Privacy Policy

Effective Date: October 12, 2026 · Last Updated: October 12, 2026

1. Introduction

Keepacy, Inc., a Delaware corporation (“Keepacy,” “we,” “us,” or “our”), operates the Keepacy™ platform at keepacy.com, including the web application, APIs, and related services (collectively, the “Service”). This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you use our Service. It also covers people who never signed up: someone an account holder named as a beneficiary, and someone who uses a Legacy Letter or Legacy Card.

Keepacy, Inc. is the data controller for your personal information. Our contact details and postal address are listed in Section 17 of this policy.

Two kinds of account. An account that uses device keys keeps the keys to its documents on the account holder's devices and in their recovery kit. Keepacy's servers hold no key that can open those documents. An older account, one that hasn't moved to device keys yet, uses our earlier design, in which Keepacy holds a recovery key. Where the two differ, this policy says so.

By using Keepacy, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree, please do not use the Service.

2. Information We Collect

2.1 Information You Provide

  • Account information: email address, password (stored as a bcrypt hash), and optional display name. Your email address is used for account authentication, email-based multi-factor authentication, transactional notifications (verification, check-in alerts, beneficiary updates, security alerts), and account recovery.
  • Documents: files you upload to your vault (wills, insurance policies, financial records, medical directives, identity documents, and similar).
    • Accounts that use device keys: your device encrypts each document before it is uploaded, and Keepacy's servers hold no key that can open it. We can see a document's size, file type, category, any tags you add, when it was added, and who you share it with, but not its name or its contents.
    • Older accounts: documents are encrypted at rest using AES-256-GCM with per-document keys and protected in transit by TLS. Keepacy holds a recovery key that is used only for beneficiary release and account recovery. After we confirm your death through our death certificate review, Keepacy uses that key to release documents to your beneficiaries. When your check-ins lapse, and before your death is confirmed, your beneficiaries can see the title, category and dates of each document you share with them, and nothing else about it.
    • On either kind of account, we do not accept a physician's statement in place of a death certificate.
  • Life Plan: the Life Plan wizard begins with a few yes-or-no questions about your situation (for example, whether you own a home, have children, own a business, or have life insurance). We store those answers as you give them, and we can read them. The details you then enter in your Life Plan (names, account details, medical information, instructions for your family) are stored encrypted. On an account that uses device keys, Keepacy's servers hold no key that can open those details.
  • Recovery kit: on an account that uses device keys, we show you a recovery kit: 24 words, which the app also shows as one line of text. If you created your account to accept an invitation, the app calls these words your recovery code. We never receive them. We store a copy of your keys that only your recovery kit can unlock.
  • Beneficiary information: names, email addresses and relationship descriptions of the people you name, and any personal note you write for one of them. See Section 2.5.
  • Invitations: when you invite someone you named, the question you set for them, which we can read, and a check value derived from your answer. We never receive the answer itself. See Section 2.5.
  • Legacy Letters: when you make a Legacy Letter, the full legal name you type for that person, which we store only as a hash signed by you. We never receive the letter's code or your answers.
  • Legacy Card orders: the name and US mailing address you give us for your Legacy Card. It may be yours or someone else's, such as your lawyer's. Only give us someone else's address if they agree. We encrypt it and use it only to mail the card.
  • Phone number: if you add a number for texts or phone calls in your check-in settings, we collect it. Before we save it, we send it a code, by text or by an automated call, and you enter that code; we record when you did. We use the number only to send you that code, check-in reminders, escalation alerts and security alerts about your account, and, if someone who named you in Keepacy stops checking in and you have confirmed your number, a text telling you to check your email (Section 2.5).
  • Financial account information: if you choose to link an external financial account, we receive from our account connection provider (Plaid) the institution name, the account name and type, and the current, available and limit balances. For investment accounts we also receive your holdings and the securities detail that describes them. For loan and credit accounts we request liability detail such as interest rates and payment terms. Your banking credentials are entered directly with Plaid and your financial institution and are never seen or stored by Keepacy. We do not request or receive your transaction history.
  • Payment information: if you subscribe to a paid plan, payment details are collected and processed by our third-party payment processor (Stripe). We do not store credit card numbers on our servers.
  • Photo of your ID, if our support team asks for one: if you can't sign in and ask our support team for help with your account, we may email a one-time link to your account's address and ask you to upload a photo of a government ID, such as a driver's license or passport. The photo shows whatever your ID shows, such as your face, date of birth and address. You can cover the ID number. A member of our staff looks at it and writes down the full name on it and the type of ID. We never record the ID number. We keep that name, encrypted, and the type of ID with your account as a record of who asked. Section 10 says when we delete the photo.

