This is the record of processing activities of The Doxa Way Ltd for Wamemba me: the app, the site wamemba.me and the legal site insight.wamemba.me. It follows the ICO documentation guidance:
- ICO, Documentation: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/documentation/
Doxa, the company's other service, has its own record in the doxa-app repository. The two services share no database, account system, analytics project or error-monitoring organisation.
This record describes the state on its effective date: the code on main, the production Supabase project xvjeflaaddtwyqrqzfck and the live settings read on 2026-10-14. Each activity is marked live or coming (designed in specs/wamemba-v1/README.md, not built). The vendor facts come from the sub-processor register, register/subprocessors.json. This document is not legal advice. A qualified lawyer has not reviewed it.
Why Wamemba me keeps this record. The Article 30(5) exemption for organisations with fewer than 250 staff does not apply: the processing is not occasional, and it is about children.
1. Controller details
| Item | Value |
|---|
| Controller | The Doxa Way Ltd, trading as Wamemba me |
| Company number | 16744139 (England and Wales) |
| Registered office | 108 Kings Road, New Haw, Addlestone, KT15 3BH, United Kingdom |
| Contact | hello@wamemba.me (forwarded by Namecheap; read by the privacy lead) |
| Director and privacy lead | Garth Hilton Watson. Not a Data Protection Officer (section 2.3) |
| Supervisory authority | The Information Commission (the regulator was the Information Commissioner's Office until 30 September 2026, when the Data (Use and Access) Act 2025 ss.118-119 transferred its functions; SI 2026/1015). Called "the regulator" or "ICO" (its website) in these documents |
| ICO data protection fee | One registration covers the company, so it covers Wamemba me and Doxa. Unverified: whether The Doxa Way Ltd's registration is complete (Doxa's record, 2026-10-08, said it was pending). Action L1 |
| Scale on the effective date | The app is in internal TestFlight testing. Production holds no family accounts (the S2 smoke-test accounts were deleted, docs/decisions/2026-10-14-s2-live-on-prod.md) and 3 waitlist rows |
2. Controller decisions
2.1 Controller, not processor, for the family's content
The Doxa Way Ltd decides why and how the sayings are processed (the product design, the vendors, the retention rules), so it is the controller. A parent's own use is household activity and outside the UK GDPR (Article 2(2)(c)), but Recital 18 says a provider of the means for household activity is still bound. So Wamemba me owes the duties of a controller to the parent, to the child, and to anyone named in a saying.
2.2 EU representative: not appointed yet (open)
EU GDPR Article 27 needs a representative in the EU if the company offers goods or services to people in the EU (Article 3(2)(a)). The spec (§4.2) sets prices that the stores scale to every country, which would make the app available in EU storefronts. Default: before the app is offered in any EU or EEA storefront, either appoint an EU representative or exclude those storefronts at launch. This is a money and market decision for Garth (action L2) and a question in the solicitor brief.
2.3 No Data Protection Officer
Article 37(1) does not apply: the company is not a public body; its core activity is not large-scale regular and systematic monitoring (analytics are ancillary and opt-in in the UK and EU); and it does not process special category data on a large scale (a voice clip played back is not biometric data, DPIA section 4.3). Review trigger: 50,000 families, a child-facing feature, or any processing of voice for identification.
3. How to read section 4
- Lawful basis cites UK GDPR Article 6(1). For the parent: contract, 6(1)(b). For the child and anyone else named in a saying, who are not party to the contract: legitimate interests, 6(1)(f), with the assessment in
lawful-basis-and-retention.md section 1.2. - Transfers name the safeguard for a restricted transfer out of the UK (see
tra-international-transfers.md). "UK Ext" means the UK Extension to the EU-US Data Privacy Framework; "SCCs + UK Addendum" means the 2021 EU Standard Contractual Clauses with the ICO International Data Transfer Addendum; "adequacy" means UK adequacy regulations (the EU and EEA are adequate for the UK). - Retention is detailed in
lawful-basis-and-retention.md section 2. - Security refers to section 6.
