Guardian / Child Data Privacy & Consent Notice

Version: 2026-10-29-guardian-1 · Effective date: October 29, 2026

A consolidated convenience copy of the current published documents. Each document retains its own version and effective date. The versioned legal pages and archive remain authoritative.

On this page

Who is responsible

Soteria is operated by Daniel Ashraf Ekdawi in Cairo, Egypt. Privacy contact: [email protected]. Legal/contact address: 1 Amin Al Shamsi Basha Street, Hegaz Square, Heliopolis, Cairo, Egypt. An Organization determines the purposes and authorized participants for its community activities; Soteria processes its directed records and separately operates its Account/security functions as described in the Privacy Notice. Each remains responsible for its own legal duties. This notice explains child-data safeguards and limitations. Reading it, creating a managed Person, joining a community or accepting Account/Organization terms does not grant guardian consent or prove lawful authority. Arabic is the primary maintained text, with equivalent English. No regulatory licence, approved consent mechanism or verified guardian status is asserted merely by publishing it.

Age and guardian authority

Soteria's product rule requires specific guardian consent for consent-dependent processing of a Person's data while under 18. That rule is not a legal finding of contractual capacity or a substitute for the applicable law's age distinctions, required written consent or regulator-approved mechanisms. Religious information and children's personal data require special protection; required permissions and lawful authority must be established before processing, not inferred from a software setting. The actual legal guardian and their authority must be verified proportionately. Being a parent contact, teacher, servant, manager or profile relation does not by itself prove authority to consent. Soteria does not infer it from a matching name, email, membership or free-form label. Organizations must resolve doubtful or disputed authority through a protected process and must not upload unnecessary identity documents into ordinary profiles or email. Current age classification uses valid birth dates visible within the authorized profile ancestry and Cairo's calendar date. Unknown, malformed or conflicting dates are not proof of adulthood or permission to process; another Organization's private birth date must not be consulted merely to resolve uncertainty. Turning 18 is not an automatic determination of civil capacity or blanket permission for new purposes.

Information and choices a request must explain

Before consent-dependent processing, the responsible Organization must identify the child, verified guardian, responsible operator/Organization, specific purpose and necessary data categories, intended recipients or public sharing, relevant international processing, duration or expiry/review point, consequences of refusing and how to withdraw. The person consenting must receive clear, understandable information and genuinely choose; silence, preselected controls or an administrator's ordinary action are not consent. Community records may include identity/contact details, birth dates, relationships, membership, attendance and activities, assignment/check-in responses, photos/files, reservation information and locations where enabled. These can reveal religious participation or other sensitive information. The actual request must identify the necessary subset; this list is not permission to collect every category. A child's participation must not depend on providing more information than necessary. Public photos, sharing beyond the intended recipients, optional location, marketing or submitting identifiable child content to an AI service require a separately assessed lawful purpose and appropriate specific permission; an Organization-profile grant is not a blanket grant for those uses. Optional uses must not be bundled into required service terms or community membership. Recipients, destinations and retention follow the relevant Privacy Notice and provider disclosures, without assuming all required permits exist.

What the current recordkeeping supports

The intended direct process is for the Organization to verify guardian authority, send a secure purpose-specific request, let the guardian review the information and make an explicit choice, and retain the exact evidence. That verified self-service guardian request/Account-onboarding flow is not currently implemented. A staff member's ability to record evidence is not the ability to grant consent for a guardian. An authorized Organization profile editor can explicitly record verified offline evidence for an existing child through the dedicated evidence API. The record identifies child, guardian, Organization, explicitly stated relationship, purpose/data categories, actual grant date, notice version, language, source, signed-written or verified-written-electronic method, restricted evidence reference and recording Account/time. Both people must belong to the Organization; a supplied linked relationship must match them. The entry is labelled recorded offline evidence, not direct guardian Account acceptance or independent verification by Soteria. The current API validates the exact current notice version and does not accept an actual grant date earlier than that notice's effective instant. Do not invent a later grant date or relabel an old signature as a new grant to fit the API. Existing evidence remains with its original version and scope; historical or disputed evidence needs an authorized review. This explanatory notice update does not enlarge a recorded grant or silently create a new one.

