Children's Privacy Notice

Short version (DRAFT — pending legal review; not yet in force)

• Children never hold a Kidbys account. A verified parent or guardian (the Agent) creates and controls a child profile.
• We ask for the parent's verified consent before a child can use their own Artist area, and before any of their art is shown publicly.
• Publicly, a child is shown only by a nickname and, where enabled, an age band such as "7–10". Never their real name, school, location or photo of their face unless the parent deliberately uploads one and it passes review.
• Children cannot message anyone, cannot buy or sell, and never see prices, buyers or other families' money. They can see their own Piggy Bank.
• Parents can review, download, correct and delete their child's data, and refuse further collection, at any time.
• There is a section for kids at the end.

Effective date: EFFECTIVE DATE

This notice explains how LEGAL ENTITY NAME ("Kidbys", "we") handles personal information about children. It adds to our main Privacy Policy. It is also our online notice under the US Children's Online Privacy Protection Act (COPPA), and it reflects the extra protection children's data receives under the EU and UK GDPR and the UK Age Appropriate Design Code.

Contact: [email protected], or LEGAL ENTITY NAME, REGISTERED ADDRESS. Urgent child-safety concerns: [email protected].

1. How children take part in Kidbys

A child on Kidbys is an Artist. An Artist is a profile inside a parent's account, not an account of its own:

• Only a verified adult Agent (a parent or legal guardian) can create a child profile.
• The Agent chooses the child's display name, uploads and publishes art, sets any sale terms, and controls everything public.
• The child can use a restricted Artist area on a device the Agent has set up, signing in with a picture code (a sequence of six pictures), not a password or email.

Child profiles are available for children aged MINIMUM ARTIST AGE to MAXIMUM ARTIST AGE, subject to the rules in the child's country.

2. What we collect about a child, and from whom

2.1 Provided by the parent (Agent)

2.2 Collected from the child in the Artist area

The child is never asked for their name, email, phone number, address, school, location, photos of themselves, or any free-text personal information. The Artist area has no chat, comments, friend requests or messaging, and no third-party advertising or analytics tools.

2.3 Created by Kidbys

Badges earned, Goal progress, the child's own Piggy Bank balance (Sparks and their share of print and sale earnings), moderation outcomes (shown only to the Agent), and the history of which Agent has had custody of the profile.

2.4 Joint liveness check

To stop fake families and AI-generated identities, the parent and child take part together in a short liveness check run by a specialist provider when the family is verified. The provider processes the check on its own systems. Kidbys receives only a pass or fail result, a reason category, the time and a reference number. We never receive or store the video or any biometric template, and we never reuse the check for anything else.

3. How we use children's information

We use it only to:

• run the child's profile and Artist area;
• show art publicly only after the parent has published it, our automated safety screening has passed it, and the parent has consented to public display;
• run sales and print orders the parent sets up (the child is never part of the transaction);
• keep the child's Piggy Bank, Goals and badges;
• keep the Service safe, including screening every upload and reviewing anything flagged or reported;
• meet our legal obligations, including reporting suspected child exploitation to the authorities.

We do not use children's information for advertising, behavioural profiling, public rankings or like counts, selling, or training AI models. We do not condition a child's participation on collecting more information than is reasonably needed.

4. Who can see a child's information

We do not disclose children's information to third parties for their own purposes. If we ever wanted to, we would ask for the parent's separate consent first.

5. Parental consent

Before a child can use the Artist area, and before any of their art can be published, the Agent must:

1. verify their own identity with our identity-verification provider;
2. complete the joint parent-and-child liveness check;
3. confirm that they are the child's parent or legal guardian, or otherwise have legal authority to act for them; and
4. give consent, on the child's behalf, to the collection and use described in this notice, including separately to public display of the child's art.

Full details are in our Parental Consent & Agent Verification statement.

6. Parents' rights

As the child's Agent you can, at any time and free of charge:

• review the information we hold about your child, by downloading a full export from Profile > Privacy & Data or by emailing [email protected];
• correct your child's display name or other details;
• withdraw consent to public display, which takes your child's art off public surfaces without deleting it;
• refuse further collection by revoking your child's device sign-in, resetting the picture code, or withdrawing consent, and we will stop collecting information from your child;
• delete your child's profile and all their art. Deletion follows the step-by-step process in our Privacy Policy and How to delete your account, with a 72-hour window to change your mind and completion within 30 days.

If another adult tells us they are the child's parent and asks us to act, we will verify their identity and authority before doing so.