4. Processing activities
PA1. Accounts and sign-in (live)
| Field | Entry |
|---|
| Purpose | Make a private account on first launch; let the parent back it up and sign back in; keep accounts secure |
| Lawful basis | Contract, 6(1)(b). Rate limits and security logs: legitimate interests, 6(1)(f) |
| Data subjects | Parents and other adult users |
| Data categories | Supabase user id (random UUID), created and last-sign-in times, anonymous flag; with Apple: Apple's subject identifier and the email Apple gives (can be a Hide My Email relay); with email: the email address; IP address and user agent in auth logs. No name is requested from Apple |
| Recipients | Supabase (processor); Apple for Sign in with Apple (independent controller); Supabase's own email service sends the email confirmation link (no custom SMTP is configured, read 2026-10-14) |
| Transfers | Supabase: stored in London (AWS eu-west-2); Supabase Inc. (US) support access under SCCs + UK Addendum. Apple: Apple's terms |
| Retention | While the account exists. Never-subscribed anonymous accounts: 90 days after last open (coming, S4). Auth logs: per Supabase plan (Pro: 7 days) |
| Security | Section 6; session in the iOS keychain / Android Keystore (AFTER_FIRST_UNLOCK); anonymous sign-ins limited to 30 an hour per IP |
PA2. Children (live)
| Field | Entry |
|---|
| Purpose | Say whose saying it is; work out each child's exact age at the time of a saying |
| Lawful basis | Legitimate interests, 6(1)(f): the parent's interest in keeping their child's words, and Wamemba me's in providing the service the parent asked for. LIA: lawful-basis-and-retention.md 1.2 |
| Data subjects | Children of the parent's family (spec audience: 2 to 8 years old) |
| Data categories | First name; birthday (optional). No surname, photo, school or location is asked for |
| Recipients | Supabase |
| Transfers | As PA1 |
| Retention | Until the parent deletes the child or the account (a child with sayings must have them removed first; a whole family deletes cleanly) |
| Security | Section 6; RLS: members of the family only; viewers read, never write |
PA3. Sayings, made-up words and their meanings (live)
| Field | Entry |
|---|
| Purpose | Keep the funny things and made-up words a family's children say; each child's word dictionary |
| Lawful basis | Parent: contract, 6(1)(b). Child and other named speakers: legitimate interests, 6(1)(f) |
| Data subjects | Children; the parent; other people a parent names as a speaker ("Dad", "the bus driver") |
| Data categories | Saying kind, context line, date said, lines with speaker (child id or a free-text name) and text, made-up word flag; the private meaning of a word (word_meanings, parents only); created-by user id |
| Dictation | On the device only: iOS expo-speech-recognition with on-device recognition required (a patch refuses to start when on-device recognition is unavailable); Android 13+ createOnDeviceSpeechRecognizer. No audio leaves the phone, and the dictation audio is not kept. Older devices and non-English iPhones type instead |
| Recipients | Supabase. A copy is kept on the parent's phone (AsyncStorage, per account) until synced and after |
| Transfers | As PA1 |
| Retention | Until the parent deletes the saying, the child or the account; backups 7 days |
| Security | Section 6; save_saying() runs as the caller (security invoker), so every write passes RLS; meanings in their own table so a viewer's read of lines can never include them |
PA4. Children's voice clips (coming, S3)
| Field | Entry |
|---|
| Purpose | Let a parent attach a short recording of the child saying it again, to play back to the family and on shared links |
| Lawful basis | Parent: contract, 6(1)(b). Child: legitimate interests, 6(1)(f), with the higher bar recorded in the DPIA (R3) |
| Art. 9 | Not special category: the clip is stored and played back, never processed to identify anyone (DPIA 4.3). Re-assess if any voice feature beyond playback is proposed |
| Data categories | Audio file (clip_path), the saying it belongs to |
| Recipients | Supabase Storage (private bucket, signed URLs); people the parent shares with |
| Retention | With the saying |
| Security | Private bucket, signed URLs with a short life, RLS on the path |
PA5. Cards, shared links and the share page (coming, S3)
| Field | Entry |
|---|
| Purpose | Turn a saying into a card or a private link (wamemba.me/s/<token>) that relatives open in a browser |
| Lawful basis | Contract, 6(1)(b), on the parent's instruction; child: legitimate interests, 6(1)(f) |
| Data subjects | Children; speakers; viewers of a link (IP in logs) |
| Data categories | Context, lines with speakers' first names, each child speaker's age (never birthday, surname or meaning), clip URL; token, revoked_at; viewer IP and user agent in server logs |
| Recipients | Anyone with the link; Vercel (page hosting); the platforms the parent shares to (WhatsApp, Instagram, Messages: independent controllers for what the parent sends) |
| Retention | Until the parent revokes the link or deletes the saying or account. A card image already sent is outside our control |
