Guardian / Child Data Privacy & Consent Notice

Version: 2026-11-05-centralized-6 · Effective date: November 5, 2026

A consolidated convenience copy of the current published documents. Each document retains its own version and effective date. The versioned legal pages and archive remain authoritative.

On this page

Who is responsible

Soteria is operated by Daniel Ashraf Ekdawi in Cairo, Egypt. Privacy contact: [email protected]. Legal/contact address: 1 Amin Al Shamsi Basha Street, Hegaz Square, Heliopolis, Cairo, Egypt. An Organization determines the purposes and authorized participants for its community activities; Soteria processes its directed records and separately operates its Account/security functions as described in the Privacy Notice. Each remains responsible for its own legal duties. This notice explains child-data safeguards and limitations. Reading it, creating a managed Person, joining a community or accepting Account/Organization terms does not grant guardian consent or prove lawful authority. Arabic is the primary maintained text, with equivalent English. No regulatory licence, approved consent mechanism or verified guardian status is asserted merely by publishing it.

Age and guardian authority

Soteria's product rule requires specific guardian consent for consent-dependent processing of a Person's data while under 18. That rule is not a legal finding of contractual capacity or a substitute for the applicable law's age distinctions, required written consent or regulator-approved mechanisms. Religious information and children's personal data require special protection; required permissions and lawful authority must be established before processing, not inferred from a software setting. The actual legal guardian and their authority must be verified proportionately. Being a parent contact, teacher, servant, manager or profile relation does not by itself prove authority to consent. Soteria does not infer it from a matching name, email, membership or free-form label. Organizations must resolve doubtful or disputed authority through a protected process and must not upload unnecessary identity documents into ordinary profiles or email. Current age classification uses valid birth dates visible within the authorized profile ancestry and Cairo's calendar date. Unknown, malformed or conflicting dates are not proof of adulthood or permission to process; another Organization's private birth date must not be consulted merely to resolve uncertainty. Turning 18 is not an automatic determination of civil capacity or blanket permission for new purposes. Egyptian Executive Regulations Article 15 distinguishes under-15s, whose explicit written guardian permission must precede collection and specify duration, from ages 15–under 18, for whom its Arabic text calls for the guardian’s consent submitted by the child or guardian through the prescribed mechanism. Soteria keeps a guardian-involved under-18 rule and does not treat the less strict wording in some English guidance as permission to bypass that process.

Information and choices a request must explain

Before consent-dependent processing, the responsible Organization must identify the child, verified guardian, responsible operator/Organization, specific purpose and necessary data categories, intended recipients or public sharing, relevant international processing, duration or expiry/review point, consequences of refusing and how to withdraw. The person consenting must receive clear, understandable information and genuinely choose; silence, preselected controls or an administrator's ordinary action are not consent. Community records may include identity/contact details, birth dates, relationships, membership, attendance and activities, assignment/check-in responses, photos/files, reservation information and locations where enabled. These can reveal religious participation or other sensitive information. The actual request must identify the necessary subset; this list is not permission to collect every category. A child's participation must not depend on providing more information than necessary. Public photos, sharing beyond the intended recipients, optional location, marketing or submitting identifiable child content to an AI service require a separately assessed lawful purpose and appropriate specific permission; an Organization-profile grant is not a blanket grant for those uses. Optional uses must not be bundled into required service terms or community membership. Recipients, destinations and retention follow the relevant Privacy Notice and provider disclosures, without assuming all required permits exist.

What the current recordkeeping supports

Authorized Organization users may record independently verified written consent from the actual legal guardian, including a guardian who has no Soteria Person or Account. The recorder identifies whether they are the guardian or are recording consent obtained from that guardian; collecting evidence does not confer guardianship. The record preserves identity/contact and claimed authority, verification method and protected references, purposes/categories, recipients, exact notice version and language, actual consent date, expiry, recorder/time and withdrawal. Historical review remains restricted to Super Admin reviewers. Rejected, withdrawn or expired evidence authorizes nothing. A restricted historical-review path can reference the actual earlier published notice, retain the original document reference, grant time, scope, method, review reason and accepted/rejected decision separately from recording time. The grant cannot predate that actual notice. A rejected review authorizes nothing. A restricted historical review may also retain an external original notice by its title, version, effective date and protected document reference. The actual grant date and original scope stay separate from the later review/recording date; the evidence is not relabelled as acceptance of a Soteria notice. Ordinary editors cannot backdate or broaden permission. Expiry and withdrawal exclude a grant from active evidence and stop Account access where activation relies on that grant. Historical wording and original evidence remain immutable. This Organization-mediated evidence workflow does not authenticate an external document by its reference alone, supply a regulatory permission or establish comprehensive downstream enforcement.

