Privacy Policy
What personal data we collect, why we collect it, how long we keep it, and the rights you have over it.
Last updated: May 2026 · UK GDPR & Data Protection Act 2018
Who we are
SEQUR is the data controller for personal data processed through this service. For privacy questions, our designated contact is privacy@securelegacydemo.com.
What we collect
Account information
Your email address, password (hashed, never stored in clear), display name, and the language you prefer the interface in.
Vault content
The documents, messages, voice notes, and other files you upload. These are encrypted at rest using AES-256-GCM. We also store the metadata you attach to them (titles, descriptions, tags).
Trusted contact details
The names, email addresses, and relationships you record for the people you nominate as trusted contacts. They are notified only when a release condition you configured has been met.
Authentication data
Multi-factor authentication secrets, recovery codes, and session tokens. We log sign-in attempts and security-relevant events for your audit log.
Usage and technical data
IP address, user-agent string, and timestamps for security and audit purposes only. We do not run third-party analytics or advertising trackers.
Why we process it (lawful basis)
- Contract. To deliver the service you signed up for: storing your vault, sending notifications, handling release events.
- Legitimate interests. To keep the service secure (logging, abuse prevention, MFA) and to investigate reported faults.
- Legal obligation. To respond to lawful requests from authorities and to retain audit data for the period required by UK law.
- Consent. For optional things — for example, if you opt in to product update emails. You can withdraw consent at any time.
Who we share it with
We do not sell your data. We share it only with the following categories of processor, each under a data processing agreement:
- Cloud hosting and storage providers (servers located in the UK and EU only).
- Email delivery providers, used to send transactional notifications you have asked for.
- Payment processors, when you upgrade to a paid tier (we never see or store full card numbers).
- Lawful authorities, where required by a valid court order or statutory request.
How long we keep it
Active account data is retained while your account is open.
If you delete a document, it is removed from your view immediately and permanently purged from storage within 30 days.
If you close your account, all account data, vault content, and trusted-contact records are scheduled for permanent deletion within 30 days.
Audit logs and security-relevant events may be retained for up to 12 months after account closure for fraud and abuse investigation.
Your rights
Under UK GDPR you have the right to:
- Access the personal data we hold about you.
- Correct inaccurate or incomplete data.
- Request deletion of your account and associated data.
- Object to processing or request that it is restricted.
- Receive a copy of your data in a portable machine-readable format.
- Withdraw consent for any processing based on consent.
- Lodge a complaint with the Information Commissioner's Office (ico.org.uk).
To exercise any of these rights, email privacy@securelegacydemo.com. We respond within one calendar month.
International transfers
Your vault content is stored on servers located in the United Kingdom and European Union. Where a processor operates outside that area (for example, an email delivery provider), we rely on the UK's adequacy decisions or Standard Contractual Clauses to keep your data protected.
Changes to this policy
When we make material changes to how we process your data, we update the “last updated” date above and notify registered users by email. Continuing to use the service after notification constitutes acceptance of the revised policy.