History

Record of processing activities

2 versions on recordRead the current version

Every version of this document since it was first published, taken from the public record of every change. A version is kept whenever the words a reader sees changed.

Every version

1. Version 1.1

   Version went up

   In effect from 15 October 2026 · Published 14 October 2026

   Verified at the Namecheap session on 2026-10-14: hello@wamemba.me and garth@wamemba.me forward to garth@doxa.app, a Google Workspace mailbox of The Doxa Way Ltd (L9, first half). PostHog: IP anonymised, no recordings, no AI training (L6 done). Sentry: DPA not yet accepted, aggregated data off (L3 with Garth). insight.wamemba.me is live.

   Read this versionPull request #58Commit a5a9a83

   What changed from Version 1.0

   +72 words−36 words

   111 unchanged paragraphs

   Record of processing activities (UK GDPR Article 30)

   This is the record of processing activities of The Doxa Way Ltd for Wamemba me: the app, the site wamemba.me and the legal site insight.wamemba.me. It follows the ICO documentation guidance:

   ICO, Documentation: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/documentation/

   Doxa, the company's other service, has its own record in the doxa-app repository. The two services share no database, account system, analytics project or error-monitoring organisation.

   This record describes the state on its effective date: the code on main, the production Supabase project xvjeflaaddtwyqrqzfck and the live settings read on 2026-10-14. Each activity is marked live or coming (designed in specs/wamemba-v1/README.md, not built). The vendor facts come from the sub-processor register, register/subprocessors.json. This document is not legal advice. A qualified lawyer has not reviewed it.

   Why Wamemba me keeps this record. The Article 30(5) exemption for organisations with fewer than 250 staff does not apply: the processing is not occasional, and it is about children.

   1. Controller details

   Item | Value

   Controller | The Doxa Way Ltd, trading as Wamemba me

   Company number | 16744139 (England and Wales)

   Registered office | 108 Kings Road, New Haw, Addlestone, KT15 3BH, United Kingdom

   Contact | hello@wamemba.me (forwarded by Namecheap; read by the privacy lead)

   Director and privacy lead | Garth Hilton Watson. Not a Data Protection Officer (section 2.3)

   Supervisory authority | The Information Commission (the regulator was the Information Commissioner's Office until 30 September 2026, when the Data (Use and Access) Act 2025 ss.118-119 transferred its functions; SI 2026/1015). Called "the regulator" or "ICO" (its website) in these documents

   ICO data protection fee | One registration covers the company, so it covers Wamemba me and Doxa. Unverified: whether The Doxa Way Ltd's registration is complete (Doxa's record, 2026-10-08, said it was pending). Action L1

   Scale on the effective date | The app is in internal TestFlight testing. Production holds no family accounts (the S2 smoke-test accounts were deleted, docs/decisions/2026-10-14-s2-live-on-prod.md) and 3 waitlist rows

   2. Controller decisions

   2.1 Controller, not processor, for the family's content

   The Doxa Way Ltd decides why and how the sayings are processed (the product design, the vendors, the retention rules), so it is the controller. A parent's own use is household activity and outside the UK GDPR (Article 2(2)(c)), but Recital 18 says a provider of the means for household activity is still bound. So Wamemba me owes the duties of a controller to the parent, to the child, and to anyone named in a saying.

   2.2 EU representative: not appointed yet (open)

   EU GDPR Article 27 needs a representative in the EU if the company offers goods or services to people in the EU (Article 3(2)(a)). The spec (§4.2) sets prices that the stores scale to every country, which would make the app available in EU storefronts. Default: before the app is offered in any EU or EEA storefront, either appoint an EU representative or exclude those storefronts at launch. This is a money and market decision for Garth (action L2) and a question in the solicitor brief.

