Veyay launch legal packet
Status: FAMILY, ALL-AGES AND PERSONAL-UPLOAD CANDIDATE WITH ADULT SPEECH DISCLOSURE, THE PARENT'S DIRECT-NOTICE ELEMENTS AND A PURPOSE-LIMITED CHILD-RETENTION RULE, COVERING EVERY PARENT-PAID DEPENDENT LEARNER UNDER 18 INCLUDING UNDER 13, AND THE SAME-HOME FAMILY WORDING, WITH THE PARENT-CONSENT RETENTION ROW CORRECTED (D-RA-290 Phase 2; D-RA-297 rule 4; derived from the published 2026-10-14.2) — NOT LEGAL ADVICE, NOT YET PRINCIPAL-APPROVED, NOT AUTHORIZED FOR PUBLICATION, ACCOUNT SERVICE, OR INSTITUTIONAL RELIANCE.
Product: Veyay, operated by Cabildo Companies LLC Version: 2026-10-14.3 Governing release gate: REVIEW_MANIFEST.json identifies this draft; config/veyay/legal_release_v1.json continues to govern the unchanged active packet
This directory is the publication-byte source packet for Veyay. It separates product facts from legal conclusions and keeps publication closed until Cabildo records a hash-bound internal legal/privacy/risk disposition for the exact files and the Principal approves the exact lane, manifest hash, rendered hash, and candidate commit. D-RA-254 makes external counsel optional and never a release prerequisite. Internal model or persona review is evidence for Cabildo's analysis; it is never represented as attorney participation, legal advice, certification, or statutory compliance.
This candidate has not been published or accepted. The approved and published 2026-10-08.1 (R4) packet and its server-side acceptance receipts remain in force until this version is approved, published and accepted. This version covers adult accounts and adult-run classes (professors, tutors, co-op teachers), homeschool families, parent-managed learners of every age with the parent's paid seat as the verification, and personal-study uploads with the uploader's responsibility. School and district lanes, learning-management rostering, retained oral assessment and sharing of uploads are not covered. It does not activate any population or treat an adult's own acceptance as a parent's consent.
Independent adult, parent-managed, and institutional use have separate authority and acceptance requirements. Every minor learning lane remains closed until the exact population, jurisdiction, agreement/consent, technical evidence and Principal approval are recorded. The public receipt identifies notice bytes; it is never a learner consent receipt or a legal conclusion.
Publication and every lane activation remain blocked by: each lane's DARK controls (the switches and migrations named in the promise-to-test table); the abuse-material reporting path for any upload lane (registration, written procedure, disable-and-preserve control); support staffing, monitored hours, escalation and an end-to-end receipt and readback exercise; and the Principal's decisions recorded with the Counsel and Pendleton review. The coach context isolation (P38) and learner-disclosure (P39) defects found by that review are fixed in code.
The packet covers:
TERMS.md— terms for the demonstration, adult accounts and classes, parent-managed learners, seats and uploads.PRIVACY_NOTICE.md— demo, adult, family, seat and upload data flows.GUARDIAN_AND_STUDENT_NOTICES.md— the parent consent notice and the learner notice.RETENTION_AND_ORAL_RECORDING.md— active-system retention, exports, oral audio, and deletion limits.INSTITUTIONAL_DPA_DRAFT.md— draft negotiation template, never an executed agreement.SECURITY_AND_SUBPROCESSORS.md— custody and current service-provider sheet.UPLOAD_RIGHTS_AND_TAKEDOWN.md— rights attestation and complaint procedure.ACCESSIBILITY_AND_SUPPORT.md— accessibility target and support boundaries.JURISDICTION_TRACKER.md— issues Cabildo must disposition for each launch population.DATA_LIFECYCLE_MAP.md— object-level export, deletion, survivor, provider, and backup map.
TERMS_DRAFT.md and PRIVACY_NOTICE_DRAFT.md are retained historical drafts and are not part of version 2026-10-14.3 or rendered for publication.
No file says that Veyay is FERPA-, COPPA-, PPRA-, or state-law “compliant.” No file claims provider zero retention, automatic safeguarding, automated year-end deletion, learning efficacy, or automated grading. The public notice receipt is notice evidence, not account acceptance. Every account must separately record authenticated, affirmative acceptance of the exact active version and packet hash before service is allowed. Operations, accessibility, production-journey, and exact Principal activation gates remain separate.