Privacy policy

The controller within the meaning of the GDPR is: Apex Ventures Tech LLC [Street and number] [Postcode City] [EU member state] Email: support@ifever.eu Phone: [phone number]

Data protection contact: privacy@ifever.eu

When you open our website, our hosting provider automatically records technical data in server logs:

• IP address
• date and time of access
• page requested
• browser and operating system
• previous page (referrer)

We use this to keep the website working and secure, for example to fend off attacks. Our legal basis is our legitimate interests (Art. 6(1)(f) GDPR). We delete the log files after [7] days.

Hosting provider: [name, address, server location]. We have a written data processing agreement under Art. 28 GDPR with them.

This website does not use cookies for advertising or analytics. If you switch between light and dark theme, we remember your choice in your browser’s local storage. It never leaves your device.

After you sign in, we use a strictly necessary session cookie so you stay signed in. [Add name and lifetime once the app is connected.]

Our fonts are hosted on our own server. Loading the website does not connect to Google or any other font provider.

When you create an account, we collect:

• name and email address
• password, only as a one-way hash, never in plain text
• mobile number, if you give one, for text reminders
• your settings, for example your check-in rhythm

Our legal basis is performance of our contract with you (Art. 6(1)(b) GDPR). Your mobile number is optional.

Documents, passwords and letters in your vault are each encrypted with AES-256-GCM using their own key, and each of those keys is wrapped by a master key held separately from the database. Our staff have no access to the contents. A stolen copy of the database alone does not reveal your documents.

Honest limitation: this is encryption we hold the key to, because the service must be able to deliver your vault when you can no longer act. We do not have a design where only you hold the key and delivery still works.

Your vault may contain special categories of data, for example health data in an advance directive. We only process it on the basis of your explicit consent given in advance (Art. 9(2)(a) GDPR), because you choose to store it with us and want it passed to the people you choose. You can withdraw consent at any time by deleting the contents.

You can add names, email addresses and mobile numbers of people who should receive documents or confirm a release. We process this on the basis of our legitimate interests in providing the service you asked for (Art. 6(1)(f) GDPR), and use it only for that purpose.

Please tell these people beforehand. As this data is not collected from them directly, we inform them in line with Art. 14 GDPR when we first contact them: who we are, why we are contacting them and where to find this policy. ifever is free for recipients and trusted people. They do not enter into a contract with us. They may contact us at privacy@ifever.eu to access, rectify or erase the information you provided about them, or to opt out of messages from us.

Your partner’s vault is separate from yours. We do not show you anything stored in your partner’s vault, and we do not show them anything stored in yours.

If you report a death to us, we collect the uploaded proof (for example the death certificate), the details about the person who died, and your name, email address and relationship to that person. We use this only to check the report, inform the trusted people and reach you if we have questions.

We delete the proof once the check is complete, at the latest after [90] days.

We send reminders, confirmation requests and releases by email and text message through service providers (processors under Art. 28 GDPR): [email provider, location] and [SMS provider, location]. Passwords or vault contents are never put in an email or text message.

Because the phone numbers of your recipients are supplied by you rather than by them, we ask each person directly before we ever text them, and we record when and how they agreed. Anyone can reply STOP or use the link in that message to opt out at any time, and we will tell you if that happens so you can reach them another way. Message and data rates may apply. We do not send marketing messages.

Payments are handled by [payment provider, location]. The provider does not pass your card or account details to us. We keep billing records for the period required by tax law.

If a payment fails, we do not lock your vault. We then use your contact details to let you know.

We use no analytics or advertising services. We don’t sell personal data or pass it on for direct marketing.

[Describe where vault data is stored and which processors handle data, with the country and what information.] Where we transfer personal data outside the EU/EEA, we rely on appropriate safeguards within the meaning of Chapter V GDPR, such as an adequacy decision of the European Commission or the Standard Contractual Clauses (SCCs). Each processor is bound by a data processing agreement under Art. 28 GDPR.

We keep your information as long as your account exists. After you cancel, we delete your account and vault after [30] days, unless the law requires us to keep it. After a release, released documents remain available to recipients for [period] and are then deleted. Deletion cannot recall anything already delivered.

Under the GDPR you have the right to:

• access your personal data (Art. 15)
• rectification (Art. 16)
• erasure (Art. 17)
• restriction of processing (Art. 18)
• data portability (Art. 20)
• object to processing based on our legitimate interests (Art. 21)
• withdraw consent at any time, where we rely on consent (Art. 7(3))

Just email us at privacy@ifever.eu. We respond within one month.

If you are unhappy with how we handled your data, contact us first. You also have the right to lodge a complaint with the competent supervisory authority in your EU member state.

All connections to our website and app are encrypted with TLS. Vault contents are also encrypted one by one, and passwords and access codes are hashed with scrypt, never stored in readable form. Access attempts are limited.

If a personal data breach is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority within 72 hours (Art. 33 GDPR), and we will tell you without undue delay where the risk is high (Art. 34 GDPR).

If our service or the law changes, we update this privacy policy. The version published here applies. If we make a material change, we will notify account holders by email before it takes effect.