Automated due diligence against the legal plugin's DPA checklist (UK GDPR Art. 28, international transfers, UK Addendum and IDTA). Not legal advice; not reviewed by a lawyer.
The Doxa Way Ltd (CRN 16744139) as controller of Wamemba me: the app (me.wamemba.app), wamemba.me and insight.wamemba.me. Inventory from code on main (8400a04), the production Supabase project xvjeflaaddtwyqrqzfck (auth config and backups read 2026-10-14), the Vercel team config, live HTTP headers of wamemba.me, and each vendor's own published terms. DPF status from the official participant list dated 2026-10-14 06:00 EST.
Supabase
In order, with actionsIn useprocessor
Database (Postgres), Auth (anonymous, Apple, email), Storage (voice clips, coming); the waitlist RPC
- Company
- Supabase Pte. Ltd. (Singapore), contracting party for direct customers; Supabase, Inc. (US) is a sub-processor (support)
- Data
- account id, Apple identifier, email; children's first names and birthdays; sayings, context, speakers, made-up word meanings; voice clips (coming); waitlist emails; IP addresses and user agents in auth and API logs
- Where
- London, UK (AWS eu-west-2) for database, auth and storage; support access from the US
- Contract
- supabase.com/legal/dpa
incorporated; in force: yes
- Transfers
- SCCs 2021 Modules 2/3 + ICO UK Addendum (deemed executed)
- Retention
- Daily physical backups kept 7 days, no PITR (read 2026-10-14); API logs per plan; 30-day retrieval window after termination then deletion
- Gaps
- The built-in auth email service (no custom SMTP configured) delivers only to members of the organisation's team, at 2 messages an hour, and is 'not meant for production use'. Email backup cannot reach real parents until custom SMTP is set
- Sub-processor change notices go only to subscribers of the list page
- Actions
- Configure custom SMTP (Resend, after its own check) before email backup is offered to the public (engineering): Without it, 'Back up with email' fails for every parent
- Subscribe hello@wamemba.me to Supabase sub-processor updates (engineering): Art. 28(2): to be able to object to a new sub-processor
- Unverified
- The sender, provider and region of Supabase's built-in auth email
- Evidence
- supabase.com/legal/dpa
supabase.com/terms
supabase.com/docs/guides/auth/auth-smtp
supabase.com/legal/subprocessor-list/October-12-2026.pdf
Vercel
In order, with actionsIn useprocessor
Hosting of wamemba.me (static) and insight.wamemba.me (static); share pages (coming)
- Company
- Vercel Inc. (US)
- Data
- visitor IP address and IP-derived location, user agent, URL, time (request handling and logs)
- Where
- Global edge network (wamemba.me served from lhr1 for UK visitors, seen in x-vercel-id); Vercel Inc. is a US company
- Contract
- vercel.com/legal/dpa
incorporated; in force: yes
- Transfers
- UK Extension (DPF active to 2027-04-29); fallback SCCs Modules 1-3 + UK IDTA deemed entered
- Retention
- Runtime logs 1 day on Pro; static requests are logged only when served from cache
- Gaps
- Sub-processor change notices only by email request to privacy@vercel.com
- Actions
- Email privacy@vercel.com to receive sub-processor notices for the team (engineering): Art. 28(2)
- Unverified
- How long Vercel keeps request data internally beyond customer-visible logs
- Evidence
- vercel.com/legal/dpa
vercel.com/legal/privacy-policy
vercel.com/docs/logs/runtime
www.dataprivacyframework.gov/participant/6847
Sentry
In order, with actionsIn useprocessor
Crash and error reports from the app (organisation wamemba-me, project wamemba-app)
- Company
- Functional Software, Inc. d/b/a Sentry (US)
- Data
- Supabase user id; errors, stack traces, release, device model and OS; scrubbed breadcrumbs (no console lines; taps recorded as 'touch'); performance traces (20% sample)
- Where
- EU data region (Frankfurt) for events; organisation settings and user accounts are always in the US
