Privacy policy

1. Who we are

TidyEstate is a trading name of Ark Innovations and Technology Ltd (“we”, “us”, “our”), registered in England and Wales (company no. 10152621). Registered office: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ.

We operate the TidyEstate website and application at tidyestate.co.uk and are the data controller for personal data processed through this service.

Contact: [email protected]

2. What data we collect

We collect personal data that you provide directly to us, and data we generate as you use the service.

Account data

• Email address (required to create an account)
• Full name and phone number (optional profile fields)
• Marketing consent preference

Case data

This is highly sensitive data about a deceased person and their estate:

• Deceased person’s name, date of birth, date of death, address
• Asset details: property addresses, bank and investment account details, estimated values
• Liability details: lenders, outstanding amounts
• Beneficiary details: names, addresses, relationships, estimated inheritance amounts
• Uploaded documents: death certificate, will, grant of probate, correspondence
• Generated documents: completed probate forms, IHT400, institution letters

Technical data

• Log data: timestamps, event types, and record IDs (no PII in logs)
• Session data: authentication tokens stored in cookies

Payment data

Payment card details are processed directly by Stripe and never touch our servers. We store only the Stripe PaymentIntent reference and payment status.

3. How we use your data

• To provide the service — processing estate data, generating documents, tracking tasks and deadlines
• To send transactional emails — welcome emails, deadline reminders, document ready notifications, co-executor invites
• To process payments — via Stripe, for case unlocks and will writing purchases
• To contact a solicitor on your behalf — only with your explicit consent, when you request a solicitor referral
• To comply with legal obligations — UK GDPR, financial record-keeping requirements

We do not use your data for advertising. We do not sell your data to third parties. We do not use advertising pixels or third-party analytics that capture personal data.

4. Legal basis for processing

• Contract — processing necessary to provide the service you’ve signed up for
• Legitimate interests — security monitoring, fraud prevention, service improvement
• Consent — marketing emails (where you’ve opted in), solicitor referrals
• Legal obligation — compliance with UK law

5. Where your data is stored and processed

Your data is stored in the United Kingdom: our database, sign-in service and document storage run on Supabase in AWS’s London region (eu-west-2). Backups stay in the same region.

Your data is processed by our application servers in a United Kingdom data centre. A small number of processors below operate in the EEA or the United States; EEA transfers are covered by the UK’s adequacy regulations and US transfers rely on the UK Extension to the EU–US Data Privacy Framework or the International Data Transfer Agreement, as noted.

6. Third-party processors

• Supabase — database, authentication and file storage. AWS London (eu-west-2), United Kingdom.
• Our hosting provider — application and document-generation servers in a United Kingdom data centre (provider named here before launch).
• Stripe — payment processing (card details never reach us). EEA and United States under Stripe’s data processing agreement and the UK addendum.
• Resend — transactional email (confirmations, reminders). United States — UK Extension to the Data Privacy Framework / IDTA.
• Sentry — error monitoring. Personal data is removed from error reports before they leave our servers; the service is configured in Sentry’s EU region.
• Plausible — cookieless, aggregated website analytics. EEA.

We keep a record of processing activities and will provide the current list of processors and their locations on request.

7. How long we keep your data

• Active cases — retained while your account is active
• Completed cases — retained for 7 years after completion, matching HMRC record-keeping requirements for estate administration
• Deleted accounts — all personal data deleted within 30 days, except where retention is required by law

8. Your rights under UK GDPR

You have the right to:

• Access — request a copy of all personal data we hold about you (available via account settings > Data export)
• Rectification — correct inaccurate data (via account settings or by contacting us)
• Erasure — request deletion of your account and personal data (account settings > Delete account; data deleted within 30 days)
• Data portability — receive your case data in a structured, machine-readable format (JSON export via account settings)
• Restrict processing — in certain circumstances, request that we stop processing your data
• Object — to processing based on legitimate interests
• Withdraw consent — for any processing based on consent (e.g. marketing emails) at any time

To exercise any right, contact [email protected]. We will respond within one calendar month.

If you are unhappy with how we handle your data, you can complain to the Information Commissioner’s Office (ICO) at ico.org.uk.

9. Cookies

We use session cookies only — to keep you logged in between page loads. We do not use advertising, tracking, or analytics cookies. See our Cookie policy for details.

10. Data about the deceased person

As part of providing the service, we process personal data about the deceased person — including their name, date of birth, date of death, address, and financial details. This data is entered by you as executor and is used solely for the purpose of administering the estate.

UK GDPR does not apply to deceased individuals (it only covers living persons). However, we treat data about the deceased with the same care as any other sensitive information:

• It is shared only with co-executors you invite, and (with your explicit consent) with matched solicitor firms via our referral service
• It is not used for any purpose other than estate administration
• It is retained for 7 years after the case is completed (matching HMRC record-keeping obligations for estate administration), then deleted

If a family member has concerns about how data about a deceased person is being processed, please contact us at [email protected].

11. Changes to this policy

We will update this policy if our data practices change. Where changes are significant, we will notify you by email. The “last updated” date at the top of this page shows when the policy was last revised.