1. Overview
EstatePlan Ready ("we," "us," or "our") is a web application that helps individuals organize their assets, contacts, and wishes into a comprehensive estate plan summary for attorney review. We are committed to protecting your privacy and being transparent about how we collect, use, and share your personal information.
This Privacy Policy explains what data we collect, why we collect it, how we keep it secure, and what rights you have over that data. It is designed to comply with the European Union's General Data Protection Regulation (GDPR) and the California Consumer Privacy Act as amended by the California Privacy Rights Act (CPRA).
By creating an account and using EstatePlan Ready, you acknowledge that you have read and understood this Privacy Policy and consent to the practices described herein.
2. Information We Collect
We collect the following categories of personal information. You provide most of this data voluntarily when you create an account and fill out the estate planning questionnaire. You may skip any non-required field, though doing so may limit the usefulness of your estate plan summary.
2.1 Account & Authentication Data
- Email address and password (stored as a one-way hash)
- Full name
- Account type (individual subscriber or invited guest viewer)
- Subscription plan and status
- Multi-factor authentication (MFA) data: TOTP secret, recovery code hashes, session token hashes, failed attempt counts, and lockout timestamps
- When you sign in with a third-party provider (Google, Microsoft, Facebook, or Apple): your name, email address, and a provider-assigned account identifier used to create or link your account. See Section 6.1 for details.
2.2 Personal & Family Information
- Full legal name, residential address, date of birth, citizenship, and marital status
- Prenuptial / postnuptial agreement details and divorce decree summaries
- Spouse or partner name and date of birth
- Children and grandchildren: names, dates of birth, relationships, and minor status
- Beneficiaries with special needs, disabilities, or government benefits
- Family members intentionally excluded from the estate plan and reasons
2.3 Financial & Asset Information
- Real estate: property addresses, how title is held, approximate values, and debt status
- Bank accounts: institution, account type, ownership, approximate value, and named beneficiaries
- Investment and brokerage accounts: institution, ownership, value, and beneficiaries
- Retirement accounts (401(k), IRA, pension): type, institution, value, and beneficiaries
- Life insurance policies: insurer, policy type, death benefit, owner, and beneficiary
- Annuities: issuer, owner, value, and beneficiary
- Business interests: business name, ownership share, entity type, and operating agreements
- Vehicles and titled property: description, title status, and value
- Valuable personal property (jewelry, art, collectibles, heirlooms)
- Digital assets: online accounts, cryptocurrency, and domain names
- Expected inheritances and property held in another's trust
2.4 Liability Information
- Debts and loans: type, lender, outstanding balance, and linked assets
- Personal guarantees on business or other debt
2.5 Estate Planning Appointments (Fiduciaries)
- Executor, backup executor, guardian, backup guardian, trustee, financial power of attorney agent, and health care proxy
- For each: full name, relationship, email, phone number, and mailing address
2.6 Wishes & Goals
- Distribution preferences and specific gifts (item or amount to a named recipient)
- Charitable gifts and trust staging instructions
- Contingent beneficiary plans and pet care plans
- Funeral, burial, or cremation preferences
- End-of-life medical wishes (living will / health care directive)
- Estate planning concerns and goals
2.7 Document Records
- Document type (will, trust, power of attorney, etc.), status, storage location, and notes
Note: The app records where documents are located, not the documents themselves. No document files are uploaded or stored.
2.8 Professional Contacts
- Financial advisor, accountant/CPA, insurance agent, and other professional contacts: name, role, and contact information
2.9 Calendar & Appointment Data
- Event title, date, type (consultation, renewal, follow-up), and notes
2.10 Sharing & Invitation Data
- When you invite someone to view your estate plan: the invitee's email address, your name and email, the permission level granted (read-only or read-write), and the invitation status
2.11 Payment & Subscription Data
- Checkout session ID, order ID, product name, quantity, amount, currency, and subscription ID
- Payment status and transaction timestamps
- Cancellation date, scheduled deletion date, and cancellation reason
Card numbers and full payment details are handled entirely by our payment processor (Base44 Payments, powered by Wix). We never receive or store your full card number.
2.12 Activity & Device Data
- Sign-in events and timestamps
- Device and browser information parsed from the user-agent string (device type, operating system, browser name)
2.13 Sensitive Personal Information (CPRA)
Under the CPRA, the following categories constitute "sensitive personal information": government identifiers (if you choose to note a Social Security number or similar identifier in free-text fields), financial account and asset values, health information (end-of-life medical wishes, special needs beneficiary details), and precise geolocation (property addresses). We collect this information only to generate your estate plan summary and do not use it to infer characteristics about you.
