Doxa Privacy & Data Protection Policy

1. Who We Are

The Doxa Way Ltd ("Doxa", "we", "us") provides the Doxa mobile app, the doxa.app website and web app, the Doxa bots on Telegram and Discord, and the Doxa connector for ChatGPT and other AI assistants (together, "the Service"). We are the controller of the personal data described in this policy, except where Section 9 says that a church is the controller.

• Company number: 16744139 (registered in England and Wales)
• Registered address: 108 Kings Road, New Haw, Addlestone, KT15 3BH, United Kingdom
• Privacy contact: privacy@doxa.app (this reaches our privacy lead; see Section 16)
• POPIA Information Officer (South Africa): Garth Hilton Watson, privacy@doxa.app

3. What Data We Collect

Account and profile

• Name and email address (needed to create an account)
• Profile picture, bio and location, if you add them
• Sign-in method (email and password, Sign in with Apple, or Google Sign-In). Passwords are stored only as a hash
• The versions of our terms and this policy you accepted, your confirmation that you are 13 or older, and when and which version of the explicit consent in Section 5 you gave

What you record (special category data)

• Prophecies, testimonies, encouragements, prayers and notes, with the tags, dates and other details you add
• Voice recordings you make to transcribe a record, and images you upload
• What you say or type in Doxa Engage, and short notes Doxa saves after a session to help later sessions (for example what encourages you, and facts you stated, such as a family name or a health condition)
• Your Bible reading and Bible searches

This content can show your religious beliefs. It can also include other special category data, such as facts about your health, and information about other people. Section 5 explains how we handle it.

Groups and churches

• Groups and church boards you belong to, your role, and invitations you send or receive
• Content you choose to share with a group or a church board, and weighing notes written there

Subscriptions and payments

• Your plan, its status and usage counts (for example Engage minutes)
• In-app purchases are processed by Apple or Google, and web purchases by Stripe. We do not receive or store your full card number

Technical and usage data

• Device type, operating system and app version
• IP address, used for security, rate limiting and to deliver the Service
• Error reports from Sentry, linked to your Doxa user ID. A small sample of app sessions is recorded as a session replay with all text, images and graphics masked. Earlier versions of the app also attached an unmasked screenshot of the screen when an error happened, which could show your own content; versions of the app after 3.1.0 do not
• Product analytics from PostHog, linked to your Doxa user ID (and, in the mobile app, your email address): screens you open, features you use, and session replays. In the mobile app, session replay masks all text and images. In the web app, it masks what you type, but other text on the screen, including your records, can be recorded. Earlier versions of the mobile app could also send the text of an item you tapped; versions of the app after 3.1.0 do not
• Page views and events from Google Analytics 4 on the doxa.app website and web app (see Section 17)

Bots and AI assistants

• Doxa bots on Telegram and Discord: your platform user ID and username, and the messages you exchange with the bot
• Doxa in ChatGPT and other AI assistants: what the assistant sends to Doxa's tools (Section 8)

When you contact us

• Your emails to support@doxa.app or privacy@doxa.app and our replies

What we do not collect

• Precise GPS location
• Your contacts, or photos and files you have not chosen to upload
• Biometric data. If you unlock Doxa with Face ID, Touch ID or a fingerprint, your device does this. We never receive the biometric data

4. Why We Use Your Data, and Our Lawful Basis

The law requires a lawful basis for each use of personal data (Article 6), and an additional condition for special category data (Article 9). This table shows ours.

Where we rely on legitimate interests, we have balanced our interest against your rights, and you can object at any time (Section 11). Where we rely on consent, you can withdraw it at any time. Withdrawal does not make earlier processing unlawful.

6. Who Receives Your Data

We do not sell, rent or trade your personal data. We share it only with the organisations below, and only for the reasons given.

Processors: providers that act for us

These providers act on our behalf, as processors. "DPF" means the EU-US Data Privacy Framework and its UK Extension (the UK-US data bridge). "SCCs" means the European Commission's Standard Contractual Clauses (2021) with the UK Addendum issued by the Information Commissioner.

Controllers: organisations that decide for themselves

These organisations receive personal data through Doxa but decide for themselves how to use it, under their own privacy policies. They are independent controllers, or, for Meta, a joint controller with us.