2.2 Information Collected Automatically

  • Usage data: timestamps of logins, check-in responses, and feature interactions.
  • Audit logs: records of security-relevant actions (login attempts, MFA events, document access, beneficiary modifications, each time a member of our staff views a claim document, a photo of ID you sent our support team, or a Legacy Card mailing address, and each action our support staff take on your account, with the reason they gave) for security and compliance purposes.
  • Device information: IP address, browser type, and operating system, collected via server access logs for security monitoring. On an account that uses device keys, we also store a name for each browser or device that holds your keys (for example, “Chrome on Mac”), so you and we can tell them apart.
  • Records of what you agreed to: when you agree to our Terms and this Privacy Policy, at sign-up or after we change them, and when you name a beneficiary or confirm your digital asset directive, we record the date and time, the version or exact wording you agreed to, which boxes you ticked, your IP address, and your browser's user agent (which shows your browser and device type). We keep these as proof of what you agreed to. Section 10 says for how long.
  • Approximate location: when you sign up, we look up your approximate location (country, state and nearby city) from your IP address, using a location database kept on our own servers. You can change your state in Settings. We use it to suggest services near you, such as estate lawyers and notaries.
  • Product analytics: we use PostHog to understand how people use Keepacy. PostHog receives the pages you visit, the actions you take (such as signing up or uploading a document, never the document itself), your email address and your plan. It also makes session recordings, which replay how you used a page. Recordings hide all text shown on the page and everything you type. We also exclude the QR codes for Legacy Letters and for setting up an authenticator app, and the names and document titles in labels that screen readers read aloud. We don't record your network traffic or your browser's console. We don't make recordings on the pages where invitations, Legacy Letters or Legacy Cards are entered, or in our admin console.

2.3 Cookies and Similar Technologies

Keepacy uses a small number of cookies and similar technologies:

  • Authentication cookies: we use a secure, HttpOnly cookie to store your session refresh token. This cookie is essential for keeping you logged in and cannot be accessed by JavaScript running in your browser. It is set with the SameSite attribute and is transmitted only over HTTPS.
  • Bot protection: Cloudflare Turnstile may set cookies on authentication pages to distinguish humans from automated bots.
  • Analytics: PostHog stores an identifier in a cookie and in your browser's local storage so it can tell visits apart.
  • Your keys: on an account that uses device keys, your browser stores your keys, locked with your password, so that only this browser can use them.

We do not use advertising cookies or cross-site tracking cookies. We do not participate in cross-site tracking or interest-based advertising.

2.4 Information We Do Not Collect

  • We do not use advertising pixels or behavioral profiling for advertising. We use PostHog only to understand and improve how Keepacy is used.
  • We do not collect biometric data. When someone uses a Legacy Letter or Legacy Card, or sends our support team a photo of their ID, a member of our staff looks at the photo and reads the name. We do not use facial recognition or automated identity matching.
  • We do not sell, share, or use personal information for targeted advertising.

