1. Who we are
The P80 Project Limited is a company registered in New Zealand, trading as Heirly. We operate the website at heirly.app and the application at app.heirly.app.
For the purposes of UK GDPR and the UK Data Protection Act 2018, Heirly is the data controller in respect of personal data collected through our platform. For Australian and New Zealand users, Heirly is the agency/organisation responsible for the personal information described in this policy.
You can contact us at any time at [email protected].
2. What data we collect
We collect the following categories of personal information:
Account information
- Name and email address (collected when you register or are invited to an estate)
Estate and item data
- The name of the deceased person associated with the estate
- Descriptions, photographs, and estimated or confirmed values of estate items
- Financial share entitlements and allocation decisions recorded during the estate process
- Photos uploaded by executors for item cataloguing purposes
- AI-generated valuation suggestions derived from those photos and descriptions
Beneficiary information
- Names and email addresses of beneficiaries entered by the executor before those individuals have themselves logged in or provided consent directly to Heirly
Payment information
- Payment transactions are handled by Stripe. Card numbers and payment credentials never pass through or are stored on Heirly's servers. We retain transaction references and subscription status only.
Usage and consent data
- Cookie consent records, including which categories of cookies you have accepted or declined
- Where you have consented, analytics data collected via Google Analytics 4
- Where you have consented, advertising interaction data collected via the Meta Pixel
Technical data
- IP address (used for security and fraud prevention, retained for a limited period)
- Browser type and approximate geographic location derived from IP (where analytics consent is given)
3. Lawful basis for processing
We process your personal data under the following lawful bases:
Contract performance: When you create or participate in an estate as an executor, processing your name, email, and estate data is necessary to provide the Heirly service you have requested.
Legitimate interests: We process certain technical data for platform security, fraud prevention, abuse detection, and service improvement. Our legitimate interests do not override your fundamental rights and freedoms.
Consent: We process data for marketing communications (email), analytics cookies, and advertising cookies only where you have given clear, specific consent. You may withdraw consent at any time without affecting the lawfulness of processing that occurred before withdrawal.
Under Australian and New Zealand privacy law, we collect, hold, and use personal information that is reasonably necessary for one or more of our functions or activities in operating the Heirly platform.
4. Beneficiary and deceased data
Beneficiary data entered by the executor
When an executor adds a beneficiary to an estate — providing their name, email address, and relationship to the estate — the executor acts as the data controller in respect of that personal information. Heirly acts as a data processor on the executor's instructions in this context.
Beneficiaries are notified by email as soon as they are added to an estate. That notification explains who has added them, what Heirly is, and what information has been entered. Beneficiaries must actively accept their invitation before they can participate in the estate. They may contact us at any time to exercise their rights over their personal data.
Data relating to deceased persons
The name of the deceased and details of their belongings form part of the estate record. Under UK GDPR, the New Zealand Privacy Act 2020, and the Australian Privacy Act 1988, data protection legislation applies to living individuals. Personal data of deceased persons generally falls outside the statutory definitions that confer individual rights.
Notwithstanding this, Heirly treats information about deceased persons with the same level of care, security, and discretion as we apply to the data of living individuals. This reflects our values as a grief-aware platform, not merely our legal minimum obligations.
5. How we use your data
We use the personal information we collect to:
- Create and manage your account and any estates you are part of
- Facilitate the estate catalogue, allocation rounds, and settlement process
- Send you transactional emails — invitations, status updates, and reports related to estates you are part of
- Process payments for paid estate features
- Provide AI-assisted item valuation suggestions
- Ensure platform security and prevent fraud or abuse
- Comply with applicable legal obligations
- Send marketing communications to users who have opted in (you can unsubscribe at any time)
- Analyse how the platform is used in aggregate, where analytics consent has been given, to improve the product
6. Third-party processors
We use the following third-party services to operate Heirly. Each processes personal data on our behalf under data processing agreements or equivalent contractual safeguards:
Supabase
Database, authentication, and file storage. Estate data, user accounts, and uploaded photos are stored in Supabase-managed infrastructure. Data may be hosted outside your home country; appropriate contractual safeguards are in place.
Google Gemini
AI-powered item valuation. When you upload a photo of an estate item, that image and its description may be sent to Google Gemini to generate a suggested title and estimated value. Photos and descriptions are sent for processing only — they are not used to train Google's models under our API agreement.
Resend
Transactional email delivery. Name and email address are shared with Resend in order to send estate invitations, status updates, and other service emails.
Stripe
Payment processing. Stripe handles all card transactions. Payment credentials never pass through our servers. Stripe may retain transaction data in accordance with its own privacy policy and applicable financial regulations.