Meta joint controller arrangement.For the Meta SDK, the Meta Pixel and the Conversions API, Doxa and Meta are joint controllers for collecting the data and sending it to Meta, under Meta's Controller Addendum. In short: Doxa is responsible for telling you about this collection (this policy) and for its lawful basis; Meta is responsible for its own processing after it receives the data, including your rights over that data. You can contact either of us. If you contact us, we will pass your request to Meta where needed.

Other disclosures

We may disclose personal data where the law requires or allows it: to comply with a court order or a legal obligation, to protect someone's life, to prevent fraud or crime, or to establish or defend legal claims. If we sell or merge our business, the buyer would receive your data under this policy, and we would tell you first. Where the law allows, we will tell you about a request from an authority.

Changes to our providers

We update this page when we add or change a provider. For an important change we also tell you in the app or by email. You can object by writing to privacy@doxa.app.

7. International Transfers

Doxa's database is in the United Kingdom. When a provider in Section 6 processes data in another country, the law calls this a restricted transfer. We make each transfer under one of these safeguards:

• Adequacy. Transfers between the UK and the EEA rely on adequacy decisions. The European Commission renewed its decisions for the UK in December 2025, valid to December 2031.
• Data Privacy Framework.For a US company certified under the EU-US Data Privacy Framework and its UK Extension, transfers rely on that certification. We keep the SCCs in place as a fallback where the provider's contract includes them.
• Standard Contractual Clauses.For other providers, transfers rely on the European Commission's Standard Contractual Clauses (2021) with the UK Addendum, in the provider's data processing agreement.

Where we rely on Standard Contractual Clauses, we carry out a transfer risk assessment, following the Information Commissioner's guidance, and keep it on record. It looks at the data sent, the laws of the destination country, and the extra protections we use: encryption in transit, sending no name, email or account ID to AI providers, and short retention where the provider offers it.

Some providers are US companies, so the data they process can be subject to US law. Section 6 lists which providers process data in the USA. You can ask us for a copy of the safeguard for any transfer at privacy@doxa.app.

9. Churches: Who Is Responsible for What

A church can use Doxa to record, weigh and hold the words spoken over it, on a private church board. Data protection law asks who decides why and how the data is used. On Doxa:

• The church is the controller of its church board. This is what the church records there: the words, who spoke them and when, weighing notes, held words, and who has which role. The church decides what to record and who can see it. Doxa processes this content for the church, only to provide the board.
• Doxa is the controller of each member's own accountand personal Encouragement Vault. A personal word stays in that person's own Encouragement Vault. It appears on a church board only if they bring it there.
• Doxa is also the controller of what it needs to run the Service for everyone: accounts, sign-in, billing, security, legal records and product analytics.

A church that uses a board is responsible for its own lawful basis for what it records, and for telling its members about it. A church can ask us for Doxa's Data Processing Terms for Churches (the Article 28 terms under which we process church board content) by writing to privacy@doxa.app. The same providers, locations and transfer safeguards in Sections 6 and 7 apply to church boards. A church can ask us at any time for a copy of its board, or to delete it.

10. Churches and Leaders We Contact

We write to churches, church leaders and partners about Doxa. We find their work contact details on public sources, such as church websites and directories, or receive them when they write to us. We keep their name, role, organisation, contact details and our emails with them in our contact manager (Clarify, Section 6). Our lawful basis is legitimate interests: telling churches about a service that can help them. If you are one of these contacts, you can ask us to stop at any time by replying or writing to privacy@doxa.app. We will then stop contacting you and delete your details, keeping only what we need to make sure we do not contact you again.

12. How Long We Keep Data

When you delete your account, we also ask our processors to delete your data. We may keep data longer only if the law requires it or to establish or defend a legal claim.

13. Children and Young People

You must be at least 13 years old to use Doxa. If the law where you live sets a higher age for consenting to online services on your own (in some European countries it is up to 16) and you are under that age, you need your parent's or guardian's permission to use Doxa. We do not knowingly collect data from children under 13. If you think a child under 13 has an account, write to privacy@doxa.app and we will delete it.

Young people aged 13 to 17 can use Doxa, so the ICO's Age Appropriate Design Code (the Children's Code) applies to us. Doxa shows no ads, does not collect precise location, keeps records private unless you choose to share them, and does not sell personal data or use records for advertising.

