Last updated · June 2026
This page describes what data Glenvault collects, how we protect it, and what control you have over it. For any questions, write to info@glenvault.com.
Primary data is stored in the United Kingdom. Document ciphertext sits in object storage; metadata sits in a managed PostgreSQL cluster in the same region. Backups are encrypted with a separate key before they leave the server.
If AI tagging is enabled, a document is sent once to a third-party large-language-model provider over TLS so we can extract the type, expiry date and helpful tags. Under that provider's API terms, inputs sent to their API are not used to train their models and are retained only briefly for operational purposes; we do not send your documents to the provider for any other purpose. We rely on the provider's contractual terms here rather than being able to inspect their systems directly. You can disable AI tagging in Settings, and it is off unless enabled.
Glenvault is built to record a family's affairs, so you can add information about people other than yourself — a spouse or partner, children, beneficiaries, executors, and advisors. This can include their names, dates of birth, contact details, relationship to you, documents that concern them (such as passports or certificates), and free-text notes. Some of this may be sensitive, including information about children or, where you choose to store it, health-related documents such as medical directives.
When you add information about another person, you are responsible for having a lawful basis to do so, and for telling them about it where that is appropriate. We process this information on your instruction so that you can organise your affairs and, where you have set it up, pass it to the people you choose. People whose data you have stored can contact us at info@glenvault.com; where we are able to, we will help them understand what is held and, with the account holder, address requests to access, correct, or delete it. People you add as records (rather than as account members) cannot sign in and cannot see your vault unless and until you grant them access.
You can set up rules that release some or all of your vault to people you name — for example a shared-access arrangement, a request-and-wait window, or a periodic check-in (sometimes called a “dead man's switch”) that opens access if you stop responding. To operate these we process the contact details of the people you designate, a record of check-ins and reminders, and an audit trail of any release.
When a rule triggers and any waiting period passes, the people you named are notified and given access to the data you chose to share with them; at that point they may be able to read documents and details you stored. You can change or cancel a rule while it is active, but a release that has completed cannot be undone. We act on the instructions you configure; we do not independently verify deaths or medical events beyond the checks described in the product, and we are not a substitute for a will or professional estate advice.
Glenvault is a trading name of Malden Ltd, registered in England and Wales under company number 11672272, with its registered office at 20–22 Wenlock Road, London, England, N1 7GU, United Kingdom. Malden Ltd is the data controller for the personal data you provide.
Malden Ltd is registered with the Information Commissioner's Office (ICO) under registration reference ZC165459.
Privacy questions go to info@glenvault.com. For everything else, contact.