WillSafeUK

Privacy Policy

Last updated: 20 June 2026

This policy explains how WillSafe UK (operated by Richard Wood, trading as WillSafe, the "data controller") processes your personal data. We comply with the UK GDPR and the Data Protection Act 2018.

What we collect

  • Order data: email address provided at checkout
  • Order data: SKU purchased, amount, order status, Stripe session reference
  • Support correspondence: emails you send us and our replies
  • Survey data: if you answer the optional "How did you find us?" survey on the order confirmation page, your one-tap answer is stored against your order and used only to understand which channels work; it is voluntary and holds no name, email or free text.
  • Technical data: IP address, browser type, pages viewed. If you accept all cookies, this is collected via Microsoft Clarity, which records anonymised session replays of how you use the site, and Google Analytics 4, which measures how the site is used (pages, sessions).
  • Attribution data: if you accept all cookies, a first-party cookie (ws_acq) records how you reached us (referrer, any campaign tags, landing page) so a sale can be attributed to a channel. It holds no name, email or payment detail.

We do not use advertising or remarketing cookies or tags.

What we don't collect: the content of your Will or any personal information you enter into our templates. Our templates are for you to fill in on your own device. We never see what you write.

Why we collect it and our lawful basis

  • To deliver your order. Lawful basis: performance of a contract.
  • To provide re-download access. Lawful basis: performance of a contract.
  • For fraud prevention and security. Lawful basis: legitimate interests.
  • For analytics. Lawful basis: consent (session-replay analytics via Microsoft Clarity and usage analytics via Google Analytics 4, both loaded only if you accept all cookies).
  • For marketing email. Lawful basis: consent. Only if you opt in at checkout.

Who we share it with

  • Stripe (payments): processes your card details directly; we never see or store them.
  • Supabase (hosting our database): stores your account and order records in the EU region.
  • Resend (email delivery): sends your order confirmation and download-link emails.
  • Vercel (site hosting).
  • Microsoft (Clarity analytics): if you accept all cookies, processes anonymised session-replay data to help us improve the site.
  • Google (Analytics 4): if you accept all cookies, processes usage analytics (pages, sessions) to help us measure how the site is used.

We do not sell your data to anyone, ever.

How long we keep it

  • Order records: 7 years (HMRC tax requirement).
  • Support emails: 2 years after the matter closes.
  • Marketing consent: until you unsubscribe.
  • Marketing consent records: until you unsubscribe or request deletion.

Your rights

You have the right to access, correct, delete, or port your personal data, to object to processing, and to withdraw consent. To exercise any right, email privacy@willsafe.org.uk. We respond within one month.

You also have the right to complain to the Information Commissioner's Office (ICO): ico.org.uk / 0303 123 1113.

How to complain about your data

If you believe we have mishandled your personal data, you can raise a formal data-protection complaint. Here is how:

  1. Contact us first. Email privacy@willsafe.org.uk or use our online complaints form. Include your name, contact details, and a description of your concern.
  2. We acknowledge within 5 working days of receiving your complaint, confirming who is handling it and the expected timeline.
  3. We respond within 30 calendar days of receipt. For complex cases we may extend this to 90 days; we will notify you within the original 30-day period if we need to do so.
  4. If you remain dissatisfied, you have the right to escalate to the Information Commissioner's Office (ICO) at any time - ico.org.uk / 0303 123 1113.

Our full Data Protection Complaints Process (v1.0, effective 20 June 2026) sets out the procedure in detail, including how complaints are investigated, escalated, and recorded.

International transfers

Our primary infrastructure is hosted in the UK/EU. Where providers process data in other regions (e.g. Stripe in the US), transfers are protected by Standard Contractual Clauses and each provider's certified transfer mechanism.

Contact

Data controller: Richard Wood, trading as WillSafe. Email: richard@willsafe.org.uk.