Verifiable Parental Consent Policy

How we make sure a parent or guardian, and only a parent or guardian, gives consent for a child.

Effective date and version: September 20, 2026 (Version 1.0). This document is available in English only and forms part of, and shall be read together with, the Terms of Service and the Privacy Policy.

1. Purpose

1.1 This Policy describes how Khypri AI (the “Company”) obtains and records the consent of a parent or lawful guardian for the processing of a child’s Personal Data, and expands Section 9.1 of the Privacy Policy. Section 9 of the Digital Personal Data Protection Act, 2023 requires the verifiable consent of the parent or lawful guardian before the Personal Data of a child is processed.

2. Adult-Only Registration

2.1 Only an adult parent or legal guardian may register an Account. A child cannot register or create an Account. The username and password that a child uses to sign in are created by the Account Holder. Every Student profile is created and managed by the Account Holder.

2.2 Registration proceeds as follows:

  1. the Account Holder gives a date of birth and declares that they are at least eighteen (18) years of age (this declaration is recorded as a required consent);
  2. an age check is carried out on the Account Holder’s own device, using the device camera and, for some users, a date of birth read from an identity document image that the user chooses to provide. The camera image and the document image are not uploaded to the Company’s servers and are not stored; only the outcome is used;
  3. the Account Holder’s email address and mobile number are verified by one-time passcodes (the mobile passcode is sent by WhatsApp).

2.3 A Student profile can be added only after the Account Holder’s own profile is complete. No Student profile can exist without a verified Account Holder behind it.

3. Recording Consent and Immutable Audit Trail

3.1 Required and optional consents are presented to the Account Holder in the Platform in clear, plain language alongside links to the Terms of Service, Privacy Policy, and Data Principal Notice. In strict compliance with Section 9 of the Digital Personal Data Protection Act, 2023, each consent given, modified, or withdrawn is recorded as an immutable digital audit log containing the exact verification timestamp, one-time passcode (OTP) validation token, cryptographic SHA-256 hash of the displayed notice version, and the verified Account Holder ID for statutory audit compliance.

3.2 No processing of a child’s Personal Data takes place if consent to analyze the child’s academic telemetry has not been explicitly granted.

4. Managing and Withdrawing Consent

4.1 The Account Holder can review the consents given for themselves and for each child in the Platform’s profile settings. Optional consents can be switched on or off at any time. Required consents remain in place while the Account exists and are shown as locked, because they are necessary to operate the service and to keep the child safe; they are withdrawn by deleting the Account, as described in the Data Retention and Erasure Policy.

5. Concerns About Consent

5.1 A person who believes that an Account or a Student profile was created without the consent of the child’s parent or guardian, or by someone under eighteen, should write to dpo@khypri.com. The Company may suspend the Account while it investigates, and shall delete Personal Data collected without valid consent.

5.2 The Company keeps its method of verification under review as the rules made under the Act develop, and may add further verification steps.

Select Language