| Security | Unguessable token; security-definer read function that checks revoked_at and returns only the fields above; caching and rate limits (spec §10 lesson 6) |
PA6. Family circle: partners, grandparent viewers, weekly email (coming, S6)
| Field | Entry |
|---|
| Purpose | Invite a partner (full access) and grandparents (read only); send a weekly "new sayings" email |
| Lawful basis | Partner and viewers: contract with the inviting parent and with each invitee who accepts, 6(1)(b). Weekly email: the viewer's request (contract) with one-tap unsubscribe |
| Data categories | Invitee name or label, email address, role, invitation status |
| Recipients | Supabase; Resend (email, coming, not used yet) |
| Retention | While the membership exists; invitation emails deleted when declined or expired (rule to be set in S6) |
PA7. Subscriptions, trials and gifts (coming, S4 and S6)
| Field | Entry |
|---|
| Purpose | Sell subscriptions through the App Store and Google Play; trials; restore purchases; grandparent gifts |
| Lawful basis | Contract, 6(1)(b); tax records: legal obligation, 6(1)(c) |
| Data categories | RevenueCat app user id (= Supabase user id), product, store, period, status, transaction ids, ownership type (PURCHASED or FAMILY_SHARED), transfer events. No card data: Apple and Google are the merchants of record |
| Recipients | RevenueCat (processor, coming); Apple and Google (independent controllers for the purchase) |
| Transfers | RevenueCat: US (see TRA) |
| Retention | Subscription rows while the account exists; transaction records 6 years (HMRC) |
PA8. Notifications (coming, S4 and S8)
| Field | Entry |
|---|
| Purpose | Trial reminder on day 5; "On this day"; the 7-day notice before an unused account is removed |
| Lawful basis | Contract, 6(1)(b); the parent allows notifications in the operating system |
| Data categories | Push token, notification type, send time. Lock-screen text never quotes a saying (rule from Doxa's PR #3086) |
| Recipients | Expo push service, Apple APNs, Google FCM |
| Retention | Token while the account exists and the token is valid (dead tokens removed, spec §10 lesson 9) |
PA9. Crash reports (live)
| Field | Entry |
|---|
| Purpose | Find and fix faults |
| Lawful basis | Legitimate interests, 6(1)(f) |
| Data categories | Error, stack trace, release, device model, OS version, Supabase user id, scrubbed breadcrumbs (no console lines; taps recorded as "touch" only); performance traces (20% sample in production). sendDefaultPii off; no screenshots, view hierarchy or replay |
| Recipients | Sentry (Functional Software, Inc.), organisation wamemba-me in the EU data region |
| Transfers | Stored in the EU (adequacy). Remote access by a US company: see TRA |
| Retention | Sentry plan default (register) |
PA10. Product analytics (live)
| Field | Entry |
|---|
| Purpose | Learn whether the app works for families (activation, capture speed) without reading content |
| Lawful basis | UK, EU, EEA, CH: consent, 6(1)(a), and PECR regulation 6 for the device identifier. Elsewhere: legitimate interests, 6(1)(f), with an opt-out |
| Data categories | The events declared in app/src/lib/analytics.ts (app opened, account created, signed in, linked, saying saved with method, kind and milliseconds, checked with counts, deleted, child added with has_birthday, dictation unavailable or failed with a fixed reason); app lifecycle events; device and app properties the SDK adds; Supabase user id as distinct id. sanitise() drops any value that isn't a number, boolean or fixed word. No session recording. IP anonymised in the project (both read in PostHog on 2026-10-14: anonymize_ips on, session recording off; AI training not opted in) |
| Recipients | PostHog (EU Cloud, Frankfurt), its own organisation "Wamemba me" |
| Consent mechanism | app/src/lib/privacy.ts: default off in the UK, EEA and CH, and when the region is unknown. The consent screen arrives in S4; until then those devices send nothing. Gap: no opt-out switch elsewhere yet (action L7) |
| Retention | Target 12 months (privacy policy); unverified whether the plan allows it (register) |
PA11. Website, waitlist and legal site (live)
| Field | Entry |
|---|
| Purpose | Tell people about Wamemba me; keep a waitlist; publish the legal documents and their history |
| Lawful basis | Waitlist: consent, 6(1)(a). Server logs: legitimate interests, 6(1)(f) |
| Data categories | Waitlist: email (lower case), source tag, created_at, confirmed_at (unused: no confirmation email is sent yet). Server logs: IP, user agent, URL, time |
| Recipients | Vercel (hosting); Supabase (join_waitlist(); anon can execute only that function, which returns nothing) |
| Cookies | None. No analytics, no third-party scripts or fonts (checked 2026-10-14: no set-cookie, no external resources) |
| Retention | Waitlist: until unsubscribe or request, and at most 12 months after launch (action L8, manual) |
PA12. Support and privacy requests (live)
| Field | Entry |
|---|
