Privacy Notice

Data controller: [Company legal name] Ltd

Company number: [Company number]
Registered office: [Registered office address, United Kingdom]
ICO registration: [ICO registration number]

For data protection enquiries, contact privacy@hellokinsupport.xyz.

This notice covers personal data we process when you:

• visit our website or marketing pages;
• create an account or sign in to Care Vault;
• build, update, or share a care vault (plan);
• upload documents or enter wishes and contact details;
• invite family members or accept an invitation;
• contact our support team or receive service emails;
• export your data or request account deletion.

It does not cover third-party websites or services you access through links on our site. Those services have their own privacy policies.

We may collect and process the following categories of data:

Account and identity data — name, email address, authentication identifiers, and profile settings. We use Clerk to manage secure sign-in.

Vault and plan content — funeral wishes, preferences, emergency contacts, notes, plan names, and other information you choose to record in your vault.

Documents — files you upload (for example wills, insurance policies, or identity documents), together with labels, categories, and metadata such as upload date and file size.

Sharing and collaboration data — invitations sent or received, roles assigned to family members (such as owner, co-planner, or viewer), and related activity.

Technical and usage data — IP address, browser type, device information, pages viewed, and API request logs (including timestamps and error codes) to keep the service secure and reliable.

Communications — messages you send to support and emails we send about your account, invitations, or service updates (according to your notification preferences).

Sensitive personal data. Some information you voluntarily add — such as health-related preferences, religious wishes, or details about bereavement — may be classed as "special category" data under UK GDPR. We only process this where you have given clear consent by entering it into your vault, or where another lawful basis applies. You are not required to provide special category data to use the core service.

Under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, we must have a lawful basis for processing your personal data. We rely on the following:

Where we rely on legitimate interests, we balance those interests against your rights and will not process your data in ways you would not reasonably expect.

When you add details about family members, executors, or other contacts — or invite someone to your vault — you may provide their personal data. You confirm that you have their permission to share that information with us and that they understand we will store and process it to provide the service.

If you have been invited to a vault, the plan owner is responsible for the accuracy of information they hold about you. You may contact us or the plan owner to exercise your data protection rights in relation to data they control.

We do not sell your personal data. We share it only where necessary with trusted service providers ("processors") who help us run Care Vault, including:

• Clerk — authentication and account security;
• Supabase — database hosting and private document storage;
• Resend — transactional email delivery;
• Vercel (or equivalent hosting provider) — website and application hosting.

These providers may process data in the UK, European Economic Area (EEA), United States, or other countries. Where data is transferred outside the UK, we use appropriate safeguards — such as the UK International Data Transfer Agreement, UK Addendum to EU Standard Contractual Clauses, or an adequacy decision — so your data receives a similar level of protection.

We may also disclose data if required by law, to protect our rights, or in connection with a merger, acquisition, or sale of assets (with notice where practicable).

We keep personal data only for as long as needed for the purposes described in this notice:

• Active accounts — while your account exists and you use the service.
• Vault content and documents — until you delete them, delete your account, or we no longer need them to provide the service.
• Security and audit logs — typically up to 12 months, unless a longer period is needed for security investigations or legal compliance.
• Deleted accounts — we delete or anonymise personal data within a reasonable period after account deletion, subject to limited retention where the law requires (for example financial records or dispute resolution).

Pre-need planning information may be kept for extended periods while your account is active so your wishes remain available when needed. You can export or delete your data at any time from your account settings.

We take security seriously. Measures include encryption in transit (TLS), encryption at rest for stored data, access controls, role-based permissions on shared vaults, private document storage with time-limited access links, and rate limiting on sensitive routes.

No online service can guarantee absolute security. Please use a strong password, keep your sign-in details confidential, and tell us immediately if you suspect unauthorised access to your account.

Under UK data protection law, you have the right to:

• Access — request a copy of the personal data we hold about you.
• Rectification — ask us to correct inaccurate data.
• Erasure — ask us to delete your data in certain circumstances (you can also delete your account in settings).
• Restriction — ask us to limit how we use your data.
• Portability — receive your data in a structured, machine-readable format (export is available in account settings).
• Object — object to processing based on legitimate interests or for direct marketing.
• Withdraw consent — where we rely on consent, you may withdraw it at any time without affecting prior lawful processing.

To exercise any of these rights, email privacy@hellokinsupport.xyz. We will respond within one month, or inform you if we need more time for complex requests. We may need to verify your identity before acting on a request.

You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint. We would appreciate the chance to address your concerns first.

We use essential cookies and similar technologies to keep you signed in, protect your account, and operate the website. We may also use analytics cookies to understand how visitors use our site, where you have consented or where permitted by law.

You can control non-essential cookies through your browser settings or any cookie preference tool we provide on the site. Blocking essential cookies may prevent parts of the service from working.

Care Vault is intended for adults aged 18 and over in the United Kingdom. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

We may update this Privacy Notice from time to time. The "Last updated" date at the top will change when we do. For significant changes, we will notify you by email or through a notice in the product where appropriate.

Continued use of Care Vault after changes take effect means you accept the updated notice, to the extent permitted by law.

Data protection enquiries: privacy@hellokinsupport.xyz

General support: hello@hellokinsupport.xyz

Postal address: [Registered office address, United Kingdom]

Related: Terms of Service