Build a reviewable privacy programme around children's data.

What ships in the product

An append-only consent ledger

• Every decision is a new immutable entry. Grants, rejections, and withdrawals each land as a fresh ledger row — database permissions prevent the application from editing or deleting past records.
• Withdrawal is symmetric. Withdrawing consent is just another entry, as easy as granting it — the current state is simply the latest decision on record.
• The notice itself is versioned evidence. The exact consent notice a guardian accepted is versioned and snapshotted with a cryptographic digest, so historical consent evidence stays independently verifiable — even after the wording changes.

What ships in the product

Classification-driven retention with auto-purge

• Every collection of data is classified. Each type of record in the platform carries a classification — personal, sensitive, or child data — and a defined retention window.
• Short-lived data purges itself. Operational data like notifications, messages, and consent links is automatically purged once its window passes.
• Conservative by design. Financial, academic, audit, and consent records are excluded from unattended purges and move through a governed retention or erasure review.

What ships in the product

Guardian-consent gates and reviewed data boundaries

• Guardian consent is captured at onboarding. The parent app opens with a guardian-consent gate, and the student app is limited to Class 5 and above — younger children are served through their parent's account.
• The whole student record is treated as child data. Student records are classified as children's data by default, with the stricter handling that classification carries everywhere in the platform.
• Student-AI health context has an explicit boundary. Current student-AI context excludes the named health, infirmary, wellbeing, and counselling sources. Every new integration still requires review.
• AI identifier safeguards are configured and auditable. The default router pattern-redacts common identifiers; names are tokenized when the calling flow supplies known values. Permissions remain the access boundary.

What ships in the product

An internal 72-hour evidence timer

• Reporting starts an internal timer. A recorded breach is stamped with an operational deadline 72 hours from discovery and tracked from open, through notified, to resolved.
• The timer is evidence, not legal advice. Overdue cases surface on the compliance dashboard, while the school and its advisers determine the required recipients, timing, content, and any extension.
• Follow-up can be routed. The breach event can create reviewed staff work or configured notification steps; provider acceptance and statutory completion remain separate evidence.

What ships in the product

Erasure that respects statutory retention

• Erasure redacts eligible fields in place. A student's name, contact details, and identifiers are redacted across supported records, while records held by configured retention rules remain restricted for review.
• Export on request. A supported data-export package can be prepared for an authorised request and reviewed before release.
• Corrections are a governed workflow. Students and parents file field-scoped correction requests that the school reviews and approves — the record changes through an audited path, not a phone call.