14. Automated Decision-Making

We do not make decisions about you by automated means alone that have legal effects or similarly significant effects (Article 22). Our AI features help you: they transcribe, suggest titles, draft reminders and offer encouragement. They do not decide anything about your rights. An automated safety check can stop a piece of content from being shared; if this happens and you disagree, write to us and a person will review it.

15. Security and Data Breaches

• Encryption in transit (HTTPS/TLS) for all connections
• Encryption at rest (AES-256) for the database and file storage
• Row-level security in the database, so each account can reach only what it is permitted to see
• Rate limiting against abuse and brute-force attempts
• Access to production data limited to the people and systems that need it

If a personal data breach happens, we will tell the ICO within 72 hours of becoming aware of it, where the law requires this. If the breach is likely to put your rights and freedoms at high risk, we will tell you without undue delay, explain what happened, and say what you can do. We record every breach, its effects and what we did about it.

You can help: use a strong password, keep your device locked, and tell us at once if you think someone has accessed your account.

16. Data Protection Officer

We have not appointed a Data Protection Officer. The law requires one when an organisation's core activities include processing special category data on a large scale (Article 37). Religious-belief data is central to Doxa, but at Doxa's current size this processing is not large scale, using the factors in the regulators' guidance (the number of people, the volume of data, how long and how widely it is processed). We review this decision as Doxa grows. Our privacy lead handles all data protection matters at privacy@doxa.app.

17. Cookies and Similar Technologies

The doxa.app website and web app use cookies and similar technologies for sign-in (essential), analytics (Google Analytics and PostHog) and advertising measurement (the Meta Pixel and the X pixel, on the marketing website only). In the UK, the EEA and Switzerland, and wherever we cannot tell where you are, a banner asks you to accept or reject analytics and advertising cookies before they are set. Until you accept, Google Analytics and the Meta and X pixels do not load, and PostHog stores nothing in your browser, records no session replay and is not linked to your Doxa account. Elsewhere these load unless you reject them. You can change your choice at any time with Cookie settings in the website footer. The website does not respond to Do Not Track or Global Privacy Control signals. The mobile app uses PostHog (no cookies) and the Meta SDK, and the Android app outside the UK, the EEA and Switzerland also uses the Tenjin SDK. The app does not yet ask before PostHog stores an identifier on your device, or, on Android, before the Meta SDK reads the advertising identifier; on iPhone, the Meta SDK uses the identifier only if you allow tracking. See our Cookie & Tracking Policy.

18. Rights Under Other Laws

South Africa (POPIA)

You can access, correct or delete your personal information, object to processing, and complain to the Information Regulator. We transfer data outside South Africa under contracts that give an adequate level of protection (section 72 POPIA).

United States (state privacy laws, including California)

• You can ask to know, delete and correct your personal information, and to opt out of the sale or sharing of it. We do not sell personal information.
• Our advertising measurement (the advertising identifier in the app, the Meta and X pixels on the website, and web purchase reports to Meta) may count as "sharing" for cross-context behavioural advertising under California law. To opt out: turn off tracking for Doxa on iPhone, reset or delete your advertising ID on Android, reject or block cookies on the website, or write to privacy@doxa.app. The website does not respond to Global Privacy Control signals.
• Categories we collect: identifiers (name, email, user ID, advertising identifier, cookies), internet activity (usage and analytics), audio (voice recordings), sensitive information (religious beliefs in your records), and inferences (AI-generated suggestions). We use sensitive information only to provide the Service.
• We do not discriminate against you for using these rights.
• The Service is not directed at children under 13, and we do not knowingly collect their data (COPPA).

19. Changes to This Policy

We update this policy when what we do changes. The version number and date at the top show the current version. When we make an important change, we tell you in the app or by email before it applies, and the app asks you to accept the new version. If a change needs new consent from you, we ask for it and do not assume it. Earlier versions are listed on our version history page.

20. Contact Us

• Privacy and data protection: privacy@doxa.app
• Post: The Doxa Way Ltd, 108 Kings Road, New Haw, Addlestone, KT15 3BH, United Kingdom
• Supervisory authority: Information Commissioner's Office, ico.org.uk

This policy sets out obligations of The Doxa Way Ltd as a company. It creates no personal guarantee by any director, officer, employee or agent. Nothing in it limits any right you have under data protection law.