Solicitor brief

From: The Doxa Way Ltd (company 16744139), Garth Watson, director · Contact: hello@wamemba.me Wanted: (A) a short written opinion on UK GDPR and COPPA for a parent-operated app that keeps data about young children; (B) a review of our consumer terms and privacy policy; (C) a trademark clearance opinion for WAMEMBA ME. A US-qualified lawyer is needed for the COPPA and US questions.

Important. Every document listed below was drafted by an AI agent (Claude) using published guidance and vendors' own terms. No lawyer has reviewed any of it. Facts we could not verify are marked "unverified" in the documents. Please treat the drafts as a well-organised starting point, not as positions we are attached to.

1. The product in one paragraph

Wamemba me (an app for iPhone and Android, plus the site wamemba.me) lets parents of children aged about 2 to 8 save the funny things and made-up words their children say. The parent presses one button, says what the child said, and the phone transcribes it on the device; the audio is discarded. The app keeps the child's first name and (optionally) birthday, so it can show the exact age ("3 years 7 months"). Later features: the parent can record the child saying it again (a short voice clip, stored by us); turn a saying into a card or a private link for grandparents (first name and age only); invite a partner and grandparents; and subscribe ($1.99 a month or $19.99 a year through the App Store or Google Play, with a 7-day free trial on one test arm, and a grandparent gift plan). No ads, no AI training on family data, no AI voice clones, no sale of data. Every install starts with an anonymous account; never-subscribed anonymous accounts are deleted after 90 days without an open. Lapsed subscribers keep read and export access forever. The app is in internal testing today; nothing is on sale.

2. What has been drafted (all in docs/legal/, published with version history at insight.wamemba.me)

3. Questions

A. Data protection (UK GDPR, with EU notes)

Q1. Lawful basis for the child's data. We rely on contract (6(1)(b)) for the parent and legitimate interests (6(1)(f)) for the child and other people named in a saying, with a written LIA (lawful-basis-and-retention.md 1.2). We do not use the parent's consent on the child's behalf. Is this sound? Would you expect the regulator to prefer another basis?

Q2. Children's Code. We concluded the service is not "likely to be accessed by children" (dpia.md section 3): the users are adults, the children are only the subjects of the data, and the app is a paid Lifestyle app. We adopt the Code's standards voluntarily. Is the conclusion defensible, and what evidence should we keep? Does the "children's higher protection matters" duty (Art. 25(1A), in force 5 February 2026) reach us if the Code does not?

Q3. Controller or household. We treat ourselves as controller of the family's content (Recital 18), with the parent's own use being household activity. Correct? Does anything change when the parent shares a link outside the household?

Q4. Voice clips. We treat a stored and replayed clip of a child's voice as ordinary personal data, not biometric (ICO biometric guidance), and commit never to analyse, recognise or clone voices. Agreed? Any additional safeguards you would expect for children's audio?

Q5. Retention. Lapsed subscribers keep their data until they delete it, by promise (spec: "a lapsed subscription never removes read or export access"). Is indefinite retention for an inactive account compatible with storage limitation if the purpose is the family's own archive? Would a re-check after several years of no activity (dpia.md A9) be enough?

Q6. A child's own rights; separated parents. dsar-procedure.md 3.3 lets a competent child (from about 12) ask us directly to see or delete sayings about them, and tells the account holder first unless that is not in the child's best interests. A non-account-holder parent who asks for a child's sayings is refused without the account holder's agreement. Are these right? How should we handle a dispute between parents?

Q7. EU. If we offer the app in EU storefronts with local prices, do we need an Article 27 representative from day one (we think yes)? Any lighter route?

Q8. Crash reporting and PECR. We treat the Sentry SDK's on-device report cache as strictly necessary (PECR reg. 6(4)(b)). For analytics we ask for consent in the UK although the statistical-purposes exception (PECR Sch. A1 para. 5(1)(c), from 5 February 2026) may allow an opt-out. Comfortable with both?

