Privacy Policy

1 Who controls this data

This Privacy Policy explains how Estate Untangled LLC, registered in the United Arab Emirates under Formation Number 2649142 and holding License Number 2649142.01 ("Estate Untangled", "we", "us"), collects, uses, stores, and shares personal data through estateuntangled.com and the Estate Untangled application (the "Service"). It applies to account holders, the trusted contacts they name, and anyone who submits or is granted a death claim.

This Policy is incorporated into, and should be read alongside, our Terms and Conditions.

2 What we collect

We collect only what the Service actually needs to work, directly from you or from someone you've named:

We don't run any analytics or advertising trackers on this site — see section 9.

3 Why we collect it, and our lawful basis

We use your data to: create and run your account; store and encrypt your master file and documents; process your subscription payments; send the transactional emails the Service depends on (account and claim notifications — see our related note on this in the Terms); operate the death claim and review process described in section 8; and keep the Service secure and working.

Our lawful basis for most of this is that it's necessary to perform our contract with you (running the Service you signed up for). Where we process a trusted contact's or claimant's details, our basis is our legitimate interest in operating the feature you specifically asked us to provide — notifying and, where appropriate, granting access to the person you named. We don't use your data for advertising, and we don't sell it.

4 Sensitive information you choose to store

Because the guided master file is open-ended, what you write into it is up to you — and some answers may touch on what data protection law treats as "special category" data (for example, health-related details you mention under an insurance policy, or in your wishes). We don't ask for this deliberately and don't use it for anything beyond storing and, per section 8, eventually disclosing it to an approved claimant exactly as you wrote it. If you'd rather not include something sensitive, you're free to leave any question blank — nothing in the guided flow is compulsory beyond what's marked required.

5 How your data is stored and protected

Your account and master file answers are stored in a managed database, protected by row-level access rules so that only you (or, later, an approved claimant using a separate, time-limited access link) can read your own data. The most sensitive fields — account numbers, reference numbers, and similar details — are additionally encrypted individually using a managed encryption key service before they're ever written to the database, rather than relying on database-level encryption alone. Documents you upload are stored in access-controlled cloud file storage, not the database itself.

No method of storage or transmission is completely secure, and we can't guarantee absolute security — but this is designed so that a database export or an internal error, on its own, isn't enough to expose your sensitive answers.

6 Where your data is processed

Because we rely on international cloud infrastructure, your data is processed and stored outside the country you live in as a matter of course. Account and master file data is held with our database provider's South Korea region; documents and encryption key operations run through our cloud provider's Sweden region; email is sent through our cloud provider's EU-north region; and payment data is processed by Stripe, which operates globally.

As a UAE entity, we process personal data in accordance with UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data ("UAE PDPL"). For customers based in the UK or EEA, we additionally apply the UK GDPR and/or EU GDPR as a baseline — including the lawful-basis, minimisation, and rights framework described elsewhere in this Policy — regardless of whether the UAE PDPL alone would require it. Where data moves out of the UK or EEA, we rely on our providers' own standard contractual clauses, an adequacy decision, or an equivalent lawful transfer mechanism; where it moves out of the UAE, we take reasonable steps to ensure the receiving country or provider maintains an adequate level of protection consistent with the UAE PDPL.

7 Who we share data with

We share data with the following categories of recipient, each acting on our instructions to help run the Service — not for their own separate purposes:

• Infrastructure and database hosting — for authentication, database, and application hosting.
• Cloud storage and encryption — for document storage and the encryption key service described in section 5.
• Email delivery — to send the transactional emails the Service depends on.
• Payment processing — Stripe, to handle your subscription and billing.

We don't share your data with data brokers, advertisers, or anyone else outside the list above, and we don't sell personal data. We may disclose data if required by law, or to protect our rights, safety, or the safety of others.

There is one further, deliberate exception to all of the above, described fully in the next section: an approved death claim.

8 The death claim process, specifically

This is the one situation where your data may be shared with another named individual rather than a service provider, and it deserves its own explanation rather than being folded into section 7.

If someone submits a claim using your private claim link, we process their name, email, relationship, and message in order to notify you and, if the claim isn't cancelled, allow our team to review it. If a claim is approved after human review, the claimant is given a time-limited, read-only view of your master file and documents as they stood at approval — this is the intended purpose of the feature, and by naming a trusted contact and keeping this feature enabled you're specifically directing us to make this disclosure under these conditions. Full detail on how that review process works, including its real limitations, is in section 7 of our Terms and Conditions, which we'd encourage reading alongside this section.

We don't otherwise disclose your master file or documents to anyone, under any other circumstance, without a valid legal basis to do so.

9 Cookies and local storage

We don't use cookies, and we don't run any third-party analytics, advertising, or tracking scripts on this site. The one piece of information the site keeps in your browser is your session token, stored using your browser's local storage (not a cookie) so you stay signed in between visits — this is purely functional, isn't shared with any third party, and is cleared when you sign out.

10 How long we keep data

We keep your account and master file data for as long as your account is active. If you close your account, we delete it within 30 days, except where we need to keep something longer to comply with the law or resolve a dispute already in progress. An approved claimant's access link expires after a limited period shown to the claimant at the time of access, and isn't a standing account.

11 Your rights

Depending on where you're based, you may have the right to: access the personal data we hold about you; correct it if it's inaccurate; ask us to delete it; ask us to restrict or object to certain processing; and receive a copy of it in a portable format. Most of this you can already do yourself from your dashboard — your master file is editable and your documents removable at any time — but you can also contact us directly using the details in section 16.

Where a trusted contact or claimant asks us about the data we hold about them specifically (their own name, email, message, and relationship — not your master file, which remains yours), the same rights apply to that data.

12 Automated decisions

We don't make any decision about approving or denying a death claim automatically. Every claim is reviewed individually by a person before access is ever granted or refused — there's no algorithm or automatic process that decides this on our behalf.

13 Children

The Service is for adults and isn't directed at children. We don't knowingly collect personal data from anyone under 18.

14 If something goes wrong

If we become aware of a security incident that puts your personal data at risk, we'll investigate, take reasonable steps to contain it, and notify you and, where legally required, the relevant regulator, without undue delay.

15 Changes to this policy

We may update this Policy from time to time — for example, to reflect a new feature or a change in the law. If a change is material, we'll take reasonable steps to notify you, such as an email or an in-app notice, before it takes effect.

16 Contact and complaints

Questions about this Policy, or a request relating to your data, can be sent via our contact page. If you're not satisfied with our response, you may also have the right to complain to your local data protection regulator — for example, the UAE's Office of the Competent Authority for Data Protection if you're UAE-based, the ICO if you're UK-based, or your local supervisory authority if you're in the EEA.