   2.3 No Data Protection Officer

   Article 37(1) does not apply: the company is not a public body; its core activity is not large-scale regular and systematic monitoring (analytics are ancillary and opt-in in the UK and EU); and it does not process special category data on a large scale (a voice clip played back is not biometric data, DPIA section 4.3). Review trigger: 50,000 families, a child-facing feature, or any processing of voice for identification.

   3. How to read section 4

   Lawful basis cites UK GDPR Article 6(1). For the parent: contract, 6(1)(b). For the child and anyone else named in a saying, who are not party to the contract: legitimate interests, 6(1)(f), with the assessment in lawful-basis-and-retention.md section 1.2.

   Transfers name the safeguard for a restricted transfer out of the UK (see tra-international-transfers.md). "UK Ext" means the UK Extension to the EU-US Data Privacy Framework; "SCCs + UK Addendum" means the 2021 EU Standard Contractual Clauses with the ICO International Data Transfer Addendum; "adequacy" means UK adequacy regulations (the EU and EEA are adequate for the UK).

   Retention is detailed in lawful-basis-and-retention.md section 2.

   Security refers to section 6.

   4. Processing activities

   PA1. Accounts and sign-in (live)

   Field | Entry

   Purpose | Make a private account on first launch; let the parent back it up and sign back in; keep accounts secure

   Lawful basis | Contract, 6(1)(b). Rate limits and security logs: legitimate interests, 6(1)(f)

   Data subjects | Parents and other adult users

   Data categories | Supabase user id (random UUID), created and last-sign-in times, anonymous flag; with Apple: Apple's subject identifier and the email Apple gives (can be a Hide My Email relay); with email: the email address; IP address and user agent in auth logs. No name is requested from Apple

   Recipients | Supabase (processor); Apple for Sign in with Apple (independent controller); Supabase's own email service sends the email confirmation link (no custom SMTP is configured, read 2026-10-14)

   Transfers | Supabase: stored in London (AWS eu-west-2); Supabase Inc. (US) support access under SCCs + UK Addendum. Apple: Apple's terms

   Retention | While the account exists. Never-subscribed anonymous accounts: 90 days after last open (coming, S4). Auth logs: per Supabase plan (Pro: 7 days)

   Security | Section 6; session in the iOS keychain / Android Keystore (AFTER_FIRST_UNLOCK); anonymous sign-ins limited to 30 an hour per IP

   PA2. Children (live)

   Field | Entry

   Purpose | Say whose saying it is; work out each child's exact age at the time of a saying

   Lawful basis | Legitimate interests, 6(1)(f): the parent's interest in keeping their child's words, and Wamemba me's in providing the service the parent asked for. LIA: lawful-basis-and-retention.md 1.2

   Data subjects | Children of the parent's family (spec audience: 2 to 8 years old)

   Data categories | First name; birthday (optional). No surname, photo, school or location is asked for

   Recipients | Supabase

   Transfers | As PA1

   Retention | Until the parent deletes the child or the account (a child with sayings must have them removed first; a whole family deletes cleanly)

   Security | Section 6; RLS: members of the family only; viewers read, never write

   PA3. Sayings, made-up words and their meanings (live)

   Field | Entry

   Purpose | Keep the funny things and made-up words a family's children say; each child's word dictionary

   Lawful basis | Parent: contract, 6(1)(b). Child and other named speakers: legitimate interests, 6(1)(f)

   Data subjects | Children; the parent; other people a parent names as a speaker ("Dad", "the bus driver")

   Data categories | Saying kind, context line, date said, lines with speaker (child id or a free-text name) and text, made-up word flag; the private meaning of a word (word_meanings, parents only); created-by user id

   Dictation | On the device only: iOS expo-speech-recognition with on-device recognition required (a patch refuses to start when on-device recognition is unavailable); Android 13+ createOnDeviceSpeechRecognizer. No audio leaves the phone, and the dictation audio is not kept. Older devices and non-English iPhones type instead

   Recipients | Supabase. A copy is kept on the parent's phone (AsyncStorage, per account) until synced and after