2.5 Information About Beneficiaries

When you add a beneficiary, you give us their name, email address and relationship. This information comes from you, not from the beneficiary. We don't ask you for their phone number. We use this information to:

  • send them an invitation, or an email saying you have named them, if you ask us to;
  • tell them by email if your check-ins lapse. If they have their own Keepacy account and have added and confirmed a number for texts there, and your plan includes text messages, we may also text that number to tell them to check their email. We don't text anyone who doesn't have a Keepacy account;
  • tell them when a death certificate has been sent for you, and when a release is approved, cancelled or takes effect;
  • if you made them a Legacy Letter, tell them after the release that you left them a letter.

Invitations. Someone who accepts your invitation creates their own Keepacy account, and this policy applies to them as an account holder. We show you the email address of the account that accepted, so you can check it is the right person. On an invitation with a question, your device approves the person the next time you unlock your vault, and we email you which account it approved; if it isn't them, remove them. The question you set is shown to anyone signed in to Keepacy who opens the invitation link, so don't put private information in it. We delete the question and the answer's check value when someone is approved, when the invitation expires, or when too many wrong answers cancel it. If the Keepacy account of someone you approved is deleted, we email you, unless your check-ins have lapsed or a release has started. Until you invite them again, they can receive what you share only through a Legacy Letter you made for them.

Personal notes. You can write a short note for each person you name, for example to say where you left a Legacy Letter. We store it in a form we can read, because we send it to that person by email: if you stop answering check-ins, which can be before we know whether you've died, and again after we confirm your death if you made them a Legacy Letter. We remove links, email addresses and anything that looks like a letter code before we store it. Don't put a letter code, your answers or anything private in it. We email you whenever a note is changed.

Legacy Letters. If you make a Legacy Letter for someone, we store a hash of their full legal name, signed by you, and use it only to check the ID of whoever uses that letter.

Emails that can't be delivered. If our email provider tells us an email to someone you named couldn't be delivered because the address doesn't work, we note it on your Beneficiaries page and email you once, so you can check the address. We clear the note when you change the address.

Beneficiaries who wish to exercise their data rights may contact us at privacy@keepacy.com.

2.6 Information From People Who Use a Legacy Letter or Legacy Card

If you find a Legacy Letter or Legacy Card and enter it at keepacy.com/found, you give us information directly, even if you have no Keepacy account:

  • an email address, if you choose to give one, which we use only to tell you about that claim;
  • a copy of the account holder's death certificate, which a member of our staff reviews and which we store encrypted;
  • a photo of your government ID, which a member of our staff looks at. For a Legacy Letter, they check that the name matches the name the account holder wrote. For a Legacy Card, they record the full name on your ID and the kind of ID, encrypted with your claim, as a record of who received what was shared.

The letter's or card's code and your answers are never sent to us. Our servers also log your IP address, as they do for every visitor. If the account holder's account is deleted, we delete your claim and everything you sent us with it. You can ask about your information at privacy@keepacy.com.

3. Lawful Basis for Processing

We process your personal information on the following legal bases:

  • Contractual necessity: processing required to provide the Service you have signed up for, including document storage, check-in monitoring, beneficiary notifications, and account management.
  • Consent: where you have opted in to specific features, such as SMS messaging or voice call check-ins. You may withdraw consent at any time.
  • Legitimate interests: fraud prevention, security monitoring, abuse detection, understanding how the Service is used, improving its reliability, and carrying out an account holder's instructions for the people they named and for holders of their Legacy Letters and Legacy Card, where these interests are not overridden by your rights.
  • Legal obligation: where we are required to process or retain data to comply with applicable laws.

