for children's data must be verifiable and given by a person with parental responsibility.

9. Contact

For questions about consent, to withdraw consent or to request a copy of your consent records, please contact us at info@wonderpath.co.uk. You may also write to us at: Clove9, Office 128, 18 Young Street, Unit LGE, Edinburgh, EH2 4JB, Scotland, United Kingdom.