Legacy Toolkit Privacy Policy

Who we are and how to contact us

Legacy Toolkit is the New Zealand-based operator of the Legacy Toolkit website, account service, desktop app, encrypted sync, trusted sharing, Legacy Access, subscription, download, and update services. Legacy Toolkit is the agency collecting and holding personal information for the purposes described in this policy.

Our Privacy Officer can be contacted at privacy@legacytk.com or through https://legacytk.com/contact/. That is also our service address for privacy requests. Do not send passwords, recovery codes, vault plaintext, identity documents, or other unnecessary sensitive information by ordinary email.

Scope and New Zealand law

This policy applies to Legacy Toolkit websites and account pages, subscription checkout, support communications, downloads and updates, the desktop app, encrypted cloud sync, sharing, trusted-contact invitations, Legacy Access claims, and release administration.

We handle personal information under the New Zealand Privacy Act 2020 and its Information Privacy Principles. If a more specific New Zealand privacy code applies to a particular activity or information, we will apply that code. Third-party services also publish their own policies for activities they control.

Information we collect directly

• Account and identity information, including username, email address, authentication identifiers, verification state, sign-in events, public encryption keys, and account status.
• Subscription and billing records, including selected plan, billing interval, price and product identifiers, payment and renewal status, Stripe customer or subscription identifiers, invoices, and checkout results. Stripe collects payment-card details; Legacy Toolkit does not intend to receive or store full card numbers.
• Support and security communications, including the information you choose to provide, relevant account or app details, correspondence, and attachments.
• Legacy Access claim information, including claimant identity, statements, evidence type, document references, notes, review decisions, challenge and delivery events, and audit history.
• Technical and security information, including IP address, approximate country, browser or device type, operating system, app version, installer channel, requested URL, timestamps, update checks, session and security events, and diagnostics.
• Bounded first-party web reliability signals, including the website surface, a route template without query strings, a release identifier, approved error or journey classification, timing bucket, random per-journey correlation identifier, status class, and Core Web Vital. This telemetry schema has no field for an account, email, organization, cookie, credential, request body, full URL, raw exception message, or stack trace.
• Cookie and preference choices, including analytics consent and market-notice preferences stored in your browser.

Information about other people and IPP3A

Legacy Toolkit lets an account holder record information about other people, such as family members, whānau, executors, attorneys, beneficiaries, advisers, emergency contacts, healthcare contacts, trusted contacts, and people mentioned in documents. This can be personal information collected from someone other than the person concerned.

Before entering another person's information, account holders must have a proper purpose and should provide only what is reasonably necessary. They must not use Legacy Toolkit to collect information unlawfully, unfairly, or in a way that intrudes unreasonably on another person's affairs.

Where Legacy Toolkit collects a trusted contact's name, email address, relationship, or similar information indirectly, we take reasonable steps to notify that person through the invitation or other appropriate notice unless an exception in the Privacy Act applies. The notice explains that we collected the information, why, the intended recipients, who holds it, and the person's access and correction rights.

A person who believes Legacy Toolkit holds information about them can contact privacy@legacytk.com. We may ask for information needed to locate the record and verify identity or authority before providing access or making a correction.

Local vault, sync, and sharing data

The primary vault is designed to be encrypted and stored locally on the user's device. Device security, the operating-system account, authentication methods, backups, recovery material, and people with device access remain part of the security boundary.

If cloud sync, sharing, or Legacy Access is enabled, the desktop app may send encrypted vault payloads together with operational metadata such as account and object identifiers, versions, timestamps, recipient records, public keys, encrypted key envelopes, status, and audit events. Metadata needed to operate the service is not necessarily hidden by vault encryption.

Encryption reduces what service operators can read, but it does not remove all privacy risk. Recipients can read information that is intentionally released to them, and information shown on an unlocked device or exported by a user is outside the encrypted cloud boundary.

Why we use personal information

• To create and secure accounts, verify identity, authenticate sessions, and connect the website, backend, and desktop app.
• To provide local-vault, encrypted sync, sharing, trusted-contact, Legacy Access, document, subscription, download, update, support, and recovery functions requested by users.
• To process payments, renewals, invoices, cancellations, refunds, taxes, entitlements, and billing support.
• To verify Legacy Access claims, prevent fraudulent or mistaken release, notify affected people, apply challenge periods, support human review, deliver approved encrypted releases, and preserve accountability records.
• To maintain reliability and security, investigate misuse, enforce our Terms, detect incidents, protect users and other people, and meet legal obligations.
• To detect broken authentication journeys, browser failures, host-policy violations, Partner API failures, and performance regressions using first-party operational telemetry that is separate from optional marketing analytics.
• To measure and improve the public website when a visitor has chosen optional analytics.

