Privacy Policy

GetWilled ("we", "us", "our") is the data controller for personal data collected through the GetWilled website and will-creation service. We are registered with the Information Commissioner's Office (ICO) under registration number [ICO registration number].

Contact: hello@getwilled.co.uk

We collect the following categories of personal data:

• Account data: your name, email address, and password (hashed and salted — we never store your password in plain text).
• Will data: information you enter to draft your will, including your date of birth, address, marital status, details of beneficiaries, executors, and your assets. This is sensitive personal data and is treated accordingly.
• Payment data: transaction records. Card details are processed directly by Stripe and are never stored on our systems.
• Usage data: pages visited, features used, browser type, IP address, and device information, collected via cookies and server logs.
• Communications: emails, support messages, and any other correspondence you send us.

We use your personal data to:

• Provide, operate, and maintain the Service;
• Generate your will document;
• Process payments and send receipts;
• Send account-related emails (password resets, confirmations, notifications);
• Respond to support enquiries;
• Improve and develop the Service (using aggregated, anonymised data);
• Comply with legal obligations.

We process your data on the following legal bases under UK GDPR:

• Contract: processing necessary to provide the Service you have signed up for.
• Legitimate interests: fraud prevention, service security, and improving the Service — where these do not override your rights.
• Legal obligation: complying with applicable law.
• Consent: for optional marketing communications. You can withdraw consent at any time.

We do not sell your personal data. We share data only where necessary:

• Stripe: payment processing. Stripe's privacy policy governs how they use your data.
• Infrastructure providers: cloud hosting (Vercel, Neon), email delivery (Mailjet), and analytics — all bound by data processing agreements.
• Law enforcement: where we are legally required to disclose data.

We retain your account and will data for as long as your account is active, plus a further period of up to seven years to comply with legal and regulatory obligations.

You can request deletion of your account and all associated data at any time from your account settings. Deletion is permanent and irreversible.

We implement appropriate technical and organisational measures to protect your data, including encryption at rest (AES-256) and in transit (TLS 1.3), access controls, and regular security reviews. No method of transmission over the internet is completely secure; we cannot guarantee absolute security.

Under UK GDPR, you have the right to:

• Access the personal data we hold about you;
• Rectify inaccurate or incomplete data;
• Erase your data ("right to be forgotten");
• Restrict processing in certain circumstances;
• Port your data to another service;
• Object to processing based on legitimate interests;
• Withdraw consent at any time where processing is based on consent.

To exercise any of these rights, email us at hello@getwilled.co.uk. We will respond within one month. If you are unhappy with our response, you have the right to lodge a complaint with the Information Commissioner's Office.

We use cookies and similar technologies. For full details, see our Cookie Policy.

Some of our service providers are based outside the UK. Where we transfer data internationally, we ensure appropriate safeguards are in place (such as UK adequacy decisions or standard contractual clauses).

We may update this Privacy Policy from time to time. We will notify you of material changes by email or by displaying a notice on the website. The effective date at the top of this page indicates when it was last updated.

Data protection enquiries: hello@getwilled.co.uk