Privacy Policy

1. Information We Collect

Account and contact information

When you create an account or purchase a plan, we collect your name, email address, billing address, and state of residence.

Estate planning facts

To prepare your documents, we collect the information you provide during the intake interview: family composition, asset descriptions, beneficiary designations, fiduciary appointments, and healthcare wishes. Where you voluntarily provide a Social Security Number, that field is encrypted using AES-256-GCM field-level encryption before storage.

Uploaded documents (Vault)

Files you upload to your document vault are stored encrypted in our database and used solely to provide the vault feature.

Payment information

Payment card details are collected and processed directly by Stripe, Inc. We receive only a tokenized reference and the last four digits of your card. We never store full card numbers.

Automatically collected information

We collect standard server logs (IP address, browser type, pages visited, timestamps) for security monitoring. We also use the Meta (Facebook) advertising pixel and Google Analytics to measure how our marketing performs and how the site is used (e.g. page views and completed purchases). These tools never receive the contents of your estate-planning documents or your intake answers, and we do not sell your personal information.

2. How We Use Your Information

• Prepare, draft, validate, and deliver your estate planning documents;
• Process payments and manage your subscription or annual update membership;
• Send transactional emails (account confirmation, document delivery, payment receipts);
• Respond to support requests and communicate about your account;
• Maintain security, detect fraud, and debug technical issues;
• Comply with legal obligations and enforce our Terms of Service.

We do not use your personal information for targeted advertising or sell it to data brokers.

3. Intelligent Technology Disclosure

Estateur uses Claude, an intelligent language model by Anthropic, PBC, to conduct the intake interview, draft your documents, and power the in-app education assistant. The facts you provide during intake are transmitted to the Anthropic API over an encrypted connection so that Claude can draft your documents.

We send only the facts necessary to draft your specific documents. Per Anthropic's enterprise terms, your data is not used to train future intelligent models. Intelligently drafted documents are subject to automated deterministic validation before delivery.

4. How We Share Your Information

We do not sell, rent, or trade your personal information. We share data only with the following service providers, and only as necessary:

5. Cookies and Tracking

We use a single first-party session cookie named est_session to keep you logged in. It is HttpOnly (not accessible to JavaScript), Secure (HTTPS only), and expires after 7 days. We also use the Meta (Facebook) pixel and Google Analytics for advertising, analytics, and conversion measurement, which may set third-party cookies; you can opt out through your browser settings, Meta's ad preferences, or Google's analytics opt-out.

6. Data Retention

We retain your account and estate planning data while your account is active and for a reasonable period afterward. If you request account deletion, we delete your personal information within 30 days, except for records we are legally required to retain (such as transaction records, kept up to 7 years). Server logs are retained for 90 days.

7. Security

• AES-256-GCM field-level encryption for sensitive identifiers (SSNs);
• Encryption of uploaded documents at rest in MongoDB Atlas;
• TLS 1.2+ for all data in transit;
• HttpOnly, Secure session cookies to mitigate session-hijacking;
• Access controls limiting employee access to personal data on a need-to-know basis.

If you suspect your account has been compromised, contact us immediately at contact@estateur.com.

8. Your Rights and Choices

You may:

• Access and correct your data: log in to review and update your information;
• Request a data export: email us for a machine-readable copy of your account data;
• Request account deletion: email us; we will complete deletion within 30 days.

9. Children's Privacy

The Service is intended for adults 18 and older. We do not knowingly collect personal information from anyone under 18.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated by email at least 30 days before taking effect. Continued use constitutes acceptance.

11. Contact Us