Last updated: 26 October 2026
In short: the contents of your vault are encrypted and we cannot read them. We use no tracking and we don’t sell data. This policy explains how we handle personal data as a controller under the UK GDPR and the Data Protection Act 2018.
We are the controller of your personal data: Apex Ventures Tech LLC Company number [00000000] [Street and number] [Town, Postcode] United Kingdom Email: support@ifever.uk.com Phone: [phone number]
Data protection contact: privacy@ifever.uk.com
When you open our website, our hosting provider automatically records technical data in server logs:
We use this to keep the website working and secure, for example to fend off attacks. Our lawful basis is our legitimate interests (Article 6(1)(f) UK GDPR). We delete the log files after [7] days.
Hosting provider: [name, address, server location]. We have a written data processing agreement with them.
This website does not use cookies for advertising or analytics. If you switch between light and dark theme, we remember your choice in your browser’s local storage. It never leaves your device.
After you sign in, we use a strictly necessary session cookie so you stay signed in. [Add name and lifetime once the app is connected.]
Our fonts are hosted on our own server. Loading the website does not connect to Google or any other font provider.
When you create an account, we collect:
Our lawful basis is performance of our contract with you (Article 6(1)(b) UK GDPR). Your mobile number is optional.
Documents, passwords and letters in your vault are each encrypted with AES-256-GCM using their own key, and each of those keys is wrapped by a master key held separately from the database. Our staff have no access to the contents. A stolen copy of the database alone does not reveal your documents.
Honest limitation: this is encryption we hold the key to, because the service must be able to deliver your vault when you can no longer act. We do not have a design where only you hold the key and delivery still works.
Your vault may contain special-category data, for example health data in an advance decision. We only process it on the basis of your explicit consent (Article 9(2)(a) UK GDPR), because you choose to store it with us and want it passed to the people you choose. You can withdraw consent at any time by deleting the contents.
You can add names, email addresses and mobile numbers of people who should receive documents or confirm a release. We process this on the basis of our legitimate interests in providing the service you asked for (Article 6(1)(f) UK GDPR), and use it only for that purpose.
Please tell these people beforehand. When we first contact them, we tell them who we are, why we are contacting them and where to find this policy. ifever is free for recipients and trusted people. They do not enter into a contract with us. They may contact us at privacy@ifever.uk.com to access, rectify or erase the information you provided about them, or to opt out of messages from us.
Your partner’s vault is separate from yours. We do not show you anything stored in your partner’s vault, and we do not show them anything stored in yours.
If you report a death to us, we collect the uploaded proof (for example the death certificate), the details about the person who died, and your name, email address and relationship to that person. We use this only to check the report, inform the trusted people and reach you if we have questions.
We delete the proof once the check is complete, at the latest after [90] days.
We send reminders, confirmation requests and releases by email and text message through service providers (processors): [email provider, location] and [SMS provider, location]. Passwords or vault contents are never put in an email or text message.
Because the phone numbers of your recipients are supplied by you rather than by them, we ask each person directly before we ever text them, and we record when and how they agreed. Anyone can reply STOP or use the link in that message to opt out at any time, and we will tell you if that happens so you can reach them another way. Message and data rates may apply. We do not send marketing messages.
Payments are handled by [payment provider, location]. The provider does not pass your card or account details to us. We keep billing records for at least six years because of tax law.
If a payment fails, we do not lock your vault. We then use your contact details to let you know.
We use no analytics or advertising services. We don’t sell personal data or pass it on for direct marketing.
[Describe where vault data is stored and which processors handle data, with the country and what information.] Where we transfer personal data outside the UK, we rely on appropriate safeguards such as an adequacy decision or the ICO’s International Data Transfer Agreement or Addendum. Each processor is bound by a written data processing agreement.
We keep your information as long as your account exists. After you cancel, we delete your account and vault after [30] days, unless the law requires us to keep it. After a release, released documents remain available to recipients for [period] and are then deleted. Deletion cannot recall anything already delivered.
Under the UK GDPR you have the right to:
Just email us at privacy@ifever.uk.com. We respond within one month.
If you are unhappy with how we handled your data, contact us first. You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk or on 0303 123 1113.
All connections to our website and app are encrypted with TLS. Vault contents are also encrypted one by one, and passwords and access codes are hashed with scrypt, never stored in readable form. Access attempts are limited.
If a personal data breach is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours as required by the UK GDPR, and we will tell you without undue delay where the risk is high.
If our service or the law changes, we update this privacy policy. The version published here applies. If we make a material change, we will notify account holders by email before it takes effect.