Privacy policy

1. Introduction and Scope

This Privacy Policy explains how Exit State Limited ("we", "us", "our", "the Company") collects, uses, stores, shares, and protects your personal data when you visit our website at exitstate.xyz ("the Site") and use our online will creation service ("the Service"). This policy applies to all Users of the Service, including visitors, registered Users, and individuals whose personal data is provided to us by Users (such as named beneficiaries, executors, and witnesses).

We are committed to protecting your privacy and handling your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) as retained under the European Union (Withdrawal) Act 2018, and the Data Protection Act 2018 (together, "Data Protection Law"). This policy should be read alongside our Terms of Service and Safety Policy.

2. Data Controller

For the purposes of Data Protection Law, the data controller is:

If you have any questions about this Privacy Policy or our data practices, or if you wish to exercise any of your data protection rights, please contact our data protection contact at privacy@exitstate.xyz.

3. Personal Data We Collect

3.1 Data you provide directly

When you register for and use the Service, we collect the following categories of personal data that you provide:

3.2 Data collected automatically

When you access the Service, we automatically collect certain technical and usage data:

• Technical data: IP address, browser type and version, operating system, device type, screen resolution, time zone setting, and browser plug-in types.
• Usage data: Pages visited, features used, session duration, clickstream data, referral source, and search terms used to find the Site.
• Authentication data: Login method (email link or Google), authentication tokens, session identifiers, and login timestamps.

3.3 Payment data

Payment card details (card number, expiry date, CVV) are collected and processed exclusively by our payment processor, Stripe, Inc. We never receive, store, or have access to your full payment card details. We receive only: a transaction reference identifier, confirmation of payment status, the amount paid, and the last four digits of the card used (for your reference in account settings).

3.4 Special category data

3.5 Third-party data

When you name beneficiaries, executors, witnesses, or guardians in your Will, you provide us with their personal data (typically their name, relationship to you, and contact details). By providing third-party personal data, you confirm that: (a) you have informed those individuals that their data has been shared with us; (b) you have directed them to this Privacy Policy; and (c) you have a lawful basis to share their data with us for this purpose.

4. Lawful Basis for Processing (UK GDPR Article 6)

We process your personal data only where we have a lawful basis to do so under UK GDPR Article 6(1). The table below sets out each processing activity, its purpose, and the applicable lawful basis:

5. Data Sharing and Recipients

5.1 Categories of recipients

We may share your personal data with the following categories of recipients:

• Your designated contacts: Witnesses and executors you nominate will receive invitations and notifications containing limited information (your name, their designated role, and instructions for participation). This sharing is initiated by you and is necessary for the performance of the Service.
• Beneficiaries: Individuals you name as beneficiaries may receive notification of their inclusion, at your direction.
• Executors (post-death): After verified death, your nominated executors will receive access to your Will, vault contents, funeral preferences, and other end-of-life information you have stored through the Service, subject to our death verification process.

5.2 Data processors (UK GDPR Article 28)

We use the following third-party data processors to help deliver the Service. Each processor is bound by a Data Processing Agreement (DPA) that complies with UK GDPR Article 28 requirements:

The table above is our current list of processors, and it is the list we keep up to date. Each of them is engaged under a written contract meeting the requirements of UK GDPR Article 28, which binds them to process personal data only on our documented instructions, to keep it confidential, to apply appropriate security measures, and to delete or return it at the end of the engagement. We remain responsible to you for what they do with it.

We may add or change processors as the Service changes. Where a change would materially affect how your personal data is processed, we will update this page and give notice by email at least 30 days before the new processing begins, so that you have the opportunity to object or to delete your account before it takes effect.

5.3 Legal and regulatory disclosures

We may disclose your personal data where required by law, regulation, legal process, or enforceable governmental request, including: (a) to comply with a court order, subpoena, or warrant; (b) to respond to a lawful request from a law enforcement agency; (c) to comply with regulatory requirements; or (d) to protect the rights, property, or safety of Exit State Limited, our Users, or the public.