- Contract
- sentry.io/legal/dpa/
click-through; in force: no
- Transfers
- Events stored in the EU (adequacy); US remote access under the UK Extension (DPF active to 2027-05-28), SCCs Modules 2/3 + UK Addendum fallback
- Retention
- Errors 30 days on the Developer plan, 90 days on Team and above
- Gaps
- DPA not accepted for organisation wamemba-me (verified 2026-10-14)
- Actions
- Accept DPA v5.1.0 in wamemba-me Settings > Legal & Compliance and file the record (director): Accepting the DPA is a contract for The Doxa Way Ltd; ClickUp 869fhb21y
- Unverified
- The Sentry plan of organisation wamemba-me (sets 30 or 90 days)
- Evidence
- sentry.io/legal/dpa/
www.sentry.help/en/articles/13965008-how-do-i-sign-your-data-processing-addendum
docs.sentry.io/organization/data-storage-location/
docs.sentry.io/security-legal-pii/security/data-retention-periods/
sentry.io/terms/
PostHog
Gap to closeIn useprocessor
Product analytics from the app (organisation 'Wamemba me', EU Cloud)
- Company
- PostHog, Inc. (US)
- Data
- Supabase user id as distinct id; declared events with numeric, boolean or fixed-word properties only (app/src/lib/analytics.ts); app lifecycle events and device properties added by the SDK
- Where
- EU Cloud, Frankfurt
- Contract
- posthog.com/dpa
signed; in force: unknown
- Transfers
- Stored in the EU; UK Extension (DPF active to 2027-03-10) with SCCs and the ICO IDTA as fallback
- Retention
- Events 1 year on the free plan, 7 years on paid plans; cannot be shortened
- Gaps
- DPA not executed for organisation "Wamemba me"
- On a paid plan, events would be kept 7 years and the policy's 1 year would be wrong
- Actions
- Generate and sign the DPA for 'Wamemba me' at app.posthog.com/legal (PandaDoc signature by a director) (director): Art. 28(3) contract; a signature binds the company
- Before any paid PostHog plan: change the privacy policy's retention row or delete events after 1 year by API (engineering): Policy accuracy (Art. 13(2)(a))
- Decide whether to keep PostHog AI features on for the organisation (is_ai_data_processing_approved). If kept, list the LLM providers PostHog uses for them (posthog.com/subprocessors) here; if not needed, turn the approval off (engineering): When the team uses PostHog AI, our analytics (no family content) go to LLM providers; Art. 28(2) wants that chain known
- Unverified
- Plan of the "Wamemba me" organisation
- Evidence
- posthog.com/dpa
posthog.com/docs/privacy/data-storage
posthog.com/docs/data/events-retention
posthog.com/terms
www.dataprivacyframework.gov/participant/2915
Expo (EAS)
In order, with actionsIn useprocessor
EAS Build (source code only), EAS Update (over-the-air updates: device requests the update manifest); push notifications (coming)
- Company
- 650 Industries, Inc. (US)
- Data
- device IP, app and runtime version on update checks; push tokens and notification metadata (coming)
- Where
- US (Google Cloud)
- Contract
- expo.dev/terms
incorporated; in force: yes
- Transfers
- UK Extension (DPF 'Active - re-certification under review', valid to 2027-10-06)
- Retention
- Build logs and artifacts 90 days; notification content never stored
- Gaps
- No breach-notice commitment
- No UK fallback if DPF certification lapses
- Actions
- Check Expo's DPF status at each 6-monthly review and before push notifications launch (engineering): Transfer depends on it alone
- Keep push text generic (never a saying) when notifications arrive (engineering): Minimises what Expo, APNs and FCM see
- Evidence
- expo.dev/terms
expo.dev/privacy-explained
expo.dev/trust
www.dataprivacyframework.gov/participant/5606
Apple
In orderIn useindependent controller
App Store and TestFlight distribution; in-app purchases (merchant of record, coming); Sign in with Apple; on-device speech recognition (no data to Apple)