7. How long we keep children's information

We keep children's information only as long as reasonably necessary for the purposes above, then delete it:

• Private drafts and published art: until the Agent deletes them or the profile.
• Uploads that never finish: deleted after 60 minutes. Uploads rejected or quarantined by moderation: deleted after 30 days unless held for a safety investigation.
• Child sign-in sessions: minutes, not days. Device credentials: until revoked or the profile is deleted.
• Legal name and date of birth (if ever collected): deleted when the profile is deleted.
• Financial records about sales and Sparks: kept as accounting records identifying an account number, never a child, for RETENTION — financial records.
• Custody history: kept as an opaque record with no name, image or contact detail.
• Material connected to a suspected child-safety crime: preserved only as long as the law requires.

This is our written data-retention policy for children's information.

8. Safety design choices

• No messaging, comments, friends or video for children. These features are not part of launch and stay switched off unless separate safety, legal and parental-control requirements are met in future, and then only if the parent turns them on.
• No public like counts, rankings, leaderboards or sales totals on anything a child or the open gallery can see.
• No advertising to children. A possible future brand feature (a curated toy shelf a child could only "wish" for, with the parent deciding everything) is switched off and will not be launched without legal review and an update to this notice.
• Every upload is screened before it can go public, location metadata is removed, and anything flagged or reported is reviewed by a person.
• High privacy by default: public display requires the parent's consent, and the child's profile is never searchable by real name.

9. COPPA direct notice to parents

This section is the notice we give parents before collecting personal information from a child under 13. We show it in the app during Agent verification and send a copy to the parent's email.

• What we have collected so far: your email address (when you created your Kidbys adult account), so that we can contact you and ask for your consent.
• Your consent is required before we collect, use or disclose personal information from your child.
• What we will collect from your child if you consent: private draft artwork your child uploads; a picture-code sign-in credential; a device credential and short-lived session data; and records of badges seen. We will also hold the information you provide about your child (display name, age band, artwork, and legal name and date of birth only if needed for verification).
• How we will use and disclose it: to run your child's Artist area and profile; to display art publicly only if you publish it and separately consent to public display; to keep the Service safe; and to meet legal obligations. We share it with service providers who help us run Kidbys, under contract, and with authorities where the law requires. We do not disclose it to third parties for their own purposes.
• How to consent: complete the verification steps in the app (identity verification, joint liveness check, authority attestation and consent).
• If you do not consent: if we do not receive your consent within COPPA CONSENT WINDOW — e.g. 14 days, we will delete your email address from our records for this purpose (your adult account itself remains unless you delete it), and no child profile will be activated.
• Your rights: you can review, delete, and refuse further collection of your child's information at any time, as described in Section 6.
• Full notice: this page, at kidbys.com/legal/children-privacy.
• Contact: LEGAL ENTITY NAME, REGISTERED ADDRESS, [email protected].

10. EU, EEA and UK

Under the GDPR and UK GDPR, children's data has specific protection even when a parent provides it. The legal basis for child profiles and public display is the consent of the holder of parental responsibility, which can be withdrawn at any time. We carry out a data protection impact assessment for processing involving children before launching in the EU or UK. You can complain to your local data protection authority.

11. For kids: how Kidbys looks after your information

This part is written for you, the artist. Ask a grown-up to read it with you if you like.

Hi! This is how we keep your information safe.

• Your grown-up is in charge. A parent or guardian set up your Kidbys profile. They decide what gets shared, and they can see what you do in your Artist area.
• Your drawings start private. When you add a drawing, only you and your grown-up can see it. Your grown-up decides if it goes in the gallery.
• We keep your real name secret. In the gallery people only see the nickname your grown-up picked, and maybe your age group. Never your real name, your school, or where you live.
• We check everything first. Before any picture goes in the gallery, our safety tools look at it, and a real person checks anything that looks wrong.
• No chatting with strangers. Nobody on Kidbys can send you messages, and you can't send messages either. That keeps you safe.
• Your picture code is your secret. Don't share your six-picture code with anyone except your grown-up.
• No sales stuff for you. Grown-ups handle prices and selling. You can see your own Piggy Bank and your own Goals.
• If something feels wrong, tell a grown-up. If you see anything on Kidbys that makes you feel worried or upset, tell your parent, guardian or a teacher straight away. They can tell us at [email protected].
• You can ask for things to be deleted. If you want a drawing or your whole profile removed, ask your grown-up. They can delete it.

12. Changes

If we change how we handle children's information in a material way, we will tell Agents first and, where required, ask for fresh consent before the change applies to their child.