Privacy policy

1. Who we are and how to contact us

HeirWell is operated by HeirWell Ltd, a company registered in Northern Ireland (company number NI732507), registered office: 93 Magheraboy Avenue, Portrush, Northern Ireland, BT56 8GW. HeirWell Ltd is the controller of the personal data described in this policy and is registered with the Information Commissioner's Office (registration ZC133604). This policy covers the HeirWell application and our website, heirwell.co.uk.

For anything relating to your personal data — questions, requests, or complaints — contact us at contact@heirwell.co.uk.

2. The information we collect

• Your account: your name, email address, phone number, address, and sign-in credentials (passkeys or one-time codes — we never store passwords).
• Estate records you enter: details of the deceased person and their estate — assets, debts, valuations, gifts, tax details (including National Insurance and tax reference numbers), and the names and details of beneficiaries and other people involved in the estate.
• Documents you upload: wills, death certificates, identity documents, statements and correspondence, stored in a private encrypted vault.
• Correspondence: emails you send and receive through your HeirWell email addresses, including attachments.
• Payments: handled by Stripe. We record that you paid and the amount; your card details go directly to Stripe and are never stored by us.
• Technical and security data: IP address, browser characteristics, and security event logs (such as sign-ins), kept to protect your account.

3. People other than the account holder

Estate administration necessarily involves information about other people. Data protection law does not apply to the deceased, but we protect their information with the same security as everything else. Information about living people — beneficiaries, co-executors, family members — entered by an executor is personal data, and this policy applies to it. If your information has been entered into HeirWell by an executor and you have questions or wish to exercise your rights, contact us at the address above.

4. Sensitive information

We never ask for special category data, but documents and correspondence you choose to store may incidentally contain it (for example a cause of death on a certificate, or care-related letters). We process it only because you choose to store those records for the estate, and it is never used for any other purpose.

5. How we use your information, and our lawful bases

• Providing HeirWell — your task lists, asset records, documents, mail and generated forms (lawful basis: performing our contract with you).
• Payments and accounting (contract, and our legal obligations).
• Security — authentication, fraud prevention, rate limiting and audit logs (our legitimate interest in keeping accounts and data safe).
• Service communications — emails about your account or the service (contract). We do not send marketing.
• Organising your correspondence — see section 6 (our legitimate interest in making the service work for you).

6. Automated email organisation

When an email arrives at your HeirWell address, our own AI model — built by HeirWell and hosted on infrastructure provided by our processor Modal — reads it to suggest what it is about (for example an acknowledgement or a document request) and to surface follow-up tasks. Your correspondence is not shared with any third-party AI service. This only organises your inbox — no decision with legal or similarly significant effect is ever made about you solely by automated means, and you can always act on or ignore the suggestions.

7. Who we share information with

We never sell personal data, and we share it only with the service providers (processors) that run HeirWell, under contracts that bind them to protect it:

• Supabase — database, authentication and document storage (hosted in London, UK).
• Vercel — application hosting.
• Postmark (ActiveCampaign) — sending and receiving email.
• Stripe — payment processing.
• Modal — cloud infrastructure that hosts our own AI model (section 6).
• Cloudflare — the security check (CAPTCHA) on sign-in.
• Sentry — error monitoring, so we can find and fix faults; crash reports contain technical data (such as browser details and IP address), never your estate records.

Beyond these processors, we disclose personal data only if the law requires it or to protect our legal rights.

8. International transfers

Your estate records and documents are stored in the UK. Some of our processors (such as Stripe, Postmark, Vercel, Modal and Cloudflare) process data in the United States or other countries. Where that happens, the transfer is protected by UK-approved safeguards — the UK International Data Transfer Agreement or Addendum, or an adequacy decision where one applies.

9. How long we keep information

We keep your account and estate data for as long as your account is open, so the estate record remains available to you throughout administration. You can delete individual assets, documents and messages at any time. When you request account deletion (section 10), we erase your account and estate data within one month of verifying the request, after which residual copies clear from our encrypted backups over a short further period. Payment records are kept as long as accounting law requires.

Our processors hold copies only as their function requires and under the safeguards in section 8 — for example our email provider retains delivery records for a limited period, Stripe keeps payment records for as long as financial regulation requires, and hosting providers keep short-lived technical logs. If you send us product feedback, we may keep it after an estate or account is deleted, detached from the estate it concerned — you can ask us to erase it at any time.

10. Your rights

Under UK data protection law you have the right to access your personal data, to have it corrected, to have it erased, to restrict or object to our processing of it, to data portability, and to withdraw consent where processing is based on consent. Exercising them is free, and we respond within one month.

To delete your account, submit a request from Profile settings → Close account inside the app, or email contact@heirwell.co.uk from your account email address. Either way, deletion is completed by our team rather than instantly — we verify the request, erase your account and estate data as section 9 describes, and confirm to you once it is done. You can delete individual estates yourself at any time from within the app.

If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office (ICO) at ico.org.uk, though we would welcome the chance to resolve any concern first.

11. Cookies

HeirWell sets only strictly necessary cookies: the cookies that keep you signed in, your choice of whether to stay signed in between visits, a reminder-snooze for passkey setup, and the cookie our sign-in security check (Cloudflare Turnstile) needs to work. We use no advertising or third-party analytics cookies, which is why we show no cookie banner.

12. Children

HeirWell is for executors and administrators of estates, who must be adults — the service is not directed at children and we do not knowingly collect children's data.

13. Changes to this policy

If we change this policy — for example when adding a feature or a processor — we will update it here and refresh the date at the top. Significant changes will be flagged in the app.