Children's Online Privacy Protection Act compliance for US users and services handling children's data (under 13).
Last updated: August 5, 2026 · Effective: August 5, 2026
1. Overview
This disclosure supplements our Privacy Policy for users and organizations subject to COPPA, which protects children under 13 in the United States. Key Principle: Tuteliq does NOT directly collect data from children. We process content that may contain children's personal information, but we delete that information immediately after processing. We never retain, back up, or use child data for any purpose beyond the immediate detection request.
2. What We Do (and Don't Do) with Children's Data
2.1 Tuteliq's Zero-Storage Model for Child Data
When a customer (school, platform, parent, or organization) submits content containing child information:
Step
What Happens
Child Data Stored?
1. Submission
Customer sends content (text, image, audio, video) containing child data via API
2. Processing
Tuteliq analyzes content in real-time for threats (grooming, exploitation, abuse)
3. Detection
System generates encrypted incident report with detection results
4. Encryption
Report encrypted with customer's private key
5. Return
Incident sent to customer
6. Deletion
Original child content deleted immediately
Result: Zero retention of child personal information.
2.2 What We Absolutely Do NOT Do
- Store children's personal information (names, ages, identifiers, content)
- Retain child data for any period (not even temporarily)
- Back up child data
- Use child data for training, analytics, or profiling
- Create profiles of children
- Track children across services
- Share child data with third parties
- Sell or use child data for marketing
- Build databases of child information
- Use child data for any purpose other than immediate threat detection
2.3 What Happens to Incidents
When we detect a threat involving a child:
- Incident Report Generated: Encrypted summary of the threat (type, severity, confidence)
- Encryption: Report encrypted with your (the customer's) private key
- You Receive It: Report returned to you only; Tuteliq doesn't store it
- You Manage It: You decide what action to take (delete, flag, report to authorities)
- Original Content: Deleted from Tuteliq systems (we have no copies)
Critical point: We send you the detection result, not the original content. You manage the incident; we don't store anything.
3. COPPA Compliance Details
3.1 Parental Consent Requirements
Before you submit any child data to Tuteliq, you must:
- Obtain verifiable parental consent (for children under 13)
- Explain to parents that Tuteliq will analyze their child's content
- Explain that Tuteliq deletes the content immediately
- Explain that detection results are encrypted and returned to you
- Provide your privacy policy to parents (not just ours)
- Inform parents of their rights (access, deletion)
You are responsible for: Obtaining parental consent. Tuteliq is a processor, you (the customer) are responsible for compliance with COPPA.
3.2 What Qualifies as Verifiable Parental Consent
COPPA allows several methods:
- Email with Signature: Parent's email reply confirming consent
- Signed Form: Physical or digital form with parent signature
- Credit Card Verification: Parent uses valid credit card (implies adult)
- Government ID Check: Verify parent identity via ID
- Oral Consent: Phone call to parent (you record, maintain records)
- Digital Signature: E-signature platform (DocuSign, etc.)
Tuteliq's role: We don't collect parental consent. You must obtain it before submitting child data.
3.3 Data Collection Disclosure
You must tell parents:
- What: "We use Tuteliq to analyze content for threats (grooming, abuse, bullying, etc.)"
- How: "We submit content to Tuteliq's AI detection system"
- What happens: Tuteliq analyzes the content immediately, deletes the original content right after analysis, and returns only detection results (encrypted); we manage the results and decide what action to take
- Data retention: "Tuteliq retains zero child data. We keep incidents, but Tuteliq doesn't store them."
3.4 Parental Access and Deletion Rights
You must provide parents with:
Right to Know: What child data you submitted to Tuteliq, what threats were detected, what action you took.
Right to Delete: Parents can request you delete their child's incident records; you handle deletion (we don't store child data to delete); confirmation provided within 30 days.
Right to Opt-Out: Parents can opt out of Tuteliq analysis for their child; you stop submitting that child's content.
You provide these rights: Tuteliq doesn't interact with parents, you do.