3. How We Use Your Information
- To provide the service: building, storing, and displaying your estate plan summary and generating a printable PDF for attorney review.
- To manage your account: authentication, MFA verification, subscription management, and account security. When you sign in with Google, Microsoft, Facebook, or Apple, we use the name and email address returned by the provider to create or match your account. We do not access any other data from your provider account (see Section 6.1).
- To enable sharing: sending invitations to people you designate and granting them view or edit access to your estate plan.
- To process payments: managing your subscription, processing checkout, and recording transaction status.
- To secure the platform: logging sign-in activity and device information to detect unauthorized access.
- To communicate with you: sending registration emails, password reset links, invitation notifications, and service-related updates.
- To comply with legal obligations: responding to lawful requests and preventing fraud or abuse.
4. Legal Basis for Processing (GDPR)
Under the GDPR, we process your personal data on the following lawful bases:
- Performance of a contract (Art. 6(1)(b)): Processing your estate plan data, account information, and payment data to deliver the service you signed up for.
- Consent (Art. 6(1)(a)): Sending invitation emails to people you designate, and any optional data you voluntarily provide in free-text fields. You may withdraw consent at any time.
- Legitimate interests (Art. 6(1)(f)): Logging activity and device data for security, preventing fraud, and maintaining the integrity of the platform.
- Legal obligation (Art. 6(1)(c)): Retaining payment and transaction records where required by applicable tax or financial law.
For special categories of personal data (health information, financial details) under Art. 9, processing is based on your explicit consent when you voluntarily enter this information into the estate planning questionnaire.
6. Third-Party Services
We use the following third-party services to operate EstatePlan Ready:
- Base44 Payments (powered by Wix): Processes subscription payments. Receives your email, payment method, and billing details. Governed by Wix's privacy policy.
- Google Maps / Places API: Powers address autocomplete when you enter a property address. The address query is sent to Google to return suggestions.
- RentCast API: Used to look up approximate property values when you request a valuation for a real estate address. The address is sent to RentCast to return an estimated value.
- Cloud infrastructure & hosting: The platform hosting provider stores your data and serves the application. Data is encrypted in transit and at rest.
6.1 Third-Party Login (Google, Microsoft, Facebook, Apple)
EstatePlan Ready offers optional sign-in through Google, Microsoft, Facebook, and Apple ("third-party login providers"). This section describes how we use each provider's data in accordance with each provider's developer policies, including the Google API Services User Data Policy.
Data We Receive
When you choose to sign in with a third-party provider, we request only the minimum profile information needed to create or match your account. Specifically, we request and receive:
- Your name — to populate the display name on your account.
- Your email address — to use as your account identifier and for service communications.
- A provider-assigned account identifier — an opaque ID returned by the provider that lets us link the provider account to your EstatePlan Ready account.
We do not request, access, or store your password, contacts, files, calendars, photos, social posts, friend lists, or any other data from your provider account. We request only the basic profile and email scopes, and we do not post to or act on your provider account on your behalf.
How We Use This Data
- To create your EstatePlan Ready account if one does not yet exist for that email address.
- To authenticate you and establish a session when you sign in.
- To display your name within the app (you can update it at any time in your account settings).
We do not use data received from third-party login providers for advertising, and we do not share it with third parties for their own marketing purposes. Your provider account data is used solely to operate the sign-in feature and is not combined with other data to build profiles about you.
Data Storage and Deletion
The name, email address, and provider account identifier we receive are stored with your account record for as long as your account is active. When you delete your account (see Section 7), this data is permanently deleted along with the rest of your account. If you revoke access from the provider without deleting your EstatePlan Ready account, we retain the data already associated with your account but will no longer receive new data from that provider.
Your Provider's Privacy Policy
Your use of third-party login is also governed by the respective provider's privacy policy and terms of service. The data the provider holds about you is subject to their policies:
Revoking Access
You can disconnect EstatePlan Ready from your provider account at any time through the provider's account settings. After revoking access, the provider will no longer share data with us, though your existing EstatePlan Ready account (and the data already stored in it) remains unaffected. To fully delete your data from our servers, use the account deletion feature described in Section 7.
7. Data Retention
We retain your personal information for as long as your account is active. Specific retention rules:
- Active accounts: All data is retained while your subscription is active.