5.4 No sale of personal data

6. Sign in with Google, and Google User Data

Signing in with Google is optional. You can use the Service with an email sign-in link instead, and nothing in this section applies if you do.

6.1 What we receive from Google

If you choose to sign in with Google, Google tells us three things about the account you signed in with: the email address, the name on the account, and the profile picture URL if the account has one. We also receive a Google account identifier, which we use to recognise you as the same person the next time you sign in.

We request only the email, profile and openid scopes. These are the minimum scopes required to sign somebody in. We do not request, and therefore cannot access, any other part of your Google account: not Gmail, not Drive, not Calendar, not Contacts, not Photos, and not your Google search or location history.

6.2 How we use it

Google user data is used for one purpose only: creating and signing you into your Exit State account, and sending you service messages about your own will at that email address. Your name and profile picture are shown back to you in the app so you can see which account you are in. That is the whole of it.

• We do not use Google user data for advertising, ad personalisation, or ad targeting.
• We do not sell, rent or transfer Google user data to data brokers, information resellers, or any other party for those purposes.
• We do not use Google user data to train, retrain, fine-tune or otherwise develop artificial intelligence or machine learning models, whether ours or anybody else's.
• No human at Exit State reads your Google user data, except where you have specifically asked us to for support, where it is necessary for security purposes such as investigating abuse, or where the law requires it.

6.3 Google API Services User Data Policy

6.4 Storage, retention and removal

Google user data is stored alongside the rest of your account record, in the European Union region described in the transfers section below, and is kept for as long as your account exists. Deleting your account deletes it, on the timetable set out in the retention section.

You can disconnect Exit State from your Google account at any time at myaccount.google.com/connections. Doing so stops any future sign-in through Google; it does not by itself delete your Exit State account or the will you have written, which you can delete separately using the rights described below, or by writing to privacy@exitstate.xyz.

6.5 Other Google services we use

Two other Google services appear in the Service, and neither of them touches your Google account. The Places API receives the partial address text you type into an address field so it can suggest a full address; it is sent without your account identity attached. The Gemini API receives the will content you have written at the moment you ask for a document, so it can turn your answers into the wording of a will — this is described in the next section. Neither uses data from your Google account, and neither is affected by whether you signed in with Google.

7. Automated Processing and Artificial Intelligence

7.1 Where AI is used

When you ask the Service to produce your will document, the answers you have given are sent to Google's Gemini API, which returns the wording of the document. The same happens if you use the in-app assistant to ask a question. This is the only place artificial intelligence is used in the Service, and it only happens at the moment you ask for it.

7.2 What is sent, and what is not

What is sent is the will content itself: names, relationships, gifts, wishes, and the instructions you have written. What is not sent is your payment data, your account password, your uploaded documents, any film of your signing, or anything held in the encrypted vault, which we cannot read.

7.3 No automated decisions about you

We do not carry out automated decision-making producing legal effects concerning you, or similarly significantly affecting you, within the meaning of UK GDPR Article 22. The AI drafts wording; it does not decide anything about you, does not score, profile or rank you, and does not determine whether you may use the Service or what you are charged.

7.4 The output is a draft until you sign it

Wording produced this way is a draft for you to read, correct and approve. It becomes your will only when you have read it and signed it in the presence of two witnesses, as section 9 of the Wills Act 1837 requires. Nothing in the Service is legal advice, and the responsibility for checking that the document says what you meant is yours. This is set out more fully in our Terms of Service and Disclaimer.

8. International Data Transfers

8.1 Primary data storage

Your Will Data — everything you write into the will, the documents you upload, the signed copy and any film of the signing — is held in our database and file storage at Supabase, in their Ireland region (Amazon Web Services eu-west-1). That is where it rests, and it is the only place a complete copy of it exists.