| Purpose | Answer messages; handle data subject requests and complaints |
| Lawful basis | Legitimate interests, 6(1)(f); legal obligation, 6(1)(c), for rights requests |
| Data categories | Email address, message content, account id where given |
| Recipients | Namecheap (email forwarding of hello@wamemba.me); Google Workspace, where the forward lands: garth@doxa.app, a mailbox of The Doxa Way Ltd (Namecheap Redirect Email settings, read 2026-10-14; garth@wamemba.me forwards there too) |
| Retention | 2 years after the last message; request log 6 years (dsar-procedure.md) |
PA13. Account deletion, export and clean-up (coming, S4)
| Field | Entry |
|---|
| Purpose | In-app account deletion (App Store 5.1.1(v)); export at any time (spec §3 rule 3); removal of never-subscribed anonymous accounts after 90 days without an open |
| Lawful basis | Legal obligation, 6(1)(c) (rights requests); contract; storage limitation principle |
| Status | Not built. Until then: by email, by hand (dsar-procedure.md). The clean-up has a prerequisite: the "gone" screen needs a carry-over before it is switched on (docs/decisions/2026-10-14-session-for-deleted-account.md) |
PA14. Creator and press outreach (live, small)
| Field | Entry |
|---|
| Purpose | Offer parent creators the app and ask about posts; pitch press (spec §7) |
| Lawful basis | Legitimate interests, 6(1)(f); PECR: business contacts or public creator contact addresses only |
| Data categories | Name or handle, public contact address, platform, outreach notes, their reply |
| Recipients | The company's mailbox and outreach document |
| Retention | 12 months after the last contact; immediately on request (suppression entry kept) |
PA15. Engineering operations (live)
| Field | Entry |
|---|
| Purpose | Build and run the service: migrations, smoke tests, incident checks |
| Lawful basis | Legitimate interests, 6(1)(f) |
| Data categories | Production database reads through the Supabase Management API (aggregate and schema queries; smoke-test rows) |
| Recipients | Anthropic (Claude Code sessions run by the company). Gap: which commercial terms cover these sessions (register; action L10). Rule meanwhile: no reads of family content in operations sessions unless a parent asked for help, and then only that family |
| Retention | Session transcripts per the vendor's terms |
5. Rights handling
dsar-procedure.md. Breaches: breach-response.md.
6. Security measures (Article 32)
| Measure | State |
|---|
| Encryption in transit | TLS on every connection (HSTS on wamemba.me) |
| Encryption at rest | Supabase (AWS) disk encryption |
| Access control in the database | RLS on every public table; deny by default; anon has no table access; anon EXECUTE revoked except join_waitlist(); one pgTAP file per table run as anon, owner, viewer and another family's member on prod's exact Postgres image on every PR (gate.yml db job) |
| Change control | Every change through branch → PR → the recursive quality gate (.claude/skills/quality-gate/SKILL.md); critical tier for database, auth, export and delete, sharing and money |
| Secrets | Keychain and EAS sensitive variables; no service keys in the app |
| On the phone | Session tokens in the keychain; sayings in the app sandbox (AsyncStorage, not encrypted beyond the OS's file protection: DPIA R7) |
| Telemetry minimisation | Sentry scrubbing and no screenshots; analytics sanitise(); tests guard both |
| Backups | Supabase daily physical backups, kept 7 days; no point-in-time recovery (read 2026-10-14) |
| People | One director; engineering by agents under Garth's account, through the gate |
7. Open items
| ID | Item | Owner |
|---|
| L1 | Confirm The Doxa Way Ltd's ICO registration is complete, and that its description covers Wamemba me | Garth |
| L2 | EU storefronts: appoint an EU representative or exclude EU/EEA at launch | Garth |
| L3 | Sentry: accept the DPA for organisation wamemba-me (not accepted, read 2026-10-14; aggregated identifying data is already off) | Garth (a contract) |
| L4 | PostHog: execute the DPA for organisation "Wamemba me" | system (browser), Garth if a signature is needed |
| L5 | Solicitor opinion: COPPA and UK GDPR (spec §9), terms, trademark (solicitor-brief.md) | Garth |
| L6 | Confirm PostHog project settings: discard IP and no recordings done (2026-10-14); retention depends on the plan (register) | system |
| L7 | Analytics consent and opt-out screen in onboarding and Settings (S4), before public release | system |
| L8 | Waitlist deletion 12 months after launch | system |
| L9 | Record where hello@wamemba.me forwards: done (garth@doxa.app, 2026-10-14). Add privacy@wamemba.me: open (not needed while hello@ is the published address) | system |
| L10 | Claude Code for operations: confirm commercial terms (no training) for the account used | Garth |
| L11 | In-app delete and export before the first public store release (App Store 5.1.1(v); spec §3 rule 3) | system |
8. Review
Every 6 months, and whenever a slice in spec §6 lands, a vendor changes, or a "coming" activity goes live. Next review: 2027-04-15.
