Privacy Policy

Who we are

FindMyLegacy is a web application that allows members of the public to search the UK Government's Bona Vacantia list of unclaimed estates. We are based in the United Kingdom.

What data we collect

We collect the following personal data:

• Email address and full name — collected when you register, used to log you in, address correspondence, and send estate alerts.
• Watchlist surnames — the surnames and relationship labels you choose to monitor, stored against your account.
• Case file data — if you use case management, we store the notes, status updates, document checklist entries, relationship information, and solicitor details you record against each estate. This data is private to your account.
• Uploaded documents — if you attach files (such as birth, marriage, or death certificates) to a case document entry, those files are stored securely and are accessible only to you. Uploaded documents may contain personal data about third parties (for example, named individuals on a certificate).
• Family tree data (GEDCOM) — if you upload a GEDCOM file, we extract and store the names, relationships, and approximate birth and death years of the ancestors it contains. This data is used solely to match against the Bona Vacantia list on your behalf. Family tree records may include data about deceased individuals who have not themselves consented to this processing. We rely on legitimate interests as our lawful basis for this processing: helping you identify whether a deceased relative may have left an unclaimed estate is a proportionate use of genealogical records. You can delete your family tree data at any time from the Family Tree page.
• Payment information — if you subscribe to Premium, your payment is processed by Stripe. We do not store your card details; we store only a Stripe customer identifier and your subscription status.
• AI assistant conversations— if you use the AI assistant, the text of your messages is sent to Anthropic's API to generate a response. Conversations are not stored by FindMyLegacy beyond your current session.

How we use your data

• To provide and maintain your account
• To send you email alerts when new matching estates are found
• To remember your watchlist surnames between sessions
• To store and display the research notes, status, and document checklists you create in your case files
• To match your uploaded family tree against the Bona Vacantia list and notify you of potential matches
• To process subscription payments and manage your access to premium features
• To send transactional emails relating to your account (trial status, payment notifications)

We do not sell your data, share it with third parties for marketing purposes, or use it for any purpose other than operating the service.

Cookies

We use cookies solely for session management — to keep you logged in between visits. We do not use any advertising, tracking, or analytics cookies.

Data retention

We retain your data for as long as your account is active. If you delete your account, all associated data — including your email address, full name, watchlist surnames, case file contents, uploaded documents, and family tree records — will be permanently removed.

You can delete your family tree independently (without deleting your account) from the Family Tree page. Uploaded case documents can be removed individually from within each case.

Your rights

Under UK GDPR you have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data
• Object to processing based on legitimate interests
• Withdraw consent at any time

You can delete your account and all associated data at any time from your account settings page. To exercise any other right, contact us at privacy@findmylegacy.co.uk.

Third-party services

We use the following third-party services to operate FindMyLegacy. Each acts as a data processor under our instruction.

• Supabase — database and authentication. Your account data, watchlist, cases, and family tree records are stored on Supabase infrastructure (EU region).
• Vercel — hosting and serverless functions.
• Resend — transactional email delivery (alerts, account notifications).
• Stripe— payment processing for Premium subscriptions. Stripe's privacy policy governs how card data is handled. We receive only a customer ID and subscription status.
• Anthropic— AI assistant. Text you send to the assistant is processed by Anthropic's Claude API to generate a response. Please do not include sensitive personal information in assistant messages. Anthropic's usage policy applies to this processing.

Contact

If you have any questions about this privacy policy or how we handle your data, please contact us at privacy@findmylegacy.co.uk