Privacy notice

This page describes what data Glenvault collects, how we protect it, and what control you have over it. For any questions, write to info@glenvault.com.

Data we collect

• Your email address and a password verifier (Argon2id hash, not the password itself).
• Documents you upload (encrypted at rest before they leave the server).
• Account-related metadata (titles, types, expiry dates, family-member names you add).
• An append-only audit log of sensitive actions (document views, succession protocol triggers, billing events).
• Email and IP for the device that signed up, used purely for security signals.

Where it lives

Primary data is stored in the United Kingdom. Document ciphertext sits in object storage; metadata sits in a database in the same region. Backups are encrypted with a separate key before they leave the server.

How it's protected

• Each document is encrypted with its own key using libsodium's secretbox (XSalsa20-Poly1305 authenticated encryption) before it is written to storage.
• Those per-document keys are wrapped by a household master key, which in turn is wrapped by a key derived from your password using Argon2id. The master key is held in server memory only for the duration of your session and is not written to disk in plaintext.
• Traffic between you and Glenvault is protected with TLS.

AI tagging

If AI tagging is enabled, a document is sent once to a third-party large-language-model provider over TLS so we can extract the type, expiry date and helpful tags. Under that provider's API terms, inputs sent to their API are not used to train their models and are retained only briefly for operational purposes; we do not send your documents to the provider for any other purpose. We rely on the provider's contractual terms here rather than being able to inspect their systems directly. You can disable AI tagging in Settings, and it is off unless enabled.

Third parties

• Cloudflare (UK): DDoS protection and edge TLS termination.
• Stripe (UK/IE): billing, payment processing, tax calculation.
• An email delivery provider: transactional email (verifications, password resets, invites).
• A large-language-model provider: AI document tagging (optional, paid plans).

Data about other people

Glenvault is built to record a family's affairs, so you can add information about people other than yourself: a spouse or partner, children, beneficiaries, executors, and advisors. This can include their names, dates of birth, contact details, relationship to you, documents that concern them (such as passports or certificates), and free-text notes. Some of this may be sensitive, including information about children or, where you choose to store it, health-related documents such as medical directives.

When you add information about another person, you are responsible for having a lawful basis to do so, and for telling them about it where that is appropriate. We process this information on your instruction so that you can organise your affairs and, where you have set it up, pass it to the people you choose. People whose data you have stored can contact us at info@glenvault.com; where we are able to, we will help them understand what is held and, with the account holder, address requests to access, correct, or delete it. People you add as records (rather than as account members) cannot sign in and cannot see your vault unless and until you grant them access.

Succession and release of access

You can set up rules that release some or all of your vault to people you name, for example a shared-access arrangement, a request-and-wait window, or a periodic check-in (sometimes called a “dead man's switch”) that opens access if you stop responding. To operate these we process the contact details of the people you designate, a record of check-ins and reminders, and an audit trail of any release.

When a rule triggers and any waiting period passes, the people you named are notified and given access to the data you chose to share with them; at that point they may be able to read documents and details you stored. You can change or cancel a rule while it is active, but a release that has completed cannot be undone. We act on the instructions you configure; we do not independently verify deaths or medical events beyond the checks described in the product, and we are not a substitute for a will or professional estate advice.

Your rights (GDPR / UK GDPR)

• Export everything you've uploaded as a standard .zip, any time.
• Delete your account and all encrypted blobs; the audit log is retained per legal requirement, pseudonymised after deletion.
• Request a copy of the data we hold about you by emailing the address above.
• Object to or restrict processing, and complain to the ICO (ico.org.uk) if you are unhappy with how we handle your data.

Who we are

Glenvault is a trading name of Malden Ltd, registered in England and Wales under company number 11672272, with its registered office at 20–22 Wenlock Road, London, England, N1 7GU, United Kingdom. Malden Ltd is the data controller for the personal data you provide.

Malden Ltd is registered with the Information Commissioner's Office (ICO) under registration reference ZC165459.

Contact

Privacy questions go to info@glenvault.com. For everything else, contact.