Consent is the gate, not a footnote — the strongest posture for the youngest children
For a preschooler, a parent or legal guardian is the only one who can consent to a portrait being taken, shared, or printed. Consent is collected before picture day, is off by default, is opt-in per child, and can be withdrawn at any time with immediate removal from every shared view — not at the next processing cycle, at the moment the withdrawal is recorded. A child whose family did not opt in is excluded from every shared gallery, directory page, and composite; they simply do not appear, rather than appearing with their consent status guessed at.
Galleries are never public and never indexed by a search engine. A guardian reaches only their own child’s portraits, through a private link scoped to that family. Finding a child uses a roster lookup — name and class — never a face match, and that standard path computes no biometric template. Photos and any face data are never sent to an outside AI or photo company; editing and storage run on our own private system, not a vendor’s shared environment. If any face-data feature is ever enabled by a guardian, it is held only inside our own system on a bounded window of roughly 365 days, never framed as permanently retained and never framed as "no retention" — the honest middle is a stated window, not an absence of one.
Photos are never sold. The center or school stays in control of the roster and the consent record throughout — this platform reads from that record, it does not replace the center’s authority over it.
The privacy posture, by architecture
These are not policy paragraphs that could be quietly updated later. They are how the pipeline is built.
Face matching is not wired in this product
Face matching is a capability we are building and is not turned on today — the recognizer is not yet wired: it holds no face-recognition model weights, and no face template is computed from a photo. Photo finding uses a permission-checked roster lookup instead. A parent reviewing the opt-in sees an opaque reference, never the template itself. Withdrawing the opt-in stops the matching.
One thing we will not overstate
The step that destroys the stored template is not finished, and we are not going to tell a parent it runs nightly when it does not. The cleanup job is built to refuse: when it cannot actually destroy a template, it halts and raises an alert rather than mark it deleted. We would rather leave that alert standing than record a deletion we cannot show you. When it can be demonstrated end to end, this page will say so plainly.
No outside AI or photo company
Photos and any face data run on our own private system. A portrait is never routed to a third-party AI service, an ad network, or a general-purpose outside photo lab’s storage. Editing and storage stay with us.
Per-center tenant isolation
A center’s roster, photos, and consent records are never visible to another center’s session. This is enforced at the data layer, forming a single-center FERPA-style privacy wall, not a convention a route could forget to apply.
Scoped staff roles
Center staff see only what their role permits — a front-desk view of the roster is not the same as a full consent-and-order view. Access is scoped, not all-or-nothing.