Privacy Policy

To provide the service, we collect and store:

• Your account email address, used for passwordless sign-in.
• Estate data you enter: the deceased's personal details (including, where you choose to provide them, date of birth, place of birth, National Insurance number, NHS number, passport and driving licence numbers, marital status, the location of their Will, and any solicitor's details), assets, liabilities, property valuations, executor details, institution notification progress, task progress, and estate account entries.
• The email addresses of anyone you invite to access an estate — and, if someone invites you, the email address you sign in with. We use these to manage who can see each estate.
• Questions and answers you exchange with the in-app AI Assistant, and other AI-generated content such as notification letters, stored so you can return to them.
• Payment confirmation from Stripe (we do not see or store your card details — Stripe processes the payment directly).
• Basic usage data needed to operate the product (e.g. which AI features you used, for cost monitoring).

We process this data to perform the contract with you (providing the service you paid for), including managing access for anyone you choose to share an estate with, and, where applicable, to comply with our own legal obligations (such as tax and accounting records for the payment itself). We do not use your data for advertising, and we do not sell it.

People you invite. If you invite someone to an estate as an editor (who can make changes) or a viewer (who can only read), they can see that estate's data for as long as they have access. You control who has access and can remove them, or transfer ownership, at any time. Only invite people you're content to share the estate's information with.

We also share data with the following service providers (processors), only as needed to run the service:

• Supabase — hosts our database. Row Level Security restricts every query so that only people with access to an estate can see that estate's data.
• Anthropic — processes the relevant estate data you're asking about when you use an AI feature (letters, IHT explanations, the Assistant chat, glossary "explain for my estate"), in order to generate that response. Anthropic does not have standing access to your account or database.
• Stripe — processes your payment. We receive confirmation that you paid, not your card details.
• Resend — delivers your sign-in emails, estate invitation and notification emails, and any message you send via the contact form.
• Vercel — hosts and runs the application itself.

We do not sell or rent your data to anyone, and we do not use third-party advertising or analytics trackers on this site.

Some of these providers are based outside the United Kingdom, or process data on infrastructure outside the UK — including in the United States. In particular, when you use an AI feature, the relevant estate data is sent to Anthropic for processing, which may involve a transfer to the US. Where data is transferred outside the UK, we rely on the safeguards recognised under UK data protection law — such as the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses — so that your data continues to receive an equivalent level of protection. You can contact us for more detail about the safeguards in place for a particular provider.

All traffic to this site is encrypted (HTTPS/TLS). We use passwordless, magic-link sign-in, so there is no password for an attacker to steal or for you to reuse elsewhere. Database access is governed by Row Level Security, so each request can only reach the estates you have access to — the credential that bypasses this restriction is held only on our servers and is never exposed to the browser. No system is completely secure, and we cannot guarantee absolute security, but these measures reflect current good practice for a service of this kind.

We retain your estate data for as long as your account remains active, so you can return to it throughout the (often lengthy) probate process.

You can delete an estate yourself at any time. When you do, it is first marked as deleted and can be restored for 30 days; after that it is permanently and irreversibly removed by an automated process. If other people had access to that estate, they are notified and lose access immediately. You can also archive an estate, which makes it read-only without deleting it.

If you want your whole account and its data deleted, contact us (see below) and we will remove it. In either case, we keep the limited records we're required to retain for legal or accounting purposes — principally basic payment records — even after the estate data itself is gone.

We use one essential cookie to keep you signed in. We also store a small amount of information in your browser's local storage to remember your preferences and progress — for example, which estate you last had open, and whether you've seen certain introductory messages. None of this is used for advertising or analytics, and we do not use third-party tracking cookies. A short notice on the site explains this.

These rights concern information about living individuals — including you as the executor, and any living person you name in an estate record. Under UK GDPR, you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data erased, subject to the legal/accounting exceptions above;
• restrict or object to certain processing;
• receive your data in a portable format.

To exercise any of these, contact us using the details below.

If you're concerned about how we've handled your personal data, please contact us first, using the details below. We'll acknowledge your complaint within 30 days, investigate it without undue delay, and let you know the outcome.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator, at ico.org.uk. We'd appreciate the chance to resolve your concern first, but you can approach the ICO at any time.

This service is intended for adults acting as an executor or administrator of an estate. It is not directed at children, and we do not knowingly collect data from anyone under 18.

If we make material changes to this policy, we'll update the date above and, where appropriate, let existing users know.

Questions about this policy, to exercise any of the rights above, or to make a complaint, write to support@alumnai.co.uk.