Privacy notice for members

This notice is for you if you use Doshi inside the app or website of your bank, building society, lender or other provider. We call them "your provider". If you use the Doshi app you downloaded yourself, read the Doshi app privacy policy instead.

The short version

Who we are: Doshi App Limited runs the money lessons, journeys and rewards your provider offers you.
Who decides: Your provider decides why your data is used to run Doshi for you, and we follow its instructions. For a few purposes of our own, listed in section 5, we decide.
What your provider sees: That you use Doshi, when, and the rewards you redeem. Your answers only ever reach it as totals, and a group of fewer than 10 members is hidden.
What we never do: Sell your data, or use it for advertising.
Where it is kept: In the United Kingdom. The Journey builder and the coach send what you tell them to an AI model in the European Union.
Your rights: Ask for a copy, a correction or deletion at privacy@doshi.app.

1. Who we are

Doshi App Limited is a company registered in England and Wales (company number 13807674). Our registered address is 101 Chesterton Road, London W10 6ET. You can reach us about your data at privacy@doshi.app.

2. Who is responsible for your data

Your provider chose Doshi to offer you money lessons inside its own app or website. When we run that service, your provider is the controller of your personal data and we are its processor. Your provider decides why and how your data is used, and we act on its instructions. Your provider's own privacy notice also applies to you, and it tells you the lawful basis it relies on.

For the purposes in section 5 under "Our own purposes", Doshi App Limited is the controller.

3. The data we keep

Account details: the ID your provider uses for you, the name and language it gives us, and when you first and last used Doshi. If you sign in to Doshi with an email address and password, we keep your email address too.
Learning progress: the lessons and courses you finish, and the links in lessons that you view or tap.
Money Confidence: your answer, from 0 to 10, to "How confident do you feel managing your money?".
Check answers: your first answer to each graded question in a lesson, and whether it was right.
Onboarding answers: your answers to the questions you see when you start, such as your age band, work status, housing, household and how you heard about the service, plus any questions your provider adds. We do not ask for your income or your date of birth.
Journey builder: the situations you pick (up to three), your answers to their questions, anything you type under "Other", and a record of each journey we suggest to you, whether you accept it or not.
Support flag: if something you tell the Journey builder suggests you may need help now, we record that and show you where to get support.
Coach: if your provider offers the coach, what you write to it, its replies, the facts about your money you share with it, and any rating or feedback you give.
Rewards: the points you earn, the rewards you choose, and, for a gift card, the email address you give us to send it to.
Technical data: the IP address and time each time your provider's app signs you in to Doshi, and server logs of errors and security events.

You do not have to answer any question. Every question can be skipped, and the service still works without your answers.

4. Circumstances you may consider sensitive

Some Journey builder options describe hard situations: someone controls your money, someone close to you has died, you are behind on payments, you are caring for someone, or you think you have been scammed. Whether you pick one is up to you.

We do not ask about your health, ethnicity, religion, sexual orientation, political views or any other special category of personal data, and we do not need it. If something you pick or type reveals it, we use it only to suggest your lessons and to show you where to get support. Your provider never sees it, except as part of a total.

Before anything you type under "Other" is sent, the app blocks card, account and phone numbers.

5. What we use your data for

For your provider

To run the service: show your lessons, keep your progress, run rewards and send gift cards.
To tailor your journey: choose lessons from your Onboarding answers and your Journey builder picks.
To answer the coach: reply to what you ask, using what you have told it.
To give your provider Insights: counts, shares and averages over groups of members. No answer of one member is shown. A group of fewer than 10 members is hidden. What you type, under "Other" or in a short-text answer, is never shown, only how many people answered.

Your provider chooses the lawful basis for these purposes. Its privacy notice tells you which.

Our own purposes

To improve our questions: we read what members type under "Other", with nothing that identifies them, to find the options our questions are missing. Our lawful basis is legitimate interests: better questions mean better journeys for every member.
To keep the service secure and working: logs, security monitoring and looking into misuse. Our lawful basis is legitimate interests.
To meet the law: keeping records or answering a regulator when the law requires it. Our lawful basis is legal obligation.

You can object to the purposes based on legitimate interests. See section 10.

6. Who we share it with

Your provider: In the Console it sees your ID, your name and language, when you first and last used Doshi, and the rewards you redeem. It sees your answers only as totals, as section 5 describes. It never sees your coach conversations or what you type.
Our service providers: Supabase hosts our database, and Amazon Web Services hosts the service, sends our emails and runs the AI model. They act only on our instructions.
The AI model: the Journey builder sends your picks, your answers and your "Other" text, and the coach sends your messages, to an Anthropic model that Amazon Web Services runs through Amazon Bedrock in the European Union. Amazon Web Services does not use them to train models, and does not pass them to Anthropic.
Our gift card supplier: receives the order, but not your name or email address.
Others, only if we must: a regulator, court or the police when the law requires it, or a buyer of our business, who must use your data as this notice describes.

7. Where your data is processed

We store your data in the United Kingdom, in Amazon Web Services' London region. When you use the Journey builder or the coach, it is also processed in countries in the European Union. UK law recognises the European Union as protecting personal data to the UK's standard.

Some of our service providers may reach data from outside the UK to support their service. When they do, a contract approved under UK law protects it.

8. If you live in Australia

Your provider is responsible, under the Australian Privacy Principles, for disclosing your personal information to us overseas. Your personal information is held in the United Kingdom. When you use the Journey builder or the coach, it is also processed in countries in the European Union.

If you have a concern, contact your provider or us at privacy@doshi.app. If you are not satisfied with the answer, you can complain to the Office of the Australian Information Commissioner at www.oaic.gov.au.

9. How long we keep it

While you use Doshi: we keep your data until your provider removes your data from Doshi.
When your provider removes your data: everything in section 3 is deleted. We keep only a count of removed members, which has nothing about you, and a one-way code made from your provider's ID for you, so a repeat request is recognised. Sign-in records stay without anything that links them to you.
When your provider stops using Doshi: we delete its members' data within 30 days of its contract ending.
Gift card email address: deleted 90 days after the reward is sent or closed.
Resetting your progress: if your provider lets you reset, a reset deletes your progress, your answers, your journeys, your coach conversations, and your points and rewards, but keeps your account.
Backups: copies in our backups are deleted as the backups expire.

10. Your rights

You can ask us to:

give you a copy of your data;
correct data that is wrong;
delete your data;
limit how we use it;
stop using it for a purpose based on legitimate interests;
send your data to you or to someone else in a common format.

The app does not show your Onboarding answers yet. To see them, ask for a copy.

Email privacy@doshi.app, or ask your provider. Where your provider is the controller, we pass your request to it and help it answer. We reply within one month, and we may ask you to confirm who you are first. There is usually no fee.

You can also complain to the Information Commissioner's Office at ico.org.uk. If you live in Australia, see section 8.

11. Security

Only the people and systems that need your data can reach it. Data is encrypted in transit and at rest. If a breach puts your data at risk, we tell your provider and, where the law requires it, you and the regulator. To report a security issue, see our security page.

12. Changes to this notice

When this notice changes, we update the date below and list the change here. If a change affects how your data is used, we tell your provider so that it can tell you.

What changed

27 October 2026: first version.

Last updated: 27 October 2026