Privacy notice for client staff

This notice is for you if you use the Doshi Console for your employer, a bank, building society, lender or other organisation that offers Doshi to its customers. We call that organisation "your employer". If you are a member using Doshi inside your provider's app, read the privacy notice for members instead.

The short version

• Who decides: Doshi App Limited is the controller of your Console account and the record of what you do in the Console.
• What we keep: your email address, your roles, who invited you, and what you do in the Console.
• Why: to let you sign in, to keep the Console secure, and to show your employer who did what.
• Your rights: Ask for a copy, a correction or deletion at privacy@doshi.app.

1. Who we are

Doshi App Limited is a company registered in England and Wales (company number 13807674). Our registered address is 101 Chesterton Road, London W10 6ET. You can reach us about your data at privacy@doshi.app.

We are the controller of the personal data this notice describes. Members' data you work with in the Console is covered by the privacy notice for members.

2. The data we keep

• Account details: your email address, the roles you hold, who invited you and when, and when you were removed.
• Sign-in: the one-time codes we email you to sign in, which expire after 15 minutes, and when you sign in.
• Audit trail: what you do in the Console, such as inviting staff, publishing lessons, or reviewing rewards, and when.
• Technical data: your IP address and server logs of errors and security events.

3. What we use it for

• To let you sign in and use the Console: our lawful basis is legitimate interests, ours and your employer's, in running the service your employer has contracted.
• To keep the Console secure: spotting misuse and looking into incidents. Our lawful basis is legitimate interests.
• To show your employer who did what: your employer's staff can see who made some changes, such as changes to rewards. Our lawful basis is legitimate interests.
• To send you Console emails: invitations and sign-in codes. Our lawful basis is legitimate interests.
• To meet the law: when the law requires it. Our lawful basis is legal obligation.

You can object to the purposes based on legitimate interests. See section 6.

4. Who we share it with

• Your employer: its Admins see your account and your roles, and its staff see who made some changes, such as changes to rewards.
• Our service providers: Supabase hosts our database and sign-in, and Amazon Web Services hosts the service and sends our emails. They act only on our instructions.
• Others, only if we must: a regulator, court or the police when the law requires it, or a buyer of our business, who must use your data as this notice describes.

We store your data in the United Kingdom, in Amazon Web Services' London region. Some of our service providers may reach data from outside the UK to support their service. When they do, a contract approved under UK law protects it.

5. How long we keep it

• While your employer uses the Console: we keep your account and the audit trail, including after you are removed, so your employer can still see who did what.
• When your employer stops using Doshi: we delete its staff accounts and audit trail within 30 days of its contract ending.
• Backups: copies in our backups are deleted as the backups expire.

6. Your rights

You can ask us to:

• give you a copy of your data;
• correct data that is wrong;
• delete your data;
• limit how we use it;
• stop using it for a purpose based on legitimate interests;
• send your data to you or to someone else in a common format.

Email privacy@doshi.app. We reply within one month, and we may ask you to confirm who you are first. There is usually no fee. We may keep the audit trail after a deletion request where your employer needs it to show who did what.

You can also complain to the Information Commissioner's Office at ico.org.uk.

7. Changes to this notice

When this notice changes, we update the date below and list the change here.

What changed

• 27 October 2026: first version.