- Company
- Apple Inc.; Apple Distribution International Ltd (Ireland) for UK and EU App Store customers
- Data
- Apple's own customer data; Sign in with Apple: identifier and email (can be a relay) to us
- Where
- Apple's terms
- Contract
- developer.apple.com/support/terms/apple-developer-program-license-agreement/
incorporated; in force: yes
- Transfers
- Not a transfer by us: the parent deals with Apple directly
- Retention
- Apple's terms
- Gaps
- None
- Actions
- None
- Evidence
- www.apple.com/legal/privacy/en-ww/
developer.apple.com/documentation/speech/sfspeechrecognitionrequest/requiresondevicerecognition
Google (Play, Android, Sign-In)
In order, with actionsIn useindependent controller
Google Play distribution and billing (merchant of record, coming); Google Sign-In (off in production); Android on-device speech recognition
- Company
- Google LLC / Google Ireland Ltd / Google Commerce Ltd, by distribution location
- Data
- Google's own customer data; Google Sign-In identifier and email to us (when switched on)
- Where
- Google's terms
- Contract
- play.google/developer-distribution-agreement.html
incorporated; in force: yes
- Transfers
- Controller-to-controller; Google LLC on DPF (to 2027-09-13); SCCs for UK transfers in the C2C terms
- Retention
- Google's terms
- Gaps
- Google's documentation does not state in so many words that createOnDeviceSpeechRecognizer keeps audio on the device
- Actions
- Before the Android release, test on a real device in airplane mode that dictation works (proves no network is used) and record it (engineering): Spec §3 rule 5 and the privacy policy's dictation statement
- Unverified
- Android on-device recogniser sends no audio off the device
- Which Google entity contracts with a UK developer
- Evidence
- play.google/developer-distribution-agreement.html
www.dataprivacyframework.gov/participant/5780
Namecheap
Gap to closeIn useprocessor
Domain registration and DNS for wamemba.me; free email forwarding of hello@wamemba.me
- Company
- Namecheap, Inc. (US)
- Data
- emails sent to hello@wamemba.me (sender address, content) in transit; registrant contact data (company)
- Where
- US (forwarding servers eforward*.registrar-servers.com geolocate to Los Angeles, per ipinfo.io)
- Contract
- www.namecheap.com/legal/universal/data-processing-addendum/
incorporated; in force: unknown
- Transfers
- None valid for the UK: the DPA's UK clause relies on the old 2010/87/EU clauses, no IDTA or UK Addendum, not on DPF
- Retention
- Unverified
- Gaps
- No valid UK transfer mechanism for forwarded mail
- Retention of forwarded mail logs unknown
- Actions
- Move hello@wamemba.me (and privacy@) to Google Workspace mail on wamemba.me (spec §5) and switch MX away from Namecheap forwarding (director): Needs a Google Workspace subscription for wamemba.me (money) and the MX change; removes the transfer gap
- Unverified
- Forwarded-mail log retention
- Whether the DPA covers free forwarding
- Evidence
- www.namecheap.com/legal/universal/data-processing-addendum/
www.namecheap.com/legal/general/privacy-policy/
Google Workspace
In order, with actionsIn useprocessor
The mailbox that receives hello@wamemba.me: Namecheap forwards it to garth@doxa.app, a Google Workspace mailbox of The Doxa Way Ltd (verified 2026-10-14). Planned: Wamemba me's own Workspace on wamemba.me
- Company
- Google Cloud EMEA Limited (Ireland)
- Data
- messages from parents, requests and complaints
- Where
- Google data centres
- Contract
- cloud.google.com/terms/data-processing-addendum
incorporated; in force: yes
- Transfers
- DPF (Google LLC) where adopted, otherwise SCCs
- Retention
- As the company's mail retention rule (2 years; not yet enforced)
- Gaps
- None
- Actions
- Add a 2-year retention rule for Wamemba me mail in that mailbox (or in its own Workspace once it exists) (engineering): Storage limitation (lawful-basis-and-retention.md R-2)
