How we keep ourselves accountable

Legal and compliance documents

Version 1.0In effect from 15 October 2026See every change

This folder holds Wamemba me's public legal documents and The Doxa Way Ltd's accountability documents for Wamemba me under the UK GDPR (Articles 5(2) and 24). Every top-level *.md file here is published, with its full version history and a redline between any two versions, at https://insight.wamemba.me. The public documents are also served at wamemba.me (/privacy, /terms, /cookies, /promises).

These documents were drafted by an AI agent and have not been reviewed by a lawyer. Open legal questions are in solicitor-brief.md.

Rules for these documents

Each file starts with front matter: title, version, effective, audience (public or internal) and changes (one line on what changed). Public documents add path (where they are served). The publisher reads them.
Change a document only through a pull request. If the text changes, the version must go up: minor (1.0 to 1.1) for corrections and status updates; major (1.0 to 2.0) for a new assessment, a changed decision, or anything that changes what people are told. scripts/legal/legal.test.mjs fails the PR otherwise, and checks the front matter.
A public document also gets a row in its "Change history" table, in plain words.
Write in plain, precise English (ASD-STE100 style). Public documents follow brand/BRAND.md: warm, plain, British English, sentence case, no exclamation marks, and the name is always "Wamemba me". Each section of a public document opens with a two-line "In short".
Mark any fact that is not verified as unverified. Mark any feature that is not live as coming.
If a document and the published privacy policy disagree, correct the one that is wrong, in the same PR.
Never claim a certification or a lawyer's review that has not happened.

Public documents

Document	Served at	What it is
privacy.md	wamemba.me/privacy	Privacy policy
terms.md	wamemba.me/terms	Terms of use
cookies.md	wamemba.me/cookies	Cookie notice
promises.md	wamemba.me/promises	Our promises (spec §3, part of the terms)

Accountability documents

Document	What it is	Law
ropa.md	Record of processing activities: controller details and decisions, 15 processing activities, security measures, open items	UK GDPR Art. 30
dpia.md	DPIA for children's sayings, voices and family use, with the Children's Code assessment and sign-off	Art. 35; ICO Children's Code
lawful-basis-and-retention.md	Lawful basis per use, legitimate interests assessments, retention schedule	Art. 5(1)(e), 6
tra-international-transfers.md	Transfer risk assessments	Art. 44-46
breach-response.md	72-hour breach procedure and log template	Art. 33-34
dsar-procedure.md	Rights requests, a child's own requests, account deletion, export, anonymous accounts, complaints	Art. 12-22; DPA 2018 s.164A
risk-assessment.md	Legal risk assessment and clause review	Legal plugin methods
solicitor-brief.md	Questions for a lawyer before launch
register/subprocessors.json	Vendor register: role, data, location, DPA, transfer mechanism, gaps, actions, evidence	Art. 28, 44-46

Open items that need Garth

Item	Document
Sign the DPIA (after reading section 9)	`dpia.md` section 10
EU storefronts: appoint an EU representative, or exclude the EU at first release	`ropa.md` 2.2, `risk-assessment.md` LR4
Sign the PostHog DPA for the "Wamemba me" organisation	register, PostHog
Confirm the operations AI plan uses Commercial Terms	register, Anthropic
Move wamemba.me mail to Google Workspace (cost)	`tra-international-transfers.md` T5
Confirm The Doxa Way Ltd's ICO registration covers Wamemba me	`ropa.md` L1
Engage a solicitor (UK) and US counsel with the brief	`solicitor-brief.md`
Confirm the 60 days' notice on closure in the terms (default kept)	`terms.md` s.10

Review cycle

The privacy lead reviews all documents every 6 months (next: 2027-04-15), and earlier when a slice ships, a vendor or purpose changes, after a breach, or at a trigger named in a document.