8.2 Transfers outside the UK/EEA

Several of our processors are incorporated in the United States, and some of them process data there: Supabase, Inc.; Vercel, Inc.; Stripe Payments Europe, Ltd. and Stripe, Inc.; Resend (Plus Five Five, Inc.); Google LLC — Sign in with Google; Google LLC — Places API; Google LLC — Gemini API. Where personal data is transferred outside the UK or European Economic Area to a country that has not received an adequacy decision from the UK Secretary of State, we ensure that appropriate safeguards are in place, specifically:

• UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses (SCCs), as approved by the UK Information Commissioner's Office under section 119A of the Data Protection Act 2018.
• EU-US Data Privacy Framework certification held by our US-based processors (where applicable and valid).
• Supplementary measures including encryption of data in transit (TLS 1.3) and at rest (AES-256), access controls, and contractual obligations on sub-processors.

8.3 Transfer impact assessment

We have conducted a Transfer Impact Assessment (TIA) for each international transfer, evaluating the legal framework of the recipient country, the nature of the data transferred, and the effectiveness of the safeguards in place. Copies of our TIAs and applicable SCCs/IDTA are available upon request by contacting privacy@exitstate.xyz.

9. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law. The following retention periods apply:

Upon account deletion request, we will delete or anonymise all personal data that we are not legally required to retain within 30 days. Data subject to legal retention obligations will be securely archived with restricted access and deleted upon expiry of the applicable retention period.

10. Your Data Subject Rights (UK GDPR Articles 15-22)

Under UK GDPR, you have the following rights in relation to your personal data. We are committed to facilitating the exercise of these rights promptly and free of charge.

10.1 How to exercise your rights

To exercise any of the above rights, please contact us at:

10.2 Response timeline

We will acknowledge your request within 5 business days and provide a substantive response within one calendar month of receipt. If your request is complex or we receive a high volume of requests, we may extend this period by a further two months, in which case we will notify you of the extension and the reasons for it within the initial one-month period, as permitted by UK GDPR Article 12(3).

10.3 Identity verification

To protect your personal data, we may need to verify your identity before processing your request. We will ask you to confirm your identity through your registered email address or, where necessary, by providing additional identifying information. We will never ask for your payment card details as part of identity verification.

10.4 Fees

We will not charge a fee for exercising your data subject rights unless your request is manifestly unfounded or excessive (particularly if repetitive), in which case we may charge a reasonable fee based on administrative costs or refuse to act on the request, as permitted by UK GDPR Article 12(5).

11. Data Security

We implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, in accordance with UK GDPR Article 32. For detailed information about our security practices, please refer to our Safety Policy. Key measures include:

• Encryption at rest: AES-256 encryption for all stored data
• Encryption in transit: TLS 1.3 for all data transmission
• Password security: bcrypt hashing with appropriate work factor
• Vault encryption: RSA public-key cryptography for end-to-end encrypted vault
• Access controls: Role-based access controls, principle of least privilege
• Infrastructure: Supabase (SOC 2 Type II certified) for the database and file storage, and Vercel (SOC 2 Type II certified) for hosting and server functions
• Payment security: Stripe PCI DSS Level 1 compliance — no card data touches our servers

12. Data Breach Notification

12.1 Notification to the ICO

In the event of a personal data breach as defined by UK GDPR Article 4(12), we will notify the Information Commissioner's Office (ICO) without undue delay and, where feasible, within 72 hours of becoming aware of the breach, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons (Article 33). Our notification will include: the nature of the breach; categories and approximate number of data subjects affected; the likely consequences; and the measures taken or proposed to address the breach.

12.2 Notification to data subjects

Where a breach is likely to result in a high risk to your rights and freedoms, we will communicate the breach to you without undue delay (Article 34), describing in clear and plain language: the nature of the breach; the name and contact details of our data protection contact; the likely consequences; and the measures taken or proposed to address the breach and mitigate its effects. We will use direct communication (email to your registered address) unless this would involve disproportionate effort, in which case we will use public communication or a similar measure.