   Transfers | As PA1

   Retention | Until the parent deletes the saying, the child or the account; backups 7 days

   Security | Section 6; save_saying() runs as the caller (security invoker), so every write passes RLS; meanings in their own table so a viewer's read of lines can never include them

   PA4. Children's voice clips (coming, S3)

   Field | Entry

   Purpose | Let a parent attach a short recording of the child saying it again, to play back to the family and on shared links

   Lawful basis | Parent: contract, 6(1)(b). Child: legitimate interests, 6(1)(f), with the higher bar recorded in the DPIA (R3)

   Art. 9 | Not special category: the clip is stored and played back, never processed to identify anyone (DPIA 4.3). Re-assess if any voice feature beyond playback is proposed

   Data categories | Audio file (clip_path), the saying it belongs to

   Recipients | Supabase Storage (private bucket, signed URLs); people the parent shares with

   Retention | With the saying

   Security | Private bucket, signed URLs with a short life, RLS on the path

   PA5. Cards, shared links and the share page (coming, S3)

   Field | Entry

   Purpose | Turn a saying into a card or a private link (wamemba.me/s/<token>) that relatives open in a browser

   Lawful basis | Contract, 6(1)(b), on the parent's instruction; child: legitimate interests, 6(1)(f)

   Data subjects | Children; speakers; viewers of a link (IP in logs)

   Data categories | Context, lines with speakers' first names, each child speaker's age (never birthday, surname or meaning), clip URL; token, revoked_at; viewer IP and user agent in server logs

   Recipients | Anyone with the link; Vercel (page hosting); the platforms the parent shares to (WhatsApp, Instagram, Messages: independent controllers for what the parent sends)

   Retention | Until the parent revokes the link or deletes the saying or account. A card image already sent is outside our control

   Security | Unguessable token; security-definer read function that checks revoked_at and returns only the fields above; caching and rate limits (spec §10 lesson 6)

   PA6. Family circle: partners, grandparent viewers, weekly email (coming, S6)

   Field | Entry

   Purpose | Invite a partner (full access) and grandparents (read only); send a weekly "new sayings" email

   Lawful basis | Partner and viewers: contract with the inviting parent and with each invitee who accepts, 6(1)(b). Weekly email: the viewer's request (contract) with one-tap unsubscribe

   Data categories | Invitee name or label, email address, role, invitation status

   Recipients | Supabase; Resend (email, coming, not used yet)

   Retention | While the membership exists; invitation emails deleted when declined or expired (rule to be set in S6)

   PA7. Subscriptions, trials and gifts (coming, S4 and S6)

   Field | Entry

   Purpose | Sell subscriptions through the App Store and Google Play; trials; restore purchases; grandparent gifts

   Lawful basis | Contract, 6(1)(b); tax records: legal obligation, 6(1)(c)

   Data categories | RevenueCat app user id (= Supabase user id), product, store, period, status, transaction ids, ownership type (PURCHASED or FAMILY_SHARED), transfer events. No card data: Apple and Google are the merchants of record

   Recipients | RevenueCat (processor, coming); Apple and Google (independent controllers for the purchase)

   Transfers | RevenueCat: US (see TRA)

   Retention | Subscription rows while the account exists; transaction records 6 years (HMRC)

   PA8. Notifications (coming, S4 and S8)

   Field | Entry

   Purpose | Trial reminder on day 5; "On this day"; the 7-day notice before an unused account is removed

   Lawful basis | Contract, 6(1)(b); the parent allows notifications in the operating system

   Data categories | Push token, notification type, send time. Lock-screen text never quotes a saying (rule from Doxa's PR #3086)

   Recipients | Expo push service, Apple APNs, Google FCM

   Retention | Token while the account exists and the token is valid (dead tokens removed, spec §10 lesson 9)

   PA9. Crash reports (live)

   Field | Entry

   Purpose | Find and fix faults

   Lawful basis | Legitimate interests, 6(1)(f)