Current safeguards and important gaps

Public signup uses a self-reported age band for Account eligibility, not a profile birth date. An under-15 applicant can begin registration, but the Account remains pending and cannot log in. The responsible Organization must obtain the actual guardian’s written consent externally, verify their legal authority and record evidence specific to the Account request before activation. A guardian needs no Account, and an arbitrary email or OTP click is not proof of guardianship. The same rule applies to an existing invited managed Person and a newly registered Person. An unassigned request must be linked through a recipient-bound Organization invitation. Ages 15–17 and uncertain/conflicting age still require review; neither an age declaration nor a profile-purpose grant establishes contractual capacity or Account authority. Routine Organization administration uses authorized roles, feature policies and the Organization’s documented processing responsibilities. Registration, joining an Organization and creating an Organization are the main legal checkpoints. Creating a managed profile, importing people, recording attendance, administering assignments, booking, scoring, reporting or sending service notifications does not require a new per-person or per-file Super Admin approval. A legacy record or continued access is not documented consent or proof of adulthood. Organizations must still establish the lawful basis and additional conditions actually required for sensitive information and children. Recorded privacy restrictions, actual consent withdrawal or expiry, guardian Account conditions and legal holds continue to apply to their scope and purpose. Optional public photo disclosure and precise-location uses require specific authority for the intended purpose and recipients. A restriction affecting one person does not automatically stop unrelated people’s administration. Reports identify restricted coverage; an ordinary export cannot silently present omitted records as complete. Privacy-rights returns, cancellation and refunds retain their separate protected processes. AI-assisted import sends the selected file and relevant field context to OpenAI only after review of that Organization’s processing authority, provider and transfer arrangements. That Organization/provider authorization is reusable within its documented scope; a file-bound historical review is not expanded automatically. Private file upload and local confirmation do not send data to OpenAI. Address parsing runs locally and does not need an external AI-provider approval. These safeguards do not replace legally required consent, permits, contractual arrangements or professional review. Soteria prohibits using children’s data obtained for games, competitions or other activities for the classification/profiling, tracking or behavioural monitoring prohibited by Executive Regulations Article 14(5). Guardian permission cannot authorize a prohibited use. Necessary participation administration must be assessed separately; this is not a determination that all attendance or points are prohibited. Feature-specific assessment and effective restrictions remain required before affected use.

Refusal, withdrawal and changes

Contact the responsible Organization and [email protected] to refuse or withdraw a specific consent, change its scope or raise a concern. Identify the child, Organization and purpose with safe references. You do not need an Account or new terms acceptance merely to contact us. We verify identity/authority proportionately and coordinate with the responsible Organization without silently restarting an applicable response deadline. Withdrawal ends authorization for future processing that depends on that consent; it does not retrospectively invalidate lawful earlier processing or erase evidence of the grant. We and the Organization must identify affected purposes and recipients, stop or restrict the relevant future processing, and assess retention, erasure and onward/offline copies under applicable law. Recording a withdrawal timestamp alone does not perform those actions. The targeted operational checks described above stop affected operations when current evidence is inactive or a scoped restriction applies. This does not recall delivered messages, erase recipient devices, or complete all remaining read, recipient and external-copy handling. The responsible operator and Organization must finish and record that follow-up. A materially changed purpose, recipient use or scope needs new appropriate authority/consent before that processing, rather than silently upgrading an old grant. Consent duration and any transition to the individual's own valid choice must be reviewed when age or circumstances change. Keeping compatible notice wording does not authorize a new purpose or extend a time-limited consent.

Access, correction, deletion and complaints

The child and verified guardian may raise applicable information, access, correction, restriction, objection, portability and erasure requests through the Organization or [email protected]. A request does not itself prove guardianship or entitle someone to every private record; protect the child's interests and other people's rights when verifying and responding. For Egyptian personal-data rights requests, the response commitment is six working days from submission. Verification or internal coordination must not silently reset that clock. Mandatory rights and legal remedies remain available, including a complaint to the Egyptian Personal Data Protection Center (PDPC), without first obtaining our permission or purchasing anything. Withdrawal, leaving a community, closing an Account and data deletion are different actions. Necessary lawful evidence and recovery copies may remain restricted rather than disappearing instantly. Authorized exports, public copies and disconnected devices may retain information outside direct server control. Approved deletion/restriction decisions must be accounted for before restored data returns to ordinary use; neither this notice nor an archive button certifies erasure everywhere.

Getting help safely

For privacy or guardian concerns, contact Daniel Ashraf Ekdawi at [email protected]; general support is available at [email protected] or +20 120 769 6771. State the relevant Organization and safe reference, without passwords, recovery codes, payment secrets or unnecessary scans. If documentation is genuinely needed, agree a protected channel and minimal scope first. This notice describes current behavior and required safeguards honestly; it is not a child-consent form, proof of a legal basis, regulatory approval or a completed safeguarding assessment. The Privacy Notice explains broader processing and retention, the provider supplement explains recipients and locations, and the Organization DPA explains directed processing. Prior published versions and recorded evidence remain accessible to authorized review without rewriting what was previously stated or granted.