4. How We Use Your Information

We use the information we collect to:

  • Provide, operate, and maintain the Service, including document storage, check-in monitoring, and beneficiary notifications.
  • Authenticate your identity and protect your account (passwords, MFA, session management).
  • Send transactional communications: email verification, check-in prompts, MFA codes, beneficiary notifications, and account and security alerts.
  • If you have added a number for texts or calls, send you check-in reminders, escalation alerts and security alerts about your account, and a text telling you to check your email if someone who named you in Keepacy stops checking in.
  • Make and mail your Legacy Card, if you order one.
  • Review death certificates, check the ID of people who use a Legacy Letter or Legacy Card, and check the ID of an account holder who asks our support team for help when they can't sign in.
  • Process payments and manage subscriptions.
  • Use your Life Plan profile answers (the yes-or-no questions described in Section 2.1) to tailor the Life Plan wizard, and to tell you about Keepacy features, products, or services that fit your situation. We do not use the contents of your Life Plan or your documents for this.
  • Use your approximate location to suggest services near you.
  • Understand how Keepacy is used and improve it, using product analytics (Section 2.2).
  • Detect, investigate, and prevent security incidents and fraudulent activity.
  • Comply with legal obligations, including responding to lawful data requests.

We do not use your personal information for targeted advertising. Other than the use of your Life Plan profile answers and approximate location described above, we do not use it for profiling or for any purpose unrelated to the operation of the Service.

5. Automated Decision-Making

Keepacy's check-in system uses automated processing to monitor your activity and trigger escalation sequences. Specifically:

  • If you do not respond to check-in prompts within your configured inactivity window, the system automatically escalates reminders (SMS, email, voice call) and then tells the people you named that we haven't heard from you.
  • Nothing is released automatically because you stopped responding. A release needs a member of our staff to approve a copy of your death certificate.
  • This automated processing is a core function of the Service that you configure and control. You set the inactivity window, choose the escalation methods, and designate which beneficiaries receive access to which documents.
  • You can change your inactivity window, or pause check-ins for up to 6 months, from your account settings. You can't pause once we have told the people you named. While we're waiting for you to check in, checking in or pausing inside the app asks for your password. The check-in link in our reminder emails and texts doesn't.
  • Responding to any check-in prompt at any stage of escalation immediately resets the system. On an account that uses device keys, it also cancels a release that hasn't taken effect yet.

No other automated decision-making or profiling with legal or similarly significant effects is performed on your data.

6. SMS and Messaging

If you add a number for texts in your check-in settings, we first text it a code, and save the number only once you enter that code. We then text you check-in reminders, escalation alerts and security alerts about your account. If someone who named you in Keepacy stops checking in, we may also text you to check your email. We only text numbers people have added to their own Keepacy account. If someone enters your number by mistake, you may get a text with a code. Unless that code is entered, we don't save the number or text it anything else. The following applies:

  • We collect your mobile phone number only to send you these messages.
  • We do not use your phone number, SMS opt-in data, or any data collected via SMS for marketing or advertising purposes.
  • No mobile information will be shared with third parties/affiliates for marketing/promotional purposes. Phone numbers are shared only with our SMS delivery provider (Twilio) for the sole purpose of delivering messages to you.
  • SMS consent is not a condition of purchasing any goods or services from Keepacy.
  • You can opt out of SMS messages at any time by replying STOP to any message or by removing your number in your check-in settings. Replying STOP stops every text we send to that number, including your own check-in reminders.
  • For help, reply HELP to any message or contact support@keepacy.com.

7. Data Sharing and Disclosure

We do not sell your personal information. We do not share your personal data with third parties for their marketing or advertising purposes.

We share information only in the following limited circumstances:

  • Service providers (sub-processors): we use third-party providers to operate the Service. These providers access only the minimum data necessary to perform their functions, are contractually obligated to protect it, and have Data Processing Agreements in place where required. See Section 13 for a full list.
  • Beneficiary access: when your check-ins lapse, we tell the people you named, and send each of them any personal note you wrote for them. On an older account, they can then also see the title, category and dates of each document you share with them. After we confirm your death, the people you chose can open what you shared with them. On an account that uses device keys, that means only people who accepted your invitation and were approved from your device while you were alive, and whoever holds a Legacy Letter or Legacy Card you made and passes our checks. This is a core function of the Service that you control.
  • Legacy Card mailing: we mail your Legacy Card by postal mail to the address you give us. We don't give that address to anyone else.
  • Legal requirements: we may disclose information when required by law, court order, or governmental regulation, or when we believe disclosure is necessary to protect the rights, property, or safety of Keepacy, our users, or the public. On an account that uses device keys, Keepacy's servers hold no key that can open documents or read their titles, so we can't disclose those.
  • Business transfers: if Keepacy is acquired, merged, or sells substantially all of its assets, user data may be transferred as part of that transaction. We will notify users via email at least 30 days before any such transfer and update this Privacy Policy.