   Data categories | Error, stack trace, release, device model, OS version, Supabase user id, scrubbed breadcrumbs (no console lines; taps recorded as "touch" only); performance traces (20% sample in production). sendDefaultPii off; no screenshots, view hierarchy or replay

   Recipients | Sentry (Functional Software, Inc.), organisation wamemba-me in the EU data region

   Transfers | Stored in the EU (adequacy). Remote access by a US company: see TRA

   Retention | Sentry plan default (register)

   PA10. Product analytics (live)

   Field | Entry

   Purpose | Learn whether the app works for families (activation, capture speed) without reading content

   Lawful basis | UK, EU, EEA, CH: consent, 6(1)(a), and PECR regulation 6 for the device identifier. Elsewhere: legitimate interests, 6(1)(f), with an opt-out

   Data categories | The events declared in app/src/lib/analytics.ts (app opened, account created, signed in, linked, saying saved with method, kind and milliseconds, checked with counts, deleted, child added with has_birthday, dictation unavailable or failed with a fixed reason); app lifecycle events; device and app properties the SDK adds; Supabase user id as distinct id. sanitise() drops any value that isn't a number, boolean or fixed word. No session recording. IP anonymised in the project (unverified in theboth read in PostHog project settings for this recordon 2026-10-14: anonymize_ips on, session recording off; action L6AI training not opted in)

   Recipients | PostHog (EU Cloud, Frankfurt), its own organisation "Wamemba me"

   14 unchanged paragraphs

   Consent mechanism | app/src/lib/privacy.ts: default off in the UK, EEA and CH, and when the region is unknown. The consent screen arrives in S4; until then those devices send nothing. Gap: no opt-out switch elsewhere yet (action L7)

   Retention | Target 12 months (privacy policy); unverified whether the plan allows it (register)

   PA11. Website, waitlist and legal site (live)

   Field | Entry

   Purpose | Tell people about Wamemba me; keep a waitlist; publish the legal documents and their history

   Lawful basis | Waitlist: consent, 6(1)(a). Server logs: legitimate interests, 6(1)(f)

   Data categories | Waitlist: email (lower case), source tag, created_at, confirmed_at (unused: no confirmation email is sent yet). Server logs: IP, user agent, URL, time

   Recipients | Vercel (hosting); Supabase (join_waitlist(); anon can execute only that function, which returns nothing)

   Cookies | None. No analytics, no third-party scripts or fonts (checked 2026-10-14: no set-cookie, no external resources)

   Retention | Waitlist: until unsubscribe or request, and at most 12 months after launch (action L8, manual)

   PA12. Support and privacy requests (live)

   Field | Entry

   Purpose | Answer messages; handle data subject requests and complaints

   Lawful basis | Legitimate interests, 6(1)(f); legal obligation, 6(1)(c), for rights requests

   Data categories | Email address, message content, account id where given

   Recipients | Namecheap (email forwarding of hello@wamemba.me); the destination mailbox (unverifiedGoogle Workspace, where the forward lands: which garth@doxa.app, a mailbox the forward goes toof The Doxa Way Ltd (Namecheap Redirect Email settings, read 2026-10-14; action L9garth@wamemba.me forwards there too)

   Retention | 2 years after the last message; request log 6 years (dsar-procedure.md)

   35 unchanged paragraphs

   PA13. Account deletion, export and clean-up (coming, S4)

   Field | Entry

   Purpose | In-app account deletion (App Store 5.1.1(v)); export at any time (spec §3 rule 3); removal of never-subscribed anonymous accounts after 90 days without an open

   Lawful basis | Legal obligation, 6(1)(c) (rights requests); contract; storage limitation principle

   Status | Not built. Until then: by email, by hand (dsar-procedure.md). The clean-up has a prerequisite: the "gone" screen needs a carry-over before it is switched on (docs/decisions/2026-10-14-session-for-deleted-account.md)

   PA14. Creator and press outreach (live, small)

