Guardian / Child Data Privacy & Consent Notice

Version: 2026-10-15-review-4 · Effective date: October 15, 2026

A consolidated convenience copy of the current published documents. Each document retains its own version and effective date. The versioned legal pages and archive remain authoritative.

On this page

Under-18 rule

Soteria requires guardian consent for consent-dependent processing of a Person’s data when that Person is under 18. Consent must be specific, explicit, recorded, versioned, withdrawable and auditable. An Organization must identify and verify the actual guardian relationship; Soteria never guesses it from a name, email, membership or free-form relationship label. Creating a managed Person, accepting Account Terms, or an administrator taking an ordinary action does not grant guardian consent.

What a specific grant must explain

A grant must identify the child, verified guardian, responsible Organization, purpose and necessary data categories. Community records can include contact/profile information, membership, attendance, activity, reservation details and photos, potentially revealing sensitive religious participation. Photos, public sharing and additional purposes require their own appropriate scope; no blanket permission is implied by this notice.

Verification and evidence

The intended direct flow is: the Organization identifies the guardian relationship; a secure request reaches the guardian; the guardian reviews the notice and purpose and explicitly grants consent; Soteria records the exact version, locale and time. That secure self-service verification/request flow is not yet implemented. Where self-service is impractical, an authorized Organization profile editor may explicitly record verified offline consent for an existing child. The record must identify child, guardian, Organization, relationship, purpose/data categories, actual grant time, exact notice version, locale, offline method, evidence reference and recording Account/time. It is labeled recorded offline evidence, not direct guardian Account acceptance. Do not supply identity scans unless there is a defined need and protection policy. A linked relationship record alone is not proof of guardianship.

Current enforcement and missing evidence

Managed-Person creation, import and ordinary profile operations do not require an in-app guardian-consent step or display consent controls. The responsible Organization must establish lawful processing authority and obtain any legally required guardian consent. Account Terms acceptance does not grant guardian consent. Where an invitation’s authorized scoped DOB identifies a Person under 18, ordinary self-service Account activation is held for verified guardian authorization; an Organization-profile consent grant is not reused as Account-registration authorization. Public signup currently collects no reliable age information, and a verified self-service guardian Account-onboarding flow is not yet available. Unknown age is unresolved, not assumed adult. Existing data is not automatically consented or purged, and withdrawal preserves historical evidence. Organizations must stop consent-dependent processing after withdrawal; absence of an application gate is not permission.

Withdrawal and requests

Contact the responsible Organization and [email protected] to withdraw a specific consent, correct information, request access/deletion where applicable or raise concerns. State the child, Organization and purpose without sending unnecessary sensitive documents. Withdrawal is recorded without erasing the evidence of the earlier grant and requires review of affected processing. It does not retrospectively undo lawful processing or instantly erase recovery copies.