- Cancelled subscriptions: If you cancel your subscription, your data remains accessible in read-only mode until the end of your current billing period. After that date, all estate plans, calendar events, activity logs, and MFA credentials are permanently deleted within 24 hours via an automated purge process.
- Account deletion: You may delete your account at any time from Account Security settings. Upon confirmation, all your data (estate plans, appointments, contacts, activity logs, and MFA credentials) is permanently deleted immediately. If you have an active subscription, it is cancelled at the same time so you are not charged again.
- Invitation records: Records of people you have invited are retained to enforce invitation limits and audit for abuse, even after the invitation is revoked or the account is deleted.
- Payment records: Transaction records are retained as needed for accounting and tax compliance.
8. Data Security
We take extensive measures to protect your personal information:
- Encryption: All data is encrypted in transit (TLS/HTTPS) and at rest in the database.
- Row-Level Security (RLS): Your estate plan data is isolated so that only you (and people you explicitly invite) can access it. Other users cannot see, edit, or delete your records.
- Multi-Factor Authentication (MFA): We require MFA for sensitive operations (viewing shared plans, deleting your account) and strongly encourage it for all users. MFA secrets are stored separately from your account data and are accessible only by the system.
- Service-only access: Sensitive data (estate plans, MFA credentials, invitations) is managed exclusively through server-side service roles, preventing direct client-side access or tampering.
- Rate limiting: MFA verification is rate-limited and locked out after repeated failed attempts to prevent brute-force attacks.
- Activity logging: Sign-in events and device information are logged so you can review unauthorized access.
Despite these measures, no system is perfectly secure. If we become aware of a data breach affecting your personal information, we will notify you and the relevant authorities in accordance with applicable law.
9. Your Rights Under GDPR
If you are a resident of the European Economic Area (EEA) or the United Kingdom, you have the following rights regarding your personal data:
- Right of access (Art. 15): Request a copy of the personal data we hold about you.
- Right to rectification (Art. 16): Request correction of inaccurate or incomplete data.
- Right to erasure (Art. 17): Request deletion of your personal data. You can exercise this right directly by deleting your account in Account Security settings.
- Right to restriction (Art. 18): Request that we limit processing of your data in certain circumstances.
- Right to data portability (Art. 20): Receive your personal data in a structured, machine-readable format and transmit it to another service.
- Right to object (Art. 21): Object to processing based on legitimate interests.
- Right to withdraw consent (Art. 7): Withdraw consent for processing based on consent at any time, without affecting the lawfulness of processing before withdrawal.
- Right to lodge a complaint: You have the right to lodge a complaint with your local data protection authority. We encourage you to contact us first so we can address your concerns.
To exercise any of these rights, contact us using the details in Section 14. We will respond within one month of receiving your request.
10. Your Rights Under CPRA
If you are a California resident, the California Consumer Privacy Act as amended by the CPRA grants you the following rights:
- Right to know: Request the categories and specific pieces of personal information we have collected about you, the sources, the business purpose, and the third parties to whom it was disclosed.
- Right to delete: Request deletion of your personal information. You can exercise this directly by deleting your account in Account Security settings.
- Right to correct: Request correction of inaccurate personal information.
- Right to opt-out of sale or sharing: We do not sell or share your personal information as defined by California law, so no opt-out is necessary.
- Right to limit use of sensitive personal information: Request that we limit our use of sensitive personal information (health data, financial data, precise geolocation) to what is necessary to perform the services or provide the goods reasonably expected. We already only use this information to generate your estate plan summary.
- Right to non-discrimination: We will not discriminate against you for exercising any of these rights.
To submit a request, contact us using the details in Section 14. We will verify your identity before processing the request and respond within 45 days.
11. International Data Transfers
Your data may be processed and stored on servers located outside your country of residence, including in the United States. When we transfer personal data outside the EEA or UK, we rely on appropriate safeguards such as Standard Contractual Clauses (SCCs) or other legally recognized transfer mechanisms to ensure your data is protected to a standard equivalent to that in your home country.
12. Children's Privacy
EstatePlan Ready is not directed at children under the age of 18, and we do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us so we can delete it.
13. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of material changes by posting the updated policy on this page and updating the "Last updated" date above. We encourage you to review this policy periodically.
14. Contact Us
If you have questions about this Privacy Policy, wish to exercise your data protection rights, or have concerns about how we handle your personal information, please contact us at:
For California residents, you may also submit requests by contacting us at the email above with the subject line "California Privacy Request."
You may also review our Terms of Service for the terms and conditions that govern your use of EstatePlan Ready.