DRAFT prepared for legal review, not a policy.

# COPPA summary (draft)

Prepared 2026-09-19 for review by counsel. Nothing here is legal advice, and
nothing here binds Limud until counsel has approved it. The binding document
today is the children's privacy page at https://limud.co/children-privacy.

## 1. How consent is obtained

Where Limud is used by a school, the school provides consent on behalf of
parents for the collection of personal information from students under 13, for
the educational purpose the school has authorised. Limud does not collect such
information directly from a child for any commercial purpose.

For the individual learner and family products, an adult creates and pays for
the account and is the account holder.

## 2. What is collected from a child

- Name and school email, or a pseudonymous display name in an accountless live
  session.
- Work the child submits: typed answers, uploaded photographs of written work,
  and audio recordings of spoken answers.
- Messages the child sends to the AI tutor.
- An optional interests survey the child may leave blank.
- Timing signals: when a material was opened, closed, and which sections were on
  screen. No keystrokes and no mouse movement.

## 3. What is not done

- No behavioural advertising. Limud shows no advertising of any kind.
- No sale of personal information.
- No use of a child's content to train a third-party model. The relevant vendor
  terms are named in the subprocessor draft in this packet.
- No public profile, no social feed, no child-to-child messaging outside a
  teacher-created classroom.

## 4. Parental rights

A parent may, through the school where the account is a school account and
directly where it is a family account:

- review the personal information held about their child,
- request its deletion,
- refuse further collection by ending the account.

## 5. Data minimisation in the product

- Accountless live sessions collect no roster identifier at all, and their data
  is deleted after 7 days.
- The interests survey is optional and the product works without it.
- A teacher's free-text notes and a parent's messages are excluded by design
  from the signals that shape a personalised version.

## 6. Open items for counsel

1. Confirm the school-consent route for each jurisdiction we sell into, and
   whether a direct-notice-plus-verifiable-consent flow is needed for the family
   product as it currently stands.
2. Confirm the retention periods below against the COPPA minimisation
   requirement: live sessions 7 days, lapsed individual learner 90 days,
   wellbeing notes 45 days or 14 days after resolution.
3. Confirm the wording of the audio and photograph disclosure, since a voice
   recording is personal information in its own right.