Transfer risk assessment

This document assesses each restricted transfer of personal data from Wamemba me to a recipient outside the UK, or to a company that can access UK-stored data from the USA. It follows the ICO transfer risk assessment (TRA) tool:

• ICO, International transfers: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/international-transfers/
• ICO, Transfer risk assessments: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/international-transfers/international-data-transfer-agreement-and-guidance/transfer-risk-assessments/
• DSIT, UK-US data bridge supporting documents (analysis of US law): https://www.gov.uk/government/publications/uk-us-data-bridge-supporting-documents

Vendor facts come from register/subprocessors.json (vendor pages read 2026-10-14; DPF participant list dated 2026-10-14). This document is not legal advice. A qualified lawyer has not reviewed it.

1. Method and design choice

For each transfer: (1) circumstances, (2) harm if a third party, including a public authority, accessed the data, (3) enforceability and the likelihood of access in the destination, (4) extra protections and conclusion.

The design keeps the sensitive data at home. The children's data (names, birthdays, sayings, meanings, clips) is stored only in Supabase's London region. What goes abroad is either telemetry without content (Sentry, PostHog: EU, adequate), technical data (Expo, Vercel), or messages that parents choose to send us (Namecheap forwarding). The one exception is remote support access to the London database by Supabase, Inc. (US).

Groups:

• Group A: UK Extension (UK-US data bridge). The recipient is certified under the EU-US Data Privacy Framework with the UK Extension. The Data Protection (Adequacy) (United States of America) Regulations 2023 make these transfers lawful without a TRA. They are recorded because certification can lapse.
• Group B: SCCs with the UK Addendum, or the IDTA. Article 46 safeguards; a TRA is required.
• Group C: EU and EEA. UK adequacy regulations cover them; no TRA needed.
• Group D: independent controllers. The parent deals with them directly (Apple, Google); not our transfer.
• Gap: no valid mechanism.

2. US law (common to US recipients)

Likelihood for Wamemba me. The data is the private family notes of ordinary households, with no intelligence value, no government or defence users, and no request ever received. Likelihood of US public-authority access: remote. Harm if it happened: moderate to high, because it concerns children.

Litigation. The EU General Court upheld the EU-US DPF (Latombe, T-553/23, 3 September 2025); an appeal is pending (C-703/25 P). If the EU decision falls, the UK Extension is likely to be reviewed. Fallbacks are listed per recipient.

3. Transfers

T1. Supabase, Inc. support access (Group B)

T2. Vercel Inc. (Group A)

Visitor IP addresses and request data for wamemba.me and insight.wamemba.me (and share pages, coming). Served at the nearest edge (London for UK visitors). DPF with UK Extension active to 2027-04-29; SCCs Modules 1-3 + UK IDTA fallback. Harm low. Lawful. Share pages (S3) will carry a child's first name, age and words: re-assess when S3 ships, and keep pages noindex with short cache rules.

T3. RevenueCat, Inc. (Group B, coming)

T4. Anthropic (engineering agents) (Group B or gap)

T5. Namecheap, Inc. email forwarding (gap)

T6. Group A recipients (no TRA required)

T7. Group D: Apple and Google stores

Apple (Apple Distribution International for UK customers) and Google act as independent controllers for store accounts, purchases and Sign in with Apple. The parent deals with them directly. Not a transfer by Wamemba me.

4. Actions

5. Review

Every 6 months, at each trigger above, and if the DPF is struck down. Next review: 2027-04-15.