When we disclose information

We disclose personal information only for a connected purpose, with authorisation, as necessary to provide a requested feature, or where another legal basis permits or requires disclosure. Sharing within the product occurs when a user selects a recipient or when an authorised Legacy Access release is approved.

Service providers may process information on our behalf for authentication, hosting, backend and storage infrastructure, checkout, email delivery, analytics, security, downloads, or updates. Current website paths include Clerk for authentication, Stripe for payments and subscription management, Vercel for website hosting and request handling, and Google Analytics only after optional analytics consent.

We may disclose information when required or authorised by New Zealand law, to respond to lawful process, to investigate or prevent serious security or fraud risks, to protect a person from serious harm, or as part of a genuine business reorganisation subject to appropriate confidentiality and privacy safeguards.

We do not sell private vault contents, use them for targeted advertising, or use them to train public artificial-intelligence models.

Overseas processing

Some providers may process or store information outside New Zealand. Where an overseas provider acts only as our agent, we remain responsible for ensuring it handles the information consistently with the Privacy Act. Where a transfer is a disclosure under Information Privacy Principle 12, we require a permitted basis and comparable safeguards, such as applicable law or contractual protections, unless the person has given properly informed authorisation.

Provider locations and subprocessors can change. Contact privacy@legacytk.com for current information relevant to a privacy request or proposed enterprise deployment.

Cookies, local storage, and analytics

Essential cookies and browser storage support authentication, account security, checkout handoff, fraud prevention, session continuity, and saved preferences. Blocking essential storage may prevent parts of the service from working.

Authentication pages may use tab-scoped session storage for a random journey correlation identifier and start time so an operational success, failure, timeout, or required verification step can be measured without linking the event to an account. The value is not derived from a user or organization identifier and is removed when the journey reaches a terminal outcome.

Google Analytics is optional on the public website. It is not loaded until a visitor chooses to allow analytics. Advertising storage and ad personalisation remain disabled. A visitor can reject analytics or reopen Cookie settings to change the saved choice; rejecting analytics removes the analytics cookies the site can remove from its own domain.

Clerk, Stripe, and other services may set essential cookies when their authentication or payment pages are used. Their handling of information is also governed by their own privacy notices.

Retention and deletion

We keep personal information only for as long as it is reasonably required for the purpose for which it was collected, an active service or account, security and fraud prevention, billing and tax records, dispute resolution, backup integrity, or another lawful requirement. Different records have different retention needs, and we periodically review whether continued retention is necessary.

Local-only vault information remains under the user's device and backup controls. Closing an online account does not delete copies stored locally, exported by a user, already received by an authorised recipient, or retained independently by a payment or authentication provider.

Deletion from active systems may not immediately remove securely isolated backup copies. Backup copies are protected from ordinary use and are removed or overwritten through the applicable backup lifecycle unless retention is required for security, legal, or dispute purposes.

Detailed first-party web telemetry is configured for no more than 30 days. Aggregate alert-delivery evidence may be retained for up to 400 days so reliability and incident-response controls can be reviewed over an assurance period.

Access, correction, deletion, and complaints

You may ask whether we hold personal information about you and request access to it or correction of it under the Privacy Act. You may also ask us to close your account, delete information that is no longer required, explain a decision, or provide available export options. Some information may need to be retained or withheld where the law permits.

Send a request to privacy@legacytk.com. Describe the account, trusted-contact relationship, or record involved without emailing sensitive vault contents. We may verify identity, authority, and the safety of disclosure before acting. We will respond as required by New Zealand law.

If you are not satisfied with our response, you can complain to the Office of the Privacy Commissioner at privacy.org.nz. You can also contact our Privacy Officer first so we have an opportunity to investigate and put matters right.

Security and privacy breaches

We use safeguards intended to protect information, including encryption design, authenticated sessions, access controls, transport security, release controls, monitoring, restricted administrative access, and review procedures. No system can guarantee absolute security.

If a privacy breach has caused or is likely to cause serious harm, we will notify the Office of the Privacy Commissioner and affected people as soon as practicable unless an exception applies. Security concerns should be sent to security@legacytk.com without including unnecessary sensitive data.

Children and representatives

Legacy Toolkit accounts and subscriptions are intended for adults. Do not create an account if you are under 18. Adults entering information about a child or a person who cannot act for themselves must have an appropriate purpose and authority and must consider that person's privacy interests.

We may require evidence of authority before dealing with a parent, guardian, attorney, welfare guardian, property manager, executor, administrator, or other representative. A role recorded inside Legacy Toolkit does not itself prove legal authority.

Changes to this policy

We may update this policy when the product, providers, law, or our practices change. We will update the date above and provide proportionate notice of material changes. If a new purpose is not directly related to the original purpose, we will obtain any authorisation or provide any notice required before using the information for that new purpose.

Questions and requests should be sent to the Privacy Officer at privacy@legacytk.com.

Related

• Security model
• Terms of Service
• Contact support