8. Data Security

We implement technical and organizational measures to protect your data:

  • Accounts that use device keys: your device encrypts your documents and Life Plan before they are uploaded. The keys are kept on your devices and, locked with your recovery kit, on our servers. Keepacy's servers hold no key that can open your documents. When an account moves to device keys, we delete its old key from our live systems right away. Our automated database backups made before the move still contain that key until they expire, within 30 days. Until then, someone who had one of those backups and either our server secrets or your old password could read what your account held when it moved, but nothing you add or change afterwards.
  • Older accounts: all documents are encrypted at rest using AES-256-GCM with per-document encryption keys and protected in transit by TLS. Keepacy holds a server-side recovery key that is used only for beneficiary release (after we confirm your death through our death certificate review) and for account recovery (password reset).
  • The app itself: on the web, the code that opens your documents is sent by Keepacy each time you visit. We control how that code is built and released, and you are trusting that code when you use it.
  • All data in transit is encrypted using TLS 1.2 or higher.
  • Passwords are hashed using bcrypt with a work factor of 12.
  • Multi-factor authentication is enabled on every account when it is created: a one-time code sent to your email, which cannot be turned off in Settings. An authenticator app or passkey can be added in Settings.
  • MFA secrets are encrypted with their own dedicated key. Death certificates, ID photos, Legacy Card mailing addresses, and names recorded from Legacy Card claims and from our support team's ID checks are encrypted with keys derived from a separate dedicated secret.
  • The names, email addresses and relationships of the people you name, your personal notes to them and your invitation questions are stored so we can read them, because we use them to contact those people and to show them to you.
  • Legacy Letters: we never receive a letter's code or your answers. Someone who had your letter and also a copy of our database could try to guess your answers without our limits on tries, so pick answers only the person you made it for would know. With only one question this matters more.
  • Legacy Card: the member of our staff who makes your Legacy Card sees its code while making it. The code is never stored on our servers, and we don't keep a copy once the card is made. We never see the answers you set. Someone who kept the code and also had a copy of our database could try to guess your answers, which is why the card needs at least three.
  • Our database and its backups are encrypted at rest.
  • Access to production systems is restricted to authorized personnel and logged.

While we strive to protect your data, no method of electronic storage or transmission is 100% secure. We cannot guarantee absolute security.

9. Data Breach Notification

In the event of a data breach that poses a risk to your rights and freedoms, we will:

  • Notify affected users by email within 72 hours of becoming aware of the breach.
  • Provide a description of the nature of the breach, the categories of data affected, and the measures taken or proposed to address it.
  • Report the breach to relevant supervisory authorities as required by applicable law (including GDPR Article 33 where applicable).
  • Maintain an internal record of all data breaches, regardless of whether notification is required.

10. Data Retention

We retain your data as follows:

  • Active account data: retained for the lifetime of your account.
  • Documents: retained until you delete them or your account is deleted. When you delete a document, we delete the file; copies in our storage's version history are removed after 90 days. A record that the document existed stays with your account. When your account is deleted, we delete every copy of every file, earlier versions included.
  • Audit logs: kept for 3 years after your account is deleted. They are not anonymized: we remove the link to your account, but an entry can still show your account's ID number, and many show the IP address and browser used. Entries that record a directive being removed or confirmed again are kept as directive records are (below).
  • Records of emails, texts and calls that aren't linked to an account: for many messages we send, we keep a record that isn't linked to anyone's account. These include check-in reminders by email, text or call; emails and texts to the people you named, such as when you name them, when we haven't heard from you, about a death certificate, and when what you shared is released or a release is cancelled; emails to someone who uses a Legacy Letter or Legacy Card; the email confirming your account was deleted; and notices to our staff about your account, such as when you sign up, add a person or a document, change your plan or order a Legacy Card, or when someone sends a death certificate or makes a claim. Each record shows when we sent it, whether it was an email, text or call, whether it went through (and the error if it didn't), and part of the address: the first two characters and the domain of an email address, or the last 4 digits of a phone number. Some also keep your email address or that of the person the message is about, shortened the same way, and a few details, such as a document's category and size, your old and new plan, or a claim or order number. These records don't include the message itself. Because they aren't linked to your account, they aren't deleted with it. We have not yet set how long they are kept.
  • Emails, texts and calls waiting to be sent: some messages wait in our sending queue until they go, with their full content. These include check-in reminders and alerts by email and text, and notices about your account's security or a release. A check-in call keeps the number to call and the check-in link. We delete each one from the queue 7 days after it is sent, or 30 days after sending finally fails. An email that carries a private link, such as a check-in link or a link to send us a photo of your ID, is deleted as soon as it is sent, or a day after sending fails. Check-in texts also carry a check-in link and are kept for the 7 or 30 days. Backups of the queue keep copies for up to 7 more days.
  • Beneficiary access logs (records of what the people you named opened, with their IP address): kept while the person is listed, and deleted when you remove them or your account is deleted.
  • Linked financial account data: balances are recorded for as long as the connection is active. Removing a connection revokes the access token at our provider and stops all further updates; the balance history already recorded stays in your account, encrypted, so that removing a link does not erase your past figures. It is deleted when your account is deleted.
  • Financial institution access tokens: encrypted at rest, revoked at the provider on disconnection, and deleted when the connection is removed or your account is deleted.
  • Check-in event history: retained for 1 year.
  • Beneficiary contact information: kept until you remove the person or your account is deleted. A copy of their name and email address stays in your directive record (below).
  • Personal notes: kept until you change or remove the note, remove the person, or your account is deleted.
  • Notes that an email couldn't be delivered: cleared when you change the person's address, and deleted when you remove them or your account is deleted.
  • Invitation questions and answer check values: deleted when someone is approved, when the invitation expires (30 days after it is sent), or when too many wrong answers cancel it. A hash of the question and the count of wrong answers are kept while the person is listed, so a cancelled question can't be reused.
  • Legal-name hash for a Legacy Letter: kept with the letter's signed record for as long as we keep your account.
  • Legacy Card mailing address: deleted when you activate the card, when the order is cancelled, or 90 days after we mail it, whichever comes first. An order we haven't mailed yet keeps the address until we mail it or the order is cancelled.
  • ID photos sent with a Legacy Letter or Legacy Card claim: deleted when staff record the check, when the claim ends, or 90 days after upload if no check was recorded, whichever comes first.
  • Name and ID type recorded from a Legacy Card claim: kept as the record of who received a release, until the account holder's account is deleted. If the claimant never opened what was released, they are deleted when the claim ends.
  • Email addresses given at keepacy.com/found: kept with the claim record, until the account holder's account is deleted.
  • Photos of ID sent to our support team: deleted when our staff record the check, when your account is deleted, or 30 days after you upload it, whichever comes first. The upload link stops working once it is used, or after 7 days.
  • Name and ID type recorded by our support team: kept, encrypted, as the record of who asked for help with your account, until your account is deleted. We never record the ID number.
  • Records of what you agreed to: the record of your agreement to our Terms and this Privacy Policy is deleted with your account, but a copy in our audit log, with your IP address and user agent, is kept as audit logs are (above). Each directive record, with the name and email address of the person you named, the text you agreed to, your IP address and your user agent, is kept after you remove the person and after your account is deleted, as the record of what you directed. We have not yet set how long directive records are kept.
  • Death certificates: deleted if the account holder checks in, and, for one sent with a Legacy Letter or Legacy Card, if we reject it or the claim is cancelled. Otherwise we keep it as a record of the release, until the account holder's account is deleted.

