Privacy

Trustfecta stores estate documents and releases them to the people you name, when you can no longer respond. This policy covers three groups: trust owners who hold a vault, attorneys who enrol clients, and beneficiaries and executors named in someone else's vault.

If you were named as a beneficiary, your details were given to us by the person who named you, not collected from you. See If someone named you.

Account details. Email address and a password hash. We never see your password in plain text.

Profile details. First, middle and last name, postal address, and phone number — used to identify you correctly and to reach you for check-ins.

Documents you or your attorney upload. The files themselves, plus their filename, type, size and upload date.

People you name. For each beneficiary, executor, co-trustor or secondary contact: name, email, phone, postal address and their relationship to you.

Attorney details. For firm accounts: name, firm, bar number and bar state, used to verify the person is admitted to practise.

Activity records. Every meaningful action — sign-in, document access, beneficiary change, check-in response — is logged with a timestamp, the account responsible, and the IP address and browser used. This audit trail is a security feature: it is how you can tell who opened what, and when.

What we do not collect. We do not ask for Social Security numbers, dates of birth, or financial account credentials. We do not use advertising trackers or third-party marketing cookies.

To operate the vault: store and release documents, verify identity, send check-ins, run the escalation sequence if you stop responding, and notify the people you named when a release is triggered.

We do not use your documents or personal details to train models, build profiles, or target advertising. We do not sell personal information, and we do not share it for cross-context behavioural advertising.

Your attorney, if you were enrolled through a firm. They can see your account details and manage documents and beneficiaries for you. They are your attorney; their obligations to you are their own.

The people you named, but only after a release is triggered. Before that, a beneficiary is told they have been named and by whom — nothing about your documents or their contents.

Service providers who run parts of the product on our behalf. They are contractually limited to that purpose and cannot use your data for their own ends:

• Supabase — database, authentication and encrypted document storage
• Vercel — application hosting and delivery
• Resend — transactional email (invitations, check-ins, notifications)
• MailerLite — marketing email, only if you opted in. Kept deliberately separate from transactional mail.

Legal process. We may disclose data where required by law. If we receive a valid order for your data we will tell you, unless we are legally prohibited from doing so.

On servers in the United States. If you are outside the US, using Trustfecta means your data is transferred to and processed there.

A vault is meant to outlast the person who made it, so we keep documents and vault records for as long as the account is active — potentially decades.

If you close your account, documents and personal details are deleted within [30 days]. If a release has been triggered and beneficiaries have been given access, we retain the vault for [12 months] afterwards so the estate can be administered, then delete it.

Audit records outlive the data they describe: we keep them for [7 years] because their purpose is to show who accessed an estate and when, which is precisely the question likely to be asked after the fact.

Documents are encrypted with AES-256-GCM. Each file gets its own key, which is itself encrypted under a master key held outside the database — so access to the database and the stored files alone is not enough to read anything.

We are not a zero-knowledge system, and we say so plainly. Because we can help you recover access to your own vault, we hold the means to decrypt it. That is a deliberate trade: a forgotten password should not destroy an estate plan. It does mean you are trusting us, and our security page sets out what we do to be worth it.

If personal data is exposed in a way that puts you at risk, we will notify affected people within 72 hours of confirming it, by email to the address on the account. We will tell you what was exposed, what we know about how, and what we are doing about it — including where the picture is still incomplete. We will notify regulators where the law requires it.

You can, at any time:

• See what we hold. Most of it is visible in your account already.
• Correct it. Profile and beneficiary details are editable directly.
• Take it with you. Request an export — your documents in their original formats, and your account data in a machine-readable file.
• Delete it. Request deletion of your account and its contents.
• Object or restrict. Ask us to stop particular processing, where the law gives you that right.

Email privacy@trustfecta.com and we will respond within 30 days. We will not charge you, and we will not treat you differently for asking.

Depending on where you live, you may have additional rights under the GDPR, the UK GDPR, or state privacy laws including the CCPA. We honour these requests regardless of where you are.

If you have been named as a beneficiary or executor, your name and contact details were given to us by the trust owner so we can reach you when it matters. You did not sign up, and you can still ask us what we hold, correct it, or ask to be removed — email privacy@trustfecta.com.

Removing yourself means we will not be able to reach you when the vault is released. We will tell the trust owner that a named person asked to be removed, so they can make other arrangements.

Trustfecta is not intended for anyone under 18 and we do not knowingly collect their data. A minor may be named as a beneficiary by an adult; in that case we hold only the contact details needed to reach them or their guardian.

If we change this policy in a way that materially affects your rights, we will email you before it takes effect — not quietly update the page and change the date.

Trustfecta is operated by [Legal entity name], [registered address]. This policy is governed by the laws of [State], United States.

Privacy questions: privacy@trustfecta.com. Anything else: hello@trustfecta.com.