4. Data Handling Requirements
4.1 What You Must Ensure
When using Tuteliq to analyze child data:
Before submission:
- Obtain parental consent for each child under 13
- Provide notice to parents about Tuteliq
- Have parents agree to your processing of child data
- Document consent (keep records)
During use:
- Only submit content necessary for threat detection
- Use Tuteliq only as authorized by parents
- Don't overuse or misuse the service
- Maintain your incident records securely
After detection:
- Take appropriate action based on detected threats
- Respond to parental requests promptly
- Delete incidents when requested
- Report serious threats to authorities
4.2 Your Responsibility vs. Tuteliq's
Responsibility
You (Customer)
Tuteliq
Obtain parental consent
Inform parents
Store incidents
Yes (encrypted)
Manage incidents
Delete child data
Yes (on request)
Yes (automatically, immediately)
Respond to parents
Report threats to authorities
5. Special Protections for Child Data
5.1 Age-Gating
You must:
- Verify child's age before collection
- Limit collection to what's necessary
- Don't ask for unnecessary information
- Minimize child data exposure
Tuteliq's role: We process whatever you submit, then delete it. We don't verify age. You do.
5.2 No Direct Marketing to Children
You must NOT use Tuteliq data to:
- Market to children
- Create targeted ads for children
- Profile children for commercial purposes
- Sell child data or insights
You may use Tuteliq to:
- Detect threats
- Protect safety
- Enforce terms of service
- Comply with law
5.3 Security and Encryption
Tuteliq protects child data while processing:
- Encrypted in transit (TLS 1.2+)
- Real-time processing (milliseconds)
- Immediate deletion
- No backups (child data never enters backup systems)
- No third-party access
- Incident encryption (only you can decrypt)
6. Breach Notification for Child Data
6.1 If a Security Breach Occurs
Likelihood: Extremely low (we don't store child data, so there's nothing to breach).
If a breach affecting child data does occur:
- Tuteliq notifies you: Within 24 hours
- You notify parents: Within 30 days (FTC requirement)
- You provide details: Nature of breach, types of child data affected, likely consequences, mitigation measures
Since Tuteliq deletes child data immediately, most breaches would only affect encrypted incident reports (which only you can decrypt).
6.2 Your Obligation to Parents
You must notify parents if their child's data was breached, the breach involved threats or safety concerns, or action is needed on their part.
7. Retention and Deletion
7.1 Tuteliq's Deletion Policy
Child data retention by Tuteliq: ZERO DAYS.
Data
Retention
Notes
Original child content
Immediate deletion (milliseconds)
Never stored
Processing logs
Deleted after 24 hours
No child data in logs
Incident reports
Not stored by Tuteliq
You store them (encrypted)
Backups
No child data
Child data never enters backups
Analytics
No profiling of children
7.2 Your Deletion Obligation
You must delete child incident records:
- Within 30 days of parental deletion request
- Within 90 days of account termination (for child data)
- Immediately upon parent opt-out
- Provide confirmation to parent
8. Contact for COPPA Issues
8.1 Tuteliq Support
Privacy/COPPA questions: dpo@tuteliq.ai, response within 10 business days. Emergency (potential child safety threat): legal@tuteliq.ai (mark "URGENT"). Phone available upon request for emergency situations.
8.2 FTC Contact (for COPPA Complaints)
Federal Trade Commission: ftc.gov/coppa · coppa@ftc.gov · (202) 326-2222 · FTC, 600 Pennsylvania Ave NW, Washington, DC 20580.
9. Summary
Tuteliq's COPPA commitment:
- We do NOT store children's personal information
- We do NOT collect data directly from children
- We delete child content immediately after processing
- We return only encrypted detection results (you manage them)
- We cannot decrypt or access your incidents
- We provide no child data to third parties
- We don't use child data for marketing or profiling
Your COPPA responsibilities:
- Obtain verifiable parental consent
- Provide privacy notice to parents
- Honor parental access and deletion requests
- Manage incident records responsibly
- Report safety threats to authorities
- Maintain consent records
Together: Tuteliq provides immediate threat detection; you manage compliance and parental relationships.
Document Version: 1.0 · Last Updated: August 5, 2026 · Next Review: August 5, 2027
For COPPA-related questions, contact dpo@tuteliq.ai. This document is for informational purposes and does not constitute legal advice. Consult legal counsel for guidance specific to your situation. See also our California Privacy Notice.