Privacy Policy

1. Who we are

Life 2 Legacies is a product of Hindle Consultants Pty Ltd, registered in Queensland, Australia (ABN 82 776 195 367). Our registered address is 36 Park Cove Boulevard, Hope Island QLD 4212. You can reach us at support@life2legacies.com.

2. What information we collect

We collect only what is necessary to provide the service:

• Account information — your name, email address, password (hashed with bcrypt, never stored in plain text), and country.
• Vault content — everything you add to your vault. This is encrypted at field level using AES-256-GCM before it is stored. We cannot read the contents of your vault items.
• Contacts — names and email addresses of people you add as trusted contacts.
• Billing information — payment is processed by Stripe. We do not store card numbers. We receive and store your Stripe customer ID and subscription status.
• Usage data — server logs including IP address, timestamps of requests, and error logs. These are used for security monitoring and debugging only.
• Communications — emails and SMS sent through ClickSend for security codes, access notifications, and billing reminders.

3. How we use your information

• To provide and operate the Life 2 Legacies service
• To authenticate you and secure your account with two-factor authentication
• To send transactional emails (OTP codes, ICE access notifications, billing reminders)
• To process payments via Stripe
• To maintain security audit logs of vault access
• To respond to support enquiries

We do not sell, rent, or share your personal information with third parties for marketing purposes. We do not use your vault content for any purpose other than storing and decrypting it for you.

4. Encryption and security

Your vault content is encrypted at the field level using AES-256-GCM envelope encryption. Encryption keys are managed by AWS Key Management Service (KMS) in the ap-southeast-2 (Sydney) region. The database stores only ciphertext — we cannot access the contents of your vault items even if we wanted to.

Passwords are hashed using bcrypt with a work factor of 12. Two-factor authentication (TOTP or email code) is mandatory for all accounts. Sessions use short-lived HTTP-only cookies.

5. Third-party services

• Neon PostgreSQL — encrypted database hosting. Data stored in AWS us-east-1.
• AWS KMS — encryption key management. Sydney region (ap-southeast-2).
• Vercel — application hosting and edge network.
• Stripe — payment processing. Subject to Stripe’s own privacy policy.
• ClickSend — transactional email and SMS delivery.
• Anthropic — AI-powered guided sessions (Life Story, Ancestry). Conversation content is sent to Anthropic’s API for processing during guided sessions only. It is not stored by Anthropic beyond the API request.

6. Data retention

We retain your data for as long as your account is active. If you delete your account via Settings → Delete my data, all vault content, contacts, and personal information is permanently deleted from our systems within 30 days. Stripe billing records are retained as required by financial regulations.

Backup and log data may be retained for up to 90 days after account deletion for security and debugging purposes.

7. Your rights

Depending on your location, you may have the right to:

• Access the personal information we hold about you
• Correct inaccurate personal information
• Delete your account and all associated data
• Object to or restrict certain processing
• Data portability (receive your data in a machine-readable format)
• Withdraw consent where processing is based on consent

Australian users have rights under the Privacy Act 1988 (Cth) and Australian Privacy Principles. UK and EU users have rights under UK GDPR and EU GDPR respectively. US users in California have rights under CCPA. To exercise any of these rights, contact us at support@life2legacies.com.

8. Cookies

We use a single HTTP-only session cookie to maintain your authenticated session. We do not use advertising cookies, analytics cookies, or any third-party tracking. We do not use Google Analytics or similar services.

9. Children

Life 2 Legacies is not intended for use by anyone under 18 years of age. We do not knowingly collect personal information from minors.

10. Changes to this policy

We may update this policy from time to time. Material changes will be notified by email. The current version is always available at life2legacies.com/privacy.

11. Contact

Hindle Consultants Pty Ltd
36 Park Cove Boulevard, Hope Island QLD 4212, Australia
support@life2legacies.com
hindleconsultants.com