Effective date: 9 June 2026
Version: 2026-v1
Filumio (Pty) Ltd (“Filumio”, “we”, “us”) respects your privacy. This Privacy Policy explains how we collect, use, store, share, and protect personal information when you use our digital legacy platform.
Data controller: Filumio (Pty) Ltd · 25 Redstone Crescent · support@filumio.com
This policy should be read with our Terms and Conditions and Acceptable Use Policy.
1. Scope
This policy applies to:
- visitors to our marketing website;
- registered users and account holders;
- trusted contacts and others who interact with vault invitations or tiered access; and
- individuals whose information is stored in a user’s vault by that user.
Filumio primarily serves users in South Africa, the United Kingdom, the United States, Australia, and the European Economic Area. Applicable laws may include POPIA (South Africa), GDPR / UK GDPR, the Australian Privacy Act, and US state privacy laws.
2. Information we collect
2.1 Account and profile data
- email address, country preference, locale, and time zone;
- authentication data (password hash, WebAuthn credentials, MFA settings);
- optional profile fields (display name, avatar, encrypted ID number where provided);
- subscription tier and billing-related metadata (payment card details are processed by future payment providers, not stored by Filumio in plain text).
2.2 Vault and legacy content
- documents, files, and structured data you upload or create;
- passwords, credentials, and final wishes you store;
- trusted-contact designations, access tiers, and delegation rules;
- will drafts, readiness checklist progress, and related metadata.
Depending on the feature, content may be encrypted such that Filumio cannot read it without your keys or authorised release.
2.3 Life events and verification
- death reports, attestations, and supporting notes;
- verification document metadata (and uploaded official documents where provided);
- audit-trail entries for access, login, and vault events.
2.4 Technical and usage data
- IP address, browser type, device signals, and approximate region (for pricing and regional copy);
- session identifiers, sign-in timestamps, and security logs;
- error reports and performance diagnostics.
2.5 Communications
- support enquiries and email notifications we send you;
- estate-notification templates you choose to send via Filumio.
2.6 Information about others
You may store personal information about family members, executors, beneficiaries, or advisers. You are responsible for ensuring you have a lawful basis to provide that information to Filumio.
3. How we use information
We use personal information to:
- provide, secure, and improve the Services;
- authenticate users and enforce tiered access;
- detect fraud, abuse, and suspicious death attestations;
- process subscriptions and send service communications;
- comply with legal obligations and respond to lawful requests;
- analyse aggregated, de-identified usage to improve the product; and
- obtain your consent where required (for example, cross-border storage at registration).
We do not sell your personal information.
4. Lawful bases (GDPR / UK GDPR)
Where GDPR or UK GDPR applies, we rely on:
- Contract: processing necessary to provide the Services you request;
- Consent: where you explicitly agree (for example, registration acceptance, optional marketing, cross-border transfer consent);
- Legitimate interests: security, fraud prevention, and service improvement, balanced against your rights; and
- Legal obligation: where we must retain or disclose information by law.
5. Encryption and security
We implement technical and organisational measures including:
- encryption in transit (TLS) and at rest (AES-256);
- access controls, tiered release, and tamper-evident audit logging;
- WebAuthn / MFA support;
- infrastructure hardening and monitoring.
No system is perfectly secure. You are responsible for safeguarding your master password and devices.
6. Where we store data
Filumio uses cloud infrastructure that may be located outside your home country, including:
- DigitalOcean: application hosting and managed PostgreSQL (London region);
- DigitalOcean Spaces: encrypted file storage (EU region);
- Postmark: transactional email;
- OpenAI: optional document parsing and advisor features (content sent only when you use those features);
- IP geolocation providers: approximate country detection on marketing pages.
Cross-border transfers are protected through encryption, contractual safeguards, and your consent where required under POPIA Section 72, GDPR Chapter V, or equivalent laws.
7. Retention
We retain personal information for as long as your account is active or as needed to provide the Services. After account closure:
- we delete or anonymise data within a reasonable period, subject to legal retention requirements;
- encrypted vault content may be irrecoverably deleted when encryption keys are destroyed;
- audit and security logs may be retained longer for fraud prevention and legal compliance.
You may request deletion as described in Section 9.
8. Sharing and processors
We share information only:
- with service processors listed above, under written data-processing terms;
- with trusted contacts and executors according to your vault rules and verified tiers;
- when required by law, court order, or regulator;
- to protect rights, safety, and security of users and Filumio; or
- with your explicit direction (for example, emails you send through the platform).
We do not share vault content with advertisers.
9. Your rights
Depending on your jurisdiction, you may have the right to:
- access personal information we hold about you;
- correct inaccurate data;
- delete your account and associated data;
- object to or restrict certain processing;
- withdraw consent where processing is consent-based;
- lodge a complaint with a supervisory authority (for example, the Information Regulator in South Africa, or your local data protection authority).
To exercise these rights, contact support@filumio.com. We will respond within the timeframe required by applicable law.
10. Breach notification
If we become aware of a personal-information breach that poses a risk to your rights, we will notify you and relevant regulators as soon as reasonably practicable, in line with POPIA Section 22, GDPR Articles 33–34, and equivalent requirements.
11. Children
Filumio is not intended for users under 18. We do not knowingly collect information from children. Contact us if you believe a minor has created an account.
12. Changes to this policy
We may update this Privacy Policy from time to time. Material changes will be notified at least 30 days before they take effect where practicable. Continued use constitutes acceptance. You may be asked to re-accept updated policies on sign-in.
13. Contact
Privacy enquiries: support@filumio.com
Postal address: 25 Redstone Crescent
Filumio (Pty) Ltd