   Field | Entry

   Purpose | Offer parent creators the app and ask about posts; pitch press (spec §7)

   Lawful basis | Legitimate interests, 6(1)(f); PECR: business contacts or public creator contact addresses only

   Data categories | Name or handle, public contact address, platform, outreach notes, their reply

   Recipients | The company's mailbox and outreach document

   Retention | 12 months after the last contact; immediately on request (suppression entry kept)

   PA15. Engineering operations (live)

   Field | Entry

   Purpose | Build and run the service: migrations, smoke tests, incident checks

   Lawful basis | Legitimate interests, 6(1)(f)

   Data categories | Production database reads through the Supabase Management API (aggregate and schema queries; smoke-test rows)

   Recipients | Anthropic (Claude Code sessions run by the company). Gap: which commercial terms cover these sessions (register; action L10). Rule meanwhile: no reads of family content in operations sessions unless a parent asked for help, and then only that family

   Retention | Session transcripts per the vendor's terms

   5. Rights handling

   dsar-procedure.md. Breaches: breach-response.md.

   6. Security measures (Article 32)

   Measure | State

   Encryption in transit | TLS on every connection (HSTS on wamemba.me)

   Encryption at rest | Supabase (AWS) disk encryption

   Access control in the database | RLS on every public table; deny by default; anon has no table access; anon EXECUTE revoked except join_waitlist(); one pgTAP file per table run as anon, owner, viewer and another family's member on prod's exact Postgres image on every PR (gate.yml db job)

   Change control | Every change through branch → PR → the recursive quality gate (.claude/skills/quality-gate/SKILL.md); critical tier for database, auth, export and delete, sharing and money

   Secrets | Keychain and EAS sensitive variables; no service keys in the app

   On the phone | Session tokens in the keychain; sayings in the app sandbox (AsyncStorage, not encrypted beyond the OS's file protection: DPIA R7)

   Telemetry minimisation | Sentry scrubbing and no screenshots; analytics sanitise(); tests guard both

   Backups | Supabase daily physical backups, kept 7 days; no point-in-time recovery (read 2026-10-14)

   People | One director; engineering by agents under Garth's account, through the gate

   7. Open items

   ID | Item | Owner

   L1 | Confirm The Doxa Way Ltd's ICO registration is complete, and that its description covers Wamemba me | Garth

   L2 | EU storefronts: appoint an EU representative or exclude EU/EEA at launch | Garth

   L3 | Sentry: accept the DPA for organisation wamemba-me (per-organisation acceptance) | system (browser), Garth if a signature is needednot accepted, read 2026-10-14; aggregated identifying data is already off) | Garth (a contract)

   L4 | PostHog: execute the DPA for organisation "Wamemba me" | system (browser), Garth if a signature is needed

   L5 | Solicitor opinion: COPPA and UK GDPR (spec §9), terms, trademark (solicitor-brief.md) | Garth

   L6 | Confirm PostHog project settings: discard IP, and no recordings, done (2026-10-14); retention depends on the plan (register) | system

   L7 | Analytics consent and opt-out screen in onboarding and Settings (S4), before public release | system

   L8 | Waitlist deletion 12 months after launch | system

   L9 | Record where hello@wamemba.me forwards; add : done (garth@doxa.app, 2026-10-14). Add privacy@wamemba.me | system: open (at not needed while hello@ is the Namecheap sessionpublished address) | system

   L10 | Claude Code for operations: confirm commercial terms (no training) for the account used | Garth

   3 unchanged paragraphs

   L11 | In-app delete and export before the first public store release (App Store 5.1.1(v); spec §3 rule 3) | system

   8. Review

   Every 6 months, and whenever a slice in spec §6 lands, a vendor changes, or a "coming" activity goes live. Next review: 2027-04-15.

2. Version 1.0

   First version

   In effect from 15 October 2026 · Published 14 October 2026

   First version.

   Read this versionPull request #52Commit 9c93223