- Unverified
- Data region setting of the doxa.app Workspace
- Evidence
- cloud.google.com/terms/data-processing-addendum
workspace.google.com/terms/premier_terms/
GitHub
In orderIn useprocessor
Source code, CI and the legal-history workflow. No family data; legal documents and the register are public by design
- Company
- GitHub, Inc. (US)
- Data
- no user personal data expected
- Where
- US
- Contract
- github.com/customer-terms/github-data-protection-agreement
incorporated; in force: yes
- Transfers
- DPF (to 2027-08-03) + SCCs and UK Addendum
- Retention
- n/a
- Gaps
- None
- Actions
- Keep production data out of fixtures, logs and issues (engineering): Keeps GitHub out of scope
- Evidence
- github.com/customer-terms/github-data-protection-agreement
www.dataprivacyframework.gov/participant/6174
Anthropic (engineering agents)
Gap to closeIn useprocessor
Claude Code sessions that build and operate Wamemba me, including Management API queries against production
- Company
- Anthropic Ireland, Limited
- Data
- schema and aggregate queries; smoke-test rows; the waitlist when checked; a family's data only if that family asks for help
- Where
- US
- Contract
- www.anthropic.com/legal/data-processing-addendum
incorporated; in force: unknown
- Transfers
- Commercial: SCCs Modules 2/3 + UK IDTA. Consumer plans: none
- Retention
- Commercial 30 days; consumer 30 days (training off) or 5 years (on)
- Gaps
- Unknown whether the sessions that query production run under Commercial Terms
- Actions
- Confirm which plan the operations account uses; run production work only under Team, Enterprise or the API (director): Plan choice is a spend decision; Art. 28 contract
- Until confirmed: no reads of family content in operations sessions; schema and aggregate queries only (engineering): Minimisation while the contract is unconfirmed
- Unverified
- The plan of the account that runs Wamemba me engineering sessions
- Evidence
- www.anthropic.com/legal/commercial-terms
www.anthropic.com/legal/data-processing-addendum
code.claude.com/docs/en/legal-and-compliance
RevenueCat
Not used yetPlannedprocessor
Subscriptions, trials, restore and the TRANSFER webhook (S4)
- Company
- RevenueCat, Inc. (US)
- Data
- app user id (= Supabase user id); store transactions, product, status, ownership type
- Where
- US (AWS, Snowflake)
- Contract
- www.revenuecat.com/dpa/
incorporated; in force: no
- Transfers
- SCCs Modules 2/3 + ICO IDTA Addendum
- Retention
- Return or delete within 30 days of termination on request
- Gaps
- AI sub-processors listed in Annex 3: purpose unknown
- Actions
- Before S4: read Annex 3, ask RevenueCat what data reaches its AI sub-processors, opt out if possible; complete TRA T3 (engineering): No family content should reach an AI vendor (spec §3)
- Unverified
- Training on customer data
- Evidence
- www.revenuecat.com/dpa/
www.revenuecat.com/privacy/
Resend
Not used yetPlannedprocessor
Transactional email: auth links (custom SMTP), gift cards, weekly grandparent email (S4, S6)
- Company
- Plus Five Five, Inc. (US)
- Data
- recipient email; email content (never a saying's text in a notification-style email unless the recipient is a family member or viewer)
- Where
- Sending region selectable (Ireland eu-west-1 available); account data always in the US
- Contract
- resend.com/legal/dpa
incorporated; in force: no
- Transfers
- UK Extension (DPF 're-certification under review', to 2027-03-03) + SCCs Modules 2/3 + UK Addendum
- Retention
- Emails and logs 30 days
- Gaps
- None
- Actions
- Use the eu-west-1 sending region; add to the privacy policy before first send (engineering): Minimise transfers; Art. 13
- Evidence
- resend.com/legal/dpa
resend.com/docs/dashboard/domains/regions
resend.com/security
www.dataprivacyframework.gov/participant/8907