Current safeguards and important gaps

Managed-Person creation, imports and ordinary profile operations do not require an in-app guardian-consent step and do not display evidence controls. That absence is not legal clearance. The Organization must establish the necessary lawful authority and consent; Soteria retains its own duties. Do not start or continue prohibited or unauthorized processing merely because an operation is technically possible. When an invitation's authorized scoped birth date identifies a Person under 18, ordinary self-service Account activation is held for verified guardian authorization. An Organization-profile grant is not reused as Account-registration authorization. Public signup currently collects no reliable age information; unknown age is unresolved, and a verified self-service guardian Account-onboarding route remains unavailable. There is no comprehensive automatic enforcement across attendance, events, reservations, assignments/check-ins, photos, location, relationships, notifications, exports, AI and offline replay. Current evidence does not provide a complete automated consent-expiry, duration or age-transition renewal system. These require actual review and controls, not an assumption that a “recorded” status approves every purpose.

Refusal, withdrawal and changes

Contact the responsible Organization and [email protected] to refuse or withdraw a specific consent, change its scope or raise a concern. Identify the child, Organization and purpose with safe references. You do not need an Account or new terms acceptance merely to contact us. We verify identity/authority proportionately and coordinate with the responsible Organization without silently restarting an applicable response deadline. Withdrawal ends authorization for future processing that depends on that consent; it does not retrospectively invalidate lawful earlier processing or erase evidence of the grant. We and the Organization must identify affected purposes and recipients, stop or restrict the relevant future processing, and assess retention, erasure and onward/offline copies under applicable law. Recording a withdrawal timestamp alone does not perform those actions. Ordinary managed-profile operations are not automatically blocked by withdrawal in the current application. A materially changed purpose, recipient use or scope needs new appropriate authority/consent before that processing, rather than silently upgrading an old grant. Consent duration and any transition to the individual's own valid choice must be reviewed when age or circumstances change. Keeping compatible notice wording does not authorize a new purpose or extend a time-limited consent.

Access, correction, deletion and complaints

The child and verified guardian may raise applicable information, access, correction, restriction, objection, portability and erasure requests through the Organization or [email protected]. A request does not itself prove guardianship or entitle someone to every private record; protect the child's interests and other people's rights when verifying and responding. For Egyptian personal-data rights requests, the response commitment is six working days from submission. Verification or internal coordination must not silently reset that clock. Mandatory rights and legal remedies remain available, including a complaint to the Egyptian Personal Data Protection Center (PDPC), without first obtaining our permission or purchasing anything. Withdrawal, leaving a community, closing an Account and data deletion are different actions. Necessary lawful evidence and recovery copies may remain restricted rather than disappearing instantly. Authorized exports, public copies and disconnected devices may retain information outside direct server control. Approved deletion/restriction decisions must be accounted for before restored data returns to ordinary use; neither this notice nor an archive button certifies erasure everywhere.

Getting help safely

For privacy or guardian concerns, contact Daniel Ashraf Ekdawi at [email protected]; general support is available at [email protected] or +20 120 769 6771. State the relevant Organization and safe reference, without passwords, recovery codes, payment secrets or unnecessary scans. If documentation is genuinely needed, agree a protected channel and minimal scope first. This notice describes current behavior and required safeguards honestly; it is not a child-consent form, proof of a legal basis, regulatory approval or a completed safeguarding assessment. The Privacy Notice explains broader processing and retention, the provider supplement explains recipients and locations, and the Organization DPA explains directed processing. Prior published versions and recorded evidence remain accessible to authorized review without rewriting what was previously stated or granted.