Deleting your account

You can ask us to delete your account by emailing support@keepacy.com from the email address on your account. If you can't sign in, we will also ask for a photo of your ID, through a one-time link we email to that address. We will confirm your request and respond within 30 days. Once we delete it, there is no grace period and we can't undo it. We delete your account and everything in it, and email you when it's done. If someone approved you to receive what they share, we email them that your account was deleted, unless their check-ins have lapsed or a release has started.

After your account is deleted, we keep only:

  • the audit log entries, records of emails, texts and calls that aren't linked to an account, consent copies and directive records described above;
  • your payment history at Stripe, our payment processor. We delete your customer record there, but Stripe keeps records of your past payments, as payment and tax law require;
  • the product analytics described in Section 2.2, which PostHog keeps under its own retention settings. We don't yet ask PostHog to delete them when your account is deleted;
  • copies in our database backups, which are deleted as the backups expire, within 30 days; in our sending queue and its backups, within 37 days; and in our server logs, within 90 days;
  • anything the law requires us to keep.

11. International Data Transfers

Keepacy is based in the United States. All data is stored and processed on servers located in the United States (AWS US-East-1 region). If you access the Service from outside the United States, your information will be transferred to, stored, and processed in the United States.

For users in the European Economic Area (EEA), United Kingdom, or Switzerland, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission and/or the UK International Data Transfer Agreement as the legal mechanism for transferring personal data to the United States. Our sub-processors (AWS, SendGrid, Twilio, Stripe, Cloudflare, Plaid, PostHog) each maintain their own SCCs and Data Processing Agreements.

12. Your Rights

12.1 All Users

You may:

  • Download your documents from your vault, and ask us for a copy of the other data we hold about you.
  • Correct or update your personal information at any time.
  • Ask us to delete your account and associated data (Section 10).
  • Opt out of SMS communications at any time.

12.2 European Economic Area, United Kingdom, and Switzerland (GDPR)

If you are located in the EEA, UK, or Switzerland, you have the following additional rights under the General Data Protection Regulation:

  • Right of access: request a copy of the personal data we hold about you.
  • Right to rectification: request correction of inaccurate or incomplete data.
  • Right to erasure: request deletion of your personal data, subject to legal retention obligations.
  • Right to restrict processing: request that we limit how we use your data in certain circumstances.
  • Right to data portability: receive your personal data in a structured, commonly used, machine-readable format.
  • Right to object: object to processing based on legitimate interests.
  • Right to withdraw consent: where processing is based on consent (e.g., SMS opt-in), you may withdraw consent at any time without affecting the lawfulness of prior processing.
  • Right not to be subject to automated decision-making: you may request human review of any automated decision that significantly affects you. See Section 5 for details on our automated processing.
  • Right to lodge a complaint: you have the right to lodge a complaint with your local data protection supervisory authority.

We do not currently have a physical establishment in the EEA. If we determine that we are required to appoint an EU representative under GDPR Article 27, we will update this policy with their contact details.

12.3 California Residents (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act and California Privacy Rights Act:

  • Right to Know: you may request the categories and specific pieces of personal information we have collected about you, the sources, the business purpose, and the categories of third parties with whom we share it.
  • Right to Delete: you may request that we delete your personal information, subject to certain exceptions.
  • Right to Correct: you may request correction of inaccurate personal information.
  • Right to Non-Discrimination: we will not discriminate against you for exercising your privacy rights.
  • Do Not Sell or Share: we do not sell personal information and do not share personal information for cross-context behavioral advertising. No opt-out is necessary because no sale or sharing occurs.
  • Sensitive personal information: we collect photos of government IDs (Sections 2.1 and 2.6) and the details you use to sign in. We use them only to provide the Service, check who someone is and keep accounts secure. We don't use them to infer anything about you, so there is nothing for you to limit.

