Privacy Policy

1. Overview

EstatePlan Ready ("we," "us," or "our") is a web application that helps individuals organize their assets, contacts, and wishes into a comprehensive estate plan summary for attorney review. We are committed to protecting your privacy and being transparent about how we collect, use, and share your personal information.

This Privacy Policy explains what data we collect, why we collect it, how we keep it secure, and what rights you have over that data. It is designed to comply with the European Union's General Data Protection Regulation (GDPR) and the California Consumer Privacy Act as amended by the California Privacy Rights Act (CPRA).

By creating an account and using EstatePlan Ready, you acknowledge that you have read and understood this Privacy Policy and consent to the practices described herein.

2. Information We Collect

We collect the following categories of personal information. You provide most of this data voluntarily when you create an account and fill out the estate planning questionnaire. You may skip any non-required field, though doing so may limit the usefulness of your estate plan summary.

2.1 Account & Authentication Data

Email address and password (stored as a one-way hash)
Full name
Account type (individual subscriber or invited guest viewer)
Subscription plan and status
Multi-factor authentication (MFA) data: TOTP secret, recovery code hashes, session token hashes, failed attempt counts, and lockout timestamps
When you sign in with a third-party provider (Google, Microsoft, Facebook, or Apple): your name, email address, and a provider-assigned account identifier used to create or link your account. See Section 6.1 for details.

2.2 Personal & Family Information

Full legal name, residential address, date of birth, citizenship, and marital status
Prenuptial / postnuptial agreement details and divorce decree summaries
Spouse or partner name and date of birth
Children and grandchildren: names, dates of birth, relationships, and minor status
Beneficiaries with special needs, disabilities, or government benefits
Family members intentionally excluded from the estate plan and reasons

2.3 Financial & Asset Information

Real estate: property addresses, how title is held, approximate values, and debt status
Bank accounts: institution, account type, ownership, approximate value, and named beneficiaries
Investment and brokerage accounts: institution, ownership, value, and beneficiaries
Retirement accounts (401(k), IRA, pension): type, institution, value, and beneficiaries
Life insurance policies: insurer, policy type, death benefit, owner, and beneficiary
Annuities: issuer, owner, value, and beneficiary
Business interests: business name, ownership share, entity type, and operating agreements
Vehicles and titled property: description, title status, and value
Valuable personal property (jewelry, art, collectibles, heirlooms)
Digital assets: online accounts, cryptocurrency, and domain names
Expected inheritances and property held in another's trust

2.4 Liability Information

Debts and loans: type, lender, outstanding balance, and linked assets
Personal guarantees on business or other debt

2.5 Estate Planning Appointments (Fiduciaries)

Executor, backup executor, guardian, backup guardian, trustee, financial power of attorney agent, and health care proxy
For each: full name, relationship, email, phone number, and mailing address

2.6 Wishes & Goals

Distribution preferences and specific gifts (item or amount to a named recipient)
Charitable gifts and trust staging instructions
Contingent beneficiary plans and pet care plans
Funeral, burial, or cremation preferences
End-of-life medical wishes (living will / health care directive)
Estate planning concerns and goals

2.7 Document Records

Document type (will, trust, power of attorney, etc.), status, storage location, and notes

Note: The app records where documents are located, not the documents themselves. No document files are uploaded or stored.

2.8 Professional Contacts

Financial advisor, accountant/CPA, insurance agent, and other professional contacts: name, role, and contact information

2.9 Calendar & Appointment Data

Event title, date, type (consultation, renewal, follow-up), and notes

2.10 Sharing & Invitation Data

When you invite someone to view your estate plan: the invitee's email address, your name and email, the permission level granted (read-only or read-write), and the invitation status

2.11 Payment & Subscription Data

Checkout session ID, order ID, product name, quantity, amount, currency, and subscription ID
Payment status and transaction timestamps
Cancellation date, scheduled deletion date, and cancellation reason

Card numbers and full payment details are handled entirely by our payment processor (Base44 Payments, powered by Wix). We never receive or store your full card number.

2.12 Activity & Device Data

Sign-in events and timestamps
Device and browser information parsed from the user-agent string (device type, operating system, browser name)

2.13 Sensitive Personal Information (CPRA)

Under the CPRA, the following categories constitute "sensitive personal information": government identifiers (if you choose to note a Social Security number or similar identifier in free-text fields), financial account and asset values, health information (end-of-life medical wishes, special needs beneficiary details), and precise geolocation (property addresses). We collect this information only to generate your estate plan summary and do not use it to infer characteristics about you.

3. How We Use Your Information

To provide the service: building, storing, and displaying your estate plan summary and generating a printable PDF for attorney review.
To manage your account: authentication, MFA verification, subscription management, and account security. When you sign in with Google, Microsoft, Facebook, or Apple, we use the name and email address returned by the provider to create or match your account. We do not access any other data from your provider account (see Section 6.1).
To enable sharing: sending invitations to people you designate and granting them view or edit access to your estate plan.
To process payments: managing your subscription, processing checkout, and recording transaction status.
To secure the platform: logging sign-in activity and device information to detect unauthorized access.
To communicate with you: sending registration emails, password reset links, invitation notifications, and service-related updates.
To comply with legal obligations: responding to lawful requests and preventing fraud or abuse.

4. Legal Basis for Processing (GDPR)

Under the GDPR, we process your personal data on the following lawful bases:

Performance of a contract (Art. 6(1)(b)): Processing your estate plan data, account information, and payment data to deliver the service you signed up for.
Consent (Art. 6(1)(a)): Sending invitation emails to people you designate, and any optional data you voluntarily provide in free-text fields. You may withdraw consent at any time.
Legitimate interests (Art. 6(1)(f)): Logging activity and device data for security, preventing fraud, and maintaining the integrity of the platform.
Legal obligation (Art. 6(1)(c)): Retaining payment and transaction records where required by applicable tax or financial law.

For special categories of personal data (health information, financial details) under Art. 9, processing is based on your explicit consent when you voluntarily enter this information into the estate planning questionnaire.

6. Third-Party Services

We use the following third-party services to operate EstatePlan Ready:

Base44 Payments (powered by Wix): Processes subscription payments. Receives your email, payment method, and billing details. Governed by Wix's privacy policy.
Google Maps / Places API: Powers address autocomplete when you enter a property address. The address query is sent to Google to return suggestions.
RentCast API: Used to look up approximate property values when you request a valuation for a real estate address. The address is sent to RentCast to return an estimated value.
Cloud infrastructure & hosting: The platform hosting provider stores your data and serves the application. Data is encrypted in transit and at rest.

6.1 Third-Party Login (Google, Microsoft, Facebook, Apple)

EstatePlan Ready offers optional sign-in through Google, Microsoft, Facebook, and Apple ("third-party login providers"). This section describes how we use each provider's data in accordance with each provider's developer policies, including the Google API Services User Data Policy.

Data We Receive

When you choose to sign in with a third-party provider, we request only the minimum profile information needed to create or match your account. Specifically, we request and receive:

Your name — to populate the display name on your account.
Your email address — to use as your account identifier and for service communications.
A provider-assigned account identifier — an opaque ID returned by the provider that lets us link the provider account to your EstatePlan Ready account.

We do not request, access, or store your password, contacts, files, calendars, photos, social posts, friend lists, or any other data from your provider account. We request only the basic profile and email scopes, and we do not post to or act on your provider account on your behalf.

How We Use This Data

To create your EstatePlan Ready account if one does not yet exist for that email address.
To authenticate you and establish a session when you sign in.
To display your name within the app (you can update it at any time in your account settings).

We do not use data received from third-party login providers for advertising, and we do not share it with third parties for their own marketing purposes. Your provider account data is used solely to operate the sign-in feature and is not combined with other data to build profiles about you.

Data Storage and Deletion

The name, email address, and provider account identifier we receive are stored with your account record for as long as your account is active. When you delete your account (see Section 7), this data is permanently deleted along with the rest of your account. If you revoke access from the provider without deleting your EstatePlan Ready account, we retain the data already associated with your account but will no longer receive new data from that provider.

Your Provider's Privacy Policy

Your use of third-party login is also governed by the respective provider's privacy policy and terms of service. The data the provider holds about you is subject to their policies:

Revoking Access

You can disconnect EstatePlan Ready from your provider account at any time through the provider's account settings. After revoking access, the provider will no longer share data with us, though your existing EstatePlan Ready account (and the data already stored in it) remains unaffected. To fully delete your data from our servers, use the account deletion feature described in Section 7.

7. Data Retention

We retain your personal information for as long as your account is active. Specific retention rules:

Active accounts: All data is retained while your subscription is active.
Cancelled subscriptions: If you cancel your subscription, your data remains accessible in read-only mode until the end of your current billing period. After that date, all estate plans, calendar events, activity logs, and MFA credentials are permanently deleted within 24 hours via an automated purge process.
Account deletion: You may delete your account at any time from Account Security settings. Upon confirmation, all your data (estate plans, appointments, contacts, activity logs, and MFA credentials) is permanently deleted immediately. If you have an active subscription, it is cancelled at the same time so you are not charged again.
Invitation records: Records of people you have invited are retained to enforce invitation limits and audit for abuse, even after the invitation is revoked or the account is deleted.
Payment records: Transaction records are retained as needed for accounting and tax compliance.

8. Data Security

We take extensive measures to protect your personal information:

Encryption: All data is encrypted in transit (TLS/HTTPS) and at rest in the database.
Row-Level Security (RLS): Your estate plan data is isolated so that only you (and people you explicitly invite) can access it. Other users cannot see, edit, or delete your records.
Multi-Factor Authentication (MFA): We require MFA for sensitive operations (viewing shared plans, deleting your account) and strongly encourage it for all users. MFA secrets are stored separately from your account data and are accessible only by the system.
Service-only access: Sensitive data (estate plans, MFA credentials, invitations) is managed exclusively through server-side service roles, preventing direct client-side access or tampering.
Rate limiting: MFA verification is rate-limited and locked out after repeated failed attempts to prevent brute-force attacks.
Activity logging: Sign-in events and device information are logged so you can review unauthorized access.

Despite these measures, no system is perfectly secure. If we become aware of a data breach affecting your personal information, we will notify you and the relevant authorities in accordance with applicable law.

10. Your Rights Under CPRA

If you are a California resident, the California Consumer Privacy Act as amended by the CPRA grants you the following rights:

Right to know: Request the categories and specific pieces of personal information we have collected about you, the sources, the business purpose, and the third parties to whom it was disclosed.
Right to delete: Request deletion of your personal information. You can exercise this directly by deleting your account in Account Security settings.
Right to correct: Request correction of inaccurate personal information.
Right to opt-out of sale or sharing: We do not sell or share your personal information as defined by California law, so no opt-out is necessary.
Right to limit use of sensitive personal information: Request that we limit our use of sensitive personal information (health data, financial data, precise geolocation) to what is necessary to perform the services or provide the goods reasonably expected. We already only use this information to generate your estate plan summary.
Right to non-discrimination: We will not discriminate against you for exercising any of these rights.

To submit a request, contact us using the details in Section 14. We will verify your identity before processing the request and respond within 45 days.

11. International Data Transfers

Your data may be processed and stored on servers located outside your country of residence, including in the United States. When we transfer personal data outside the EEA or UK, we rely on appropriate safeguards such as Standard Contractual Clauses (SCCs) or other legally recognized transfer mechanisms to ensure your data is protected to a standard equivalent to that in your home country.

12. Children's Privacy

EstatePlan Ready is not directed at children under the age of 18, and we do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us so we can delete it.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of material changes by posting the updated policy on this page and updating the "Last updated" date above. We encourage you to review this policy periodically.

14. Contact Us

If you have questions about this Privacy Policy, wish to exercise your data protection rights, or have concerns about how we handle your personal information, please contact us at:

EstatePlan Ready

Email: [email protected]

Data Protection Officer: James Bayliss

For California residents, you may also submit requests by contacting us at the email above with the subject line "California Privacy Request."

You may also review our Terms of Service for the terms and conditions that govern your use of EstatePlan Ready.

Get started with your estate plan