B. COPPA and US law (US counsel)

Q9. Is Wamemba me an operator collecting personal information "from a child"? The parent enters the child's name, birthday and words (FTC FAQ A.8 suggests this is outside COPPA). The open question is the voice clip: the parent records the child saying something again, on the parent's phone, in the parent's paid account. Does this count as collecting from a child under 16 CFR 312 as amended in 2025 (compliance date 22 April 2026)? If yes, is the store subscription purchase, or another method, a workable verifiable parental consent? What design rules keep us outside COPPA (for example, never addressing the child in the UI)?

Q10. "Directed to children". The brand uses a crayon style and an animated (no filmed child) onboarding film about children. Could this support a "directed to children" finding under the totality-of-circumstances test? What should we avoid in store art and marketing?

Q11. State privacy laws. We are below CCPA thresholds and give everyone the same rights. California regulations from 1 January 2026 treat data of known under-16s as sensitive personal information. Our notice says we use it only to provide the service and do not sell or share. Is the US section of privacy.md adequate? Any state where we would be in scope early?

Q12. US terms. Our terms are one plain English-law set (no arbitration, no class waiver, no "as is" disclaimer). Do we need US-specific clauses, and which would you recommend for a consumer app of this size?

C. Consumer terms (UK)

Q13. Cancellation rights and store purchases. Apple and Google are the merchants of record. Do we owe consumers anything under the Consumer Contracts Regulations 2013 (reg. 37 consent and acknowledgement for digital content) when the store sells the subscription? Is terms.md 7.2 accurate?

Q14. DMCC Act subscriptions (from January 2027). Which duties (pre-contract information, reminders, easy exit, cooling-off after a trial converts and at annual renewal, refunds) fall on us rather than on Apple and Google? Is a prepaid, non-renewing gift outside the regime?

Q15. Unfair terms. Please review terms.md against CRA 2015 Part 2 and CMA37 (2026), in particular: the content licence (s.4), removal and suspension (s.5, s.11), the 60 days' notice and export on closure (s.10), liability (s.12, no cap by choice), changes (s.14), and incorporating "our promises" as contractual (s.9). Are the promises enforceable as drafted, and is that wise?

Q16. Apple EULA. We propose to keep Apple's standard EULA and link our terms. Is terms.md s.13 needed or harmful in that case? If we use a custom EULA, what must it contain?

Q17. Gifts. A grandparent buys a year for a family (mechanism not decided: store purchase or web). What rules are needed (vouchers, expiry, refunds, who the consumer is)?

D. Marketing with children

Q18. Parent creators will be offered the app free and asked to post (labelled "Ad" or "Gifted"; the child not shown or heard while this opinion is pending). When may a creator's own child appear or be heard in a gifted or paid post in the UK (child performance licensing; CAP Code; ASA rulings) and the US (FTC Endorsement Guides)?

E. Trademark

Q19. Clearance opinion for WAMEMBA ME (word) and the handwriting logo in classes 9 (apps), 42 (software as a service) and possibly 41/45, UK and EU, in light of an EU/UK MEMBA class 9 mark (spec §9) and the dating app Wamba. Should we file in the UK first, and in which classes? Any risk in the US?

4. What a lawyer must confirm before public launch

1. Q1, Q2, Q4, Q6: the UK GDPR position on children's data (with any changes to privacy.md and dpia.md).
2. Q9 and Q10 before voice clips ship (the COPPA opinion the spec requires, §9).
3. Q13 to Q16: the terms, as published to consumers.
4. Q7: the EU position, if the EU is in the launch.
5. Q19: trademark clearance before filing and before significant launch spend.

5. What we will provide

Read access to the documents above (public at insight.wamemba.me), the product spec, screenshots of the onboarding and paywall when built, and a call with the director. Budget and fee basis to be agreed (fixed fee preferred).