Privacy Policy

We collect and process the following categories of personal data:

• Account Data: Name, email address, and password when you register.
• Legal Document Data: When creating LPAs or Wills, we collect names, addresses, dates of birth, phone numbers, and details of attorneys, executors, beneficiaries, and other parties as required by the document.
• Payment Data: Payment is processed securely by Stripe. We do not store your card details; Stripe handles this directly.
• Contact Data: Name, email, and message content when you use our contact form.
• Usage & Analytics Data: IP address, browser type, pages visited, and session data collected via Google Analytics and Vercel Analytics.
• Marketing Data: Page views and interaction data collected via Facebook Pixel (Meta), only when you have given cookie consent.
• Login History: Timestamps and IP addresses of account logins for security purposes.

Under UK GDPR Article 6, we process your data on the following lawful bases:

• Contractual necessity (Article 6(1)(b)): To create your account, generate your legal documents, process your payment, and deliver the service you have purchased.
• Consent (Article 6(1)(a)): For analytics cookies (Google Analytics), marketing cookies (Facebook Pixel), and any marketing communications. You can withdraw consent at any time.
• Legitimate interest (Article 6(1)(f)): For website security, fraud prevention, login monitoring, and improving our services. We have assessed that these interests do not override your rights.
• Legal obligation (Article 6(1)(c)): To retain financial records as required by UK tax and accounting law.

We share your personal data only when necessary to provide our services. Our third-party processors include:

• Stripe (USA) — Payment processing. Stripe processes your card details directly. Stripe Privacy Policy.
• Supabase (EU) — Our primary database for storing account and document data. Supabase Privacy Policy.
• Render (USA) — Hosts our backend server that processes your requests. Render Privacy Policy.
• Vercel (USA) — Hosts our website and collects basic analytics. Vercel Privacy Policy.
• Google Analytics (USA) — Website analytics (consent-gated). We use IP anonymisation and have disabled advertising features. Google Privacy Policy.
• Facebook Pixel / Meta (USA) — Marketing analytics (consent-gated). Only active if you accept cookies. Meta Privacy Policy.
• Klaviyo (USA) — Email marketing. Holds your name, email address and whether you have opted in to marketing email, so that turning marketing off in your account stops it being sent. Also records which pages you visit, if you accept cookies. Klaviyo Privacy Notice.
• Contentful (EU) — Delivers our blog content. Does not process your personal data.

We may also share data with legal authorities if required by law or to protect our legal rights.

Some of our third-party processors are based in the United States (Stripe, Render, Vercel, Google, Meta, Klaviyo). Where personal data is transferred outside the UK, we ensure appropriate safeguards are in place, including:

• Standard Contractual Clauses (SCCs) approved by the UK Government.
• The processor's participation in recognised data protection frameworks.
• UK adequacy regulations where applicable.

You can request details of the specific safeguards in place by contacting us.

We retain your personal data for the following periods:

• Account data: Retained while your account is active. Deleted within 30 days of account deletion request.
• Legal document data (LPAs, Wills): Retained while your account is active so you can re-download documents.
• Documents you have deleted: If you delete a document you have not paid for, it is removed straight away. If you delete a document you have paid for, it stops appearing in your account immediately, but we keep our copy for 6 years alongside the payment record. This is so we can help if the Office of the Public Guardian rejects your LPA, if you delete something by mistake and want it back, or if there is ever a question about what you paid for and received. You can ask us to erase it sooner and we will unless we are required to keep it (see Your rights below).
• Payment records: Retained for 6 years as required by UK tax and accounting law (HMRC).
• Contact form submissions: Retained for 12 months, then deleted.
• Login history: Retained for 12 months for security purposes.
• Analytics data: Google Analytics data is retained for 14 months. Facebook Pixel data is managed by Meta per their retention policy.
• Cookie consent preference: Stored for 150 days in your browser.

Under UK GDPR, you have the following rights:

• Right of access (Article 15): Request a copy of the personal data we hold about you.
• Right to rectification (Article 16): Ask us to correct inaccurate personal data.
• Right to erasure (Article 17): Ask us to delete your personal data. This right is not absolute: Article 17(3) allows us to keep information where we need it to comply with a legal obligation, or to establish, exercise or defend legal claims. In practice that means we keep payment records for 6 years as HMRC requires, and we keep our copy of a document you paid for over the same period, even after you delete it from your account. Everything else we will erase on request.
• Right to restrict processing (Article 18): Ask us to limit how we use your data.
• Right to data portability (Article 20): Receive your personal data in a portable, machine-readable format.
• Right to object (Article 21): Object to processing based on legitimate interest.
• Right to withdraw consent: Where processing is based on consent, you can withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, email us at info@simplelpa.co.uk. We will respond within 30 days.

Our website uses cookies for essential functionality, analytics, and marketing. Analytics and marketing cookies are only activated with your consent. For full details, see our Cookie Policy.

If you are unhappy with how we have handled your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

• Website: ico.org.uk/make-a-complaint
• Phone: 0303 123 1113

We would appreciate the chance to address your concerns first. Please contact us at info@simplelpa.co.uk before escalating to the ICO.