Safeguarding Policy

WonderPath ("we", "us", "our") is an AI-powered learning platform designed for children aged four to eleven. It is operated by Clove9, whose business address is Office 128, 18 Young Street, Unit LGE, Edinburgh, EH2 4JB, Scotland, United Kingdom. The safety of every child who uses our platform is our highest priority. This policy sets out the measures we take to safeguard children, the responsibilities of parents and staff, and the procedures we follow if a concern arises.

1. Our commitment to child safety

We believe that every child has the right to learn in an environment that is safe, supportive and free from harm. We are committed to:

Designing the platform with child safety as the default, not an afterthought.
Following the principles of the Information Commissioner's Office Age Appropriate Design Code (the Children's Code).
Designing to the Department for Education's product safety standards for generative AI (updated January 2026) and to Ofcom's published guidance. WonderPath has no sharing between users, which places the helper outside the Online Safety Act 2023 today; we will meet any chatbot rules for under-18s when they are made, and we build them in now.
Applying the "best interests of the child" principle in every product decision.
Maintaining a zero-tolerance approach to any form of child exploitation, abuse or inappropriate content.

2. Online safety measures

Content moderation

All AI-generated content passes through a multi-stage moderation pipeline before it is shown to a child: pre-input filtering of the child's messages, system-level safety prompts, post-output moderation of AI replies, and full conversation logging.
Blocked topic categories include sexual content, violence, self-harm, drugs, weapons, extremism, profanity and any content not suitable for primary-school-aged children.
Content is filtered using a combination of keyword and regex pattern matching, AI-based classifiers and severity-level scoring. For full details, see our AI Safety Policy.

AI safety

The AI tutor operates under strict system prompts that constrain its behaviour to age-appropriate educational interactions.
The AI cannot generate, store or display images of children.
The AI is instructed never to ask a child for personal information such as their surname, address, school name or telephone number.
Parents may disable all AI features on a per-child basis from the parent dashboard at any time.
All AI conversations are stored privately and are fully visible to the parent for review.

Platform design

The platform does not use autoplay, infinite scroll, countdowns or loss messages. Children earn badges and see a streak; a missed day never costs them anything and no message pressures them to return.
No advertising of any kind is shown to children.
No in-app purchases are available to children. All billing is handled through the parent account.

3. Grooming prevention

WonderPath is designed from the ground up to eliminate the risk of grooming and inappropriate contact with children:

No social features. There is no child-to-child messaging, commenting, following, friending or any form of social networking.
No user-to-user interaction. Children cannot communicate with any other user of the platform. The only interactive element is the AI tutor, which operates under strict safety constraints.
No public profiles. Child profiles are private and visible only to the parent and any family member or teacher whom the parent has explicitly invited to the child's Circle.
No public content. Children cannot publish, share or make any content visible outside their family Circle.
No external links. The AI tutor does not generate or display links to external websites.
Parent-controlled access. Only an adult who confirms they hold parental responsibility can create an account, add a child profile or invite members to a Circle. Card payment on a paid plan is a further check that the account holder is an adult.

4. Child protection procedures

If we become aware of content or behaviour that suggests a child may be at risk of harm, we follow these procedures:

Any AI conversation flagged by our moderation system as potentially indicating harm, abuse or distress is recorded as a safety event and reviewed by the designated safeguarding lead on the next working day.
Where there is reasonable cause to believe a child is at immediate risk of significant harm, we will contact the relevant local authority children's services or the police without delay, in accordance with Working Together to Safeguard Children (2023) and the Children Act 1989.
Where there is a concern that does not reach the threshold of immediate risk, we will notify the parent or guardian and offer guidance on appropriate support services.
We maintain a record of all safeguarding concerns, actions taken and outcomes, stored securely and separately from general platform data.
We will cooperate fully with any statutory investigation by children's services, the police or Ofsted.

5. Reporting mechanisms

Parents and guardians can report a safeguarding concern at any time using the following channels:

From your account. Read any conversation on the Conversations page and email us the date and the child's first name. A one-tap report button on each conversation is on the beta list.
Email. Send a report to info@wonderpath.co.uk with the subject line "Safeguarding concern".
Parent dashboard. Parents can review all AI conversations, journal entries and learning activity for each child and flag any content they find concerning.

We aim to acknowledge all safeguarding reports within twenty-four hours and to provide a substantive response within five working days.

If you believe a child is in immediate danger, please contact the police straight away. The NSPCC also gives advice to adults who are worried about a child: nspcc.org.uk.

6. Staff and AI safety training

We have a named designated safeguarding lead, trained to Level 3, who owns this policy and every escalation decision.
Staff who can read children's conversations hold a DBS check (an enhanced check where the role is eligible) or, if based in Scotland, are members of the PVG scheme. As a private online provider we have no statutory duty to report in England today; we report as this policy says because it is right, and we will comply with the mandatory reporting duty for child sexual abuse under the Crime and Policing Act 2026 when it comes into force.
All staff with access to user data or content moderation systems receive safeguarding training before they begin work, with refresher training at least annually.
Staff training covers recognising signs of abuse, the disclosure process, online grooming indicators, the Prevent duty and data protection for children.
Our AI systems are regularly red-teamed and tested against adversarial prompts designed to bypass safety constraints. Results are reviewed by the safeguarding lead and fed back into system prompt improvements.
Lessons are written by AI. Review by a qualified teacher is being set up and is not in place yet; our AI Safety Policy and Beta page say where it stands.

7. Data protection for children

Safeguarding and data protection are closely linked. We apply the following principles to children's data:

We collect the minimum data necessary to provide the learning service. We do not request a child's surname, home address, telephone number, school name or photograph of their face.
All children's data is processed in accordance with the UK General Data Protection Regulation, the Data Protection Act 2018 and the ICO Children's Code.
Children's data is never used for marketing, profiling or behavioural advertising.
Children's AI conversations are not used to train external foundation models.
Parents have full access to, and control over, all data held about their children. For further details, see our Privacy Policy and Data Retention Policy.

8. Review and update schedule

This safeguarding policy is reviewed at least every twelve months, or sooner if there is a significant change in legislation, guidance or the nature of our service.
Reviews are conducted by the designated safeguarding lead in consultation with the product and engineering teams.
Any material changes to this policy are communicated to parents by email and through a banner on the parent dashboard at least fourteen days before they take effect.
The version number and date at the top of this page reflect the latest version.

9. Relevant legislation and guidance

Children Act 1989 and Children Act 2004.
Working Together to Safeguard Children (2023).
UK Online Safety Act 2023 (the helper is outside its scope today; see section 1) and the Crime and Policing Act 2026 provisions on mandatory reporting of child sexual abuse, expected in force in 2027.
Department for Education, Generative AI: product safety standards (updated January 2026).
UK General Data Protection Regulation and the Data Protection Act 2018.
ICO Age Appropriate Design Code (the Children's Code).
Keeping Children Safe in Education (2024), applied by analogy to our online learning context.

10. Contact

For safeguarding enquiries, reports or concerns, please contact us at info@wonderpath.co.uk. You may also write to us at: Clove9, Office 128, 18 Young Street, Unit LGE, Edinburgh, EH2 4JB, Scotland, United Kingdom.