12.3 Breach response procedures

We maintain a documented data breach response plan that includes: immediate containment and assessment; risk evaluation; ICO notification where required; affected data subject notification where required; remediation; root cause analysis; and lessons learned. All breaches, including those not reportable to the ICO, are recorded in our internal breach register in accordance with Article 33(5).

13. Records of Processing Activities (UK GDPR Article 30)

We maintain records of processing activities as required by UK GDPR Article 30. These records include: the name and contact details of the controller; the purposes of processing; a description of the categories of data subjects and categories of personal data; the categories of recipients; details of transfers to third countries or international organisations and the safeguards in place; envisaged time limits for erasure; and a general description of technical and organisational security measures. These records are available to the ICO upon request.

14. Data Protection Impact Assessments

We conduct Data Protection Impact Assessments (DPIAs) in accordance with UK GDPR Article 35 before undertaking any processing that is likely to result in a high risk to the rights and freedoms of individuals. Given the sensitive nature of Will Data and end-of-life information, we have conducted DPIAs for: (a) the core Will creation and storage service; (b) the secure vault feature; (c) the death verification and post-death access process; and (d) international data transfers to US-based processors. Summaries of our DPIAs are available upon request.

15. Cookies and Tracking Technologies

15.1 Essential cookies

We use only strictly necessary cookies that are essential for the Service to function. These include:

• Authentication cookies: To maintain your logged-in session (set by Supabase Auth).
• Session cookies: To remember your session state across page loads.
• Security cookies: To prevent cross-site request forgery (CSRF) and other security threats.

15.2 What we do not use

We do not use: advertising cookies; third-party tracking cookies; analytics cookies that identify individual users; social media tracking pixels; or fingerprinting technologies. We do not participate in advertising networks or real-time bidding systems.

We do measure traffic, using Vercel Web Analytics. It sets no cookies and builds no profile: it records the page visited, the referring site, and coarse device and country information, and it derives a visitor count from a hash that is discarded daily and cannot be traced back to a person or reconciled with your account. This is why the Service has no cookie banner — there is nothing to ask you to consent to.

15.3 Lawful basis for cookies

Strictly necessary cookies are exempt from the consent requirement under Regulation 6(4) of the Privacy and Electronic Communications Regulations 2003 (PECR). As we do not use any non-essential cookies, no cookie consent banner is required.

16. Children's Privacy

The Service is not intended for, and we do not knowingly collect personal data from, anyone under the age of 18. You must be at least 18 years old to create a valid Will under English law. If we become aware that we have collected personal data from a child under 18, we will take steps to delete that data as soon as reasonably practicable. If you believe that a child has provided us with personal data, please contact us immediately at privacy@exitstate.xyz.

17. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will: (a) update the "Last updated" date at the top of this page; (b) notify you by email to the address associated with your account at least 30 days before the changes take effect; and (c) where required by law, seek your consent to any material changes in how we process your personal data. We encourage you to review this Privacy Policy periodically. Your continued use of the Service after the effective date of any changes constitutes your acknowledgement of the updated policy.

18. Complaints and Supervisory Authority

18.1 Complaints to us

If you have any concerns about how we handle your personal data, we encourage you to contact us first at privacy@exitstate.xyz. We take all complaints seriously and will investigate and respond within 30 days. Our internal complaints procedure includes acknowledgement, investigation, resolution, and follow-up stages.

18.2 Right to complain to the ICO

If you are not satisfied with our response, or if you believe we are processing your personal data unlawfully, you have the right to lodge a complaint with the UK's supervisory authority:

We would appreciate the opportunity to address your concern before you contact the ICO, but you are entitled to lodge a complaint with the ICO at any time without first contacting us.

This Privacy Policy was last updated on 13 March 2026 and is effective as of that date. It was prepared in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and guidance published by the Information Commissioner's Office.