12.4 Virginia, Colorado, Connecticut, and Other US States

If you are a resident of Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), or another US state with a comprehensive consumer privacy law, you may have similar rights to access, correct, delete, and port your personal data, as well as the right to opt out of targeted advertising and the sale of personal data.

  • We do not sell personal data or use it for targeted advertising, so no opt-out action is required on your part.
  • We honor Global Privacy Control (GPC) and similar browser-based opt-out preference signals.
  • Right to appeal: if we deny a privacy rights request, you may appeal by contacting us at privacy@keepacy.com with the subject line “Privacy Rights Appeal.” We will respond within 60 days. If you are not satisfied with our response, you may contact your state's attorney general.

To delete your Keepacy account, email support@keepacy.com from the email address on your account, as Section 10 explains. For any other right described above, or if you don't have an account, contact us at privacy@keepacy.com. We will respond to verified requests within 30 days (or within the timeframe required by applicable law). These rights also apply to people who never created an account, such as someone an account holder named or someone who used a Legacy Letter or Legacy Card.

13. Third-Party Services (Sub-Processors)

The Service integrates with the following third-party providers. We maintain Data Processing Agreements with each where required:

  • Amazon Web Services (AWS): cloud infrastructure, encrypted file storage (including death certificates and ID photos sent to us), database hosting, and application logs. Data stored in the US-East-1 region.
  • SendGrid (Twilio): transactional email delivery. Receives email addresses and message content necessary to deliver check-in prompts, MFA codes, security alerts, and messages to the people you named and to people using a Legacy Letter or Legacy Card, including any personal note you wrote. SendGrid tells us when an email can't be delivered. Emails to the people you named carry an internal reference number, not their name, so we can match that report to the right person.
  • Twilio: SMS delivery and voice calls. Receives the numbers people add for texts and calls, and the content of those messages: codes that confirm a number, check-in reminders, escalation alerts, security alerts, and the text telling someone to check their email when a person who named them stops checking in. Phone and SMS data shared with Twilio is not used for marketing.
  • Stripe: payment processing for subscriptions. Receives payment card data, billing address, and transaction details. Keepacy does not store payment card numbers.
  • Cloudflare: bot protection (Turnstile) on authentication forms. Processes IP addresses and browser metadata to distinguish humans from bots.
  • Plaid: financial account connections. If you choose to link an external bank, brokerage, or loan account, Plaid authenticates you with your financial institution and returns account balances, investment holdings, and liability detail to Keepacy. Plaid receives the credentials you enter in its own interface; Keepacy never sees or stores them. Keepacy does not request your transaction history and does not use financial data for marketing.
  • PostHog: product analytics and session recordings, hosted in the United States. Receives the pages you visit, the actions you take, your email address, your plan, and session recordings as described in Section 2.2. It does not receive your documents.

Each provider maintains its own privacy policy and security certifications. We share only the minimum data necessary for each provider to perform its function.

14. Do Not Track

Some browsers transmit a “Do Not Track” (DNT) signal. Because there is no industry-wide standard for DNT, we do not currently respond to DNT signals specifically. However, Keepacy does not engage in cross-site tracking, interest-based advertising, or any tracking that DNT is designed to prevent. We also honor Global Privacy Control (GPC) signals as an opt-out of the sale or sharing of personal data, though we do not sell or share personal data in any case.

15. Children's Privacy

Keepacy is not intended for individuals under the age of 18. We do not knowingly collect personal information from children. If we learn that we have collected data from a child under 18, we will delete it promptly. If you believe a child has provided us with personal information, please contact us at privacy@keepacy.com.

16. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will email you at least 30 days before they take effect and update the “Last Updated” date at the top of this page. We may make a change sooner if the law or the security of the Service requires it. Your continued use of the Service after a change takes effect constitutes your acceptance of the revised policy. We encourage you to review this policy periodically.

17. Contact Us

If you have questions about this Privacy Policy or our data practices, contact us at: