Most of the people on this platform are children, and the design starts there.

When a coach adds a student to a batch, Cultiv8 stores two things and no more: the guardian's mobile number, and a name to call the child on the register. It stores no date of birth, no photograph, no attendance history and no session notes.

The guardian then grants consent from their own phone, verified by a one-time password sent to that number, against a specific published notice. Only after that does anything else about the child become processable. Verifying an identity is not the same as verifying guardianship, so the grant additionally requires an active parent or guardian relationship to that child.

A student added to a batch is treated as a minor unless someone explicitly declares them an adult, so the consent gate cannot be skipped by leaving out an age. A placeholder nobody claims is deleted after thirty days and its place in the batch is cancelled, so a child nobody consented for never lingers in a batch.

Consent records are never overwritten. Withdrawing consent writes a new record, and so does a change to the notice, which keeps the history auditable rather than merely current.

Attendance and money decide what a coach is owed. A student marked present is a class that gets paid for, so those records are written by a person and never by software acting on its own.

Ira automates the paperwork around those records, and stops there. It summarizes and rewrites on its own, where nothing leaves for another person and no attendance or fee record changes. It writes every message that goes out and holds it for a person to approve. And it never touches attendance or money at all: Ira never acts without your approval, never marks attendance, and never modifies fee records.

That boundary is not a setting somebody could switch on. No path exists in the system for an assistant to mark a student present, record a payment, cancel a place in a batch, issue a refund, or grant a consent. Those actions carry no proposal form at all, which is a stronger guarantee than a disabled button.

Three further commitments apply to the assistant:

• Ira reads only inside your own account, and cannot see across customers.
• One customer's data is never used to train a model another customer uses.
• Ira can never show you something you could not have seen yourself, because it runs the same permission checks your own screens run.

• No certifications. Cultiv8 is not SOC 2 audited, not ISO 27001 certified, and has not been independently penetration tested. Each of those is planned rather than held.
• No coach background checks and no verified badge. The only identity check today is the payment gateway's own: a coach cannot collect money online until it verifies their tax identity and a bank account confirmed by a test deposit. Credential verification, certification checks and a verified badge are planned and not shipped. No page here describes coaches as vetted.
• No in-app child-safety reporting channel. Confidential safety reporting was removed from the launch scope and returns after it. To raise a concern during early access, use the contact form.
• Shared encryption keys, for now. Field encryption uses a platform key today. Per-customer keys, and customer-supplied keys for institutions, are planned.
• No self-service audit view yet. The append-only log exists; the screen that lets you read your own is planned.