Google Analytics 4
Website and app analytics. Activated only where you have given cookie consent for analytics. Collects anonymised usage data to help us understand how Heirly is used and improve it over time.
Meta (Facebook) Pixel
Advertising and audience matching. Activated only where you have given cookie consent for marketing. Used to show relevant Heirly ads to people who have previously visited our site. No data is shared with Meta without your explicit consent.
Brevo
Email marketing. Used only for users who have opted in to receive marketing communications from Heirly. Name and email address are shared with Brevo for this purpose. You may unsubscribe at any time via the link in any marketing email.
7. International data transfers
Heirly is incorporated in New Zealand and our third-party processors — including Supabase, Google, Stripe, and Resend — may store or process data in the United States and other countries outside the UK, European Economic Area, Australia, or New Zealand.
Where personal data is transferred internationally, we ensure appropriate safeguards are in place, such as:
- Standard Contractual Clauses approved by the UK Information Commissioner or European Commission (for UK/EEA data)
- Reliance on processors covered by adequacy decisions or equivalent frameworks recognised under NZ and Australian law
- Data processing agreements that require processors to maintain equivalent protections to those required in the originating jurisdiction
By using Heirly, you acknowledge that your data may be processed in countries with different data protection standards to your own. We take reasonable steps to ensure your information remains protected in those circumstances.
8. Data retention
- Active estates: Estate data, item records, and associated personal information are retained for as long as the estate is active.
- Completed estates: Once an estate reaches "Complete" status and no estate member has logged in for 24 consecutive months, the estate record and all associated personal data will be automatically deleted or irreversibly anonymised.
- Early deletion requests: You may request deletion of your personal data at any time by contacting [email protected]. We will action deletion requests within 30 days, subject to any overriding legal obligations to retain certain records (e.g. financial transaction records).
- Inactive accounts: Account data for registered users who have never activated an estate is retained for 12 months of inactivity, after which it is deleted.
- Cookie consent records: Retained for as long as necessary to demonstrate compliance, typically 13 months from the date of consent.
9. Your rights
Depending on where you are located, you have the following rights in relation to your personal data. These rights apply under UK GDPR and the UK Data Protection Act 2018, the Australian Privacy Act 1988, and the New Zealand Privacy Act 2020, with some variation in scope and mechanism between jurisdictions.
- Right to access: You may request a copy of the personal data we hold about you.
- Right to rectification: You may ask us to correct inaccurate or incomplete personal data.
- Right to erasure: You may ask us to delete your personal data in certain circumstances. This right may be limited where we are required by law to retain certain records.
- Right to data portability: Where processing is based on consent or contract and is carried out by automated means, you may request your data in a portable, machine-readable format.
- Right to object: You may object to processing based on our legitimate interests. We will cease that processing unless we can demonstrate compelling legitimate grounds that override your interests.
- Right to withdraw consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing that occurred before the withdrawal.
To exercise any of these rights, contact us at [email protected]. We will respond within one month (UK/EEA), 30 days (Australia), or as soon as reasonably practicable (New Zealand).
11. Children
Heirly is intended for use by adults aged 18 and over. We do not knowingly collect personal information from anyone under 18. If you believe a person under 18 has provided us with their personal data, please contact us at [email protected] and we will delete it promptly.
12. Automated decision-making
Heirly does not make any automated decisions that produce legal or similarly significant effects in relation to you.
AI-generated item valuations are produced algorithmically but are provided as suggestions only. They do not constitute professional appraisal, and no allocation or settlement decision is made automatically — every decision is reviewed and confirmed by the human executor responsible for the estate.
13. Sale of data
We do not sell your personal data to third parties. We do not share your personal data with third parties for their own independent marketing or advertising purposes. Third-party tools we use (such as Google Analytics and the Meta Pixel) operate strictly under our instructions and only where you have given consent.
14. Changes to this policy
We may update this Privacy Policy from time to time as we add new features, change how we use data, or in response to changes in applicable law. Where changes are material, we will notify registered users by email before the changes take effect. The Last updated date at the top of this page will always reflect the current version.
15. Complaints
If you have a concern about how we handle your personal data, please contact us first at [email protected]. We take all complaints seriously and will respond within a reasonable timeframe.
If you are not satisfied with our response, you may escalate to the relevant regulator:
- UK users: Information Commissioner's Office (ICO) — ico.org.uk
- Australian users: Office of the Australian Information Commissioner (OAIC) — oaic.gov.au
- New Zealand users: Office of the Privacy Commissioner — privacy.org.nz
If you are located in another country, you may also have the right to lodge a complaint with your local data protection or privacy authority.
16. Contact us
For any questions about this Privacy Policy or how we handle your personal data, please contact:
The P80 Project Limited (trading as Heirly)
Email: [email protected]
Website: heirly.app