1. Who we are
WillFull Ltd (company number 17307596), at Office 122, Filwood Green Business Park, 1 Filwood Park Lane, Bristol, England, BS4 1ET, is the controller of your personal data. We’re registered with the Information Commissioner’s Office, registration [ZA000000].
Questions about your data? Email privacy@willfull.co.uk.
2. What we collect
Name, date of birth, email, address, relationship status and your children’s names.
Your answers in the will creator, and any will you upload.
Property, accounts, balances, pensions, policies and where documents are kept.
Names and contact details of executors, guardians, beneficiaries and advisers.
What we look up about your property from public data: previous sales, local house prices, its energy certificate, and planning and flood designations.
If you choose to connect a bank through Open Banking: your account names, types and balances. Never your login.
For someone asking for access: their name and contact details, a copy of the death certificate, and the result of an identity check (photo ID and a face check, done by our identity partner).
If you forward an email to your WillFull inbox: the sender, subject and message text, kept until you delete them. PDF and photo attachments are saved into your Documents.
Files you upload or forward to us, and the details you add about them (what they are, what they link to, and where the original is kept).
Handled by Stripe. We never see your full card number.
Each time someone signs in or tries to: the time, whether it worked, the IP address, the approximate place (city and country) and the device and browser. We use it to keep your account secure and lock it after repeated wrong passwords.
Only if you agree to analytics cookies: which pages are visited and the page you came from. This is collected with Vercel Analytics and Google Tag Manager and Google Analytics, and only on our public website, never on the pages you use when signed in. We don’t use it for adverts, and it doesn’t follow you around other sites.
If you apply to join the directory: your name, work email, job title, firm, FCA or SRA numbers, what you offer, and the results of our checks against the register. If you’re approved, your name, firm, regulator number and the listing details you gave are shown publicly in the directory.
The free-text boxes, wishes and documents are yours to fill in, so they may include sensitive details such as health or beliefs if you choose to write them. We keep that only to provide WillFull to you, and it is only shown to the people you’ve chosen to share it with.
3. Where it comes from
Mostly from you. We also fill in or add to your details from public and partner sources:
- HM Land Registry, for a property’s sales and local house prices.
- postcodes.io, to find the council area for a postcode.
- The Energy Performance Certificate register, and planning.data.gov.uk for planning and flood designations.
- Companies House, for details of a company you add.
- The FCA and SRA registers, to check advisers and solicitors.
- Your bank, through our Open Banking provider Tink, only if you connect one.
- Our identity partner Didit, when someone asks for access after a death.
4. Why we use it
5. Who can see it
Some members of the WillFull team can open an account to give support or check a request. Sensitive details are hidden unless they give a reason, and every view is recorded.
We also use trusted suppliers to run the service — hosting Vercel, our database Supabase, payments Stripe, email Resend, bot protection Cloudflare, Open Banking Tink, identity checks Didit, error monitoring Sentry and, only with your permission, website analytics from Vercel and Google. They can only use your data to provide their service to us. We send public data services only what they need, such as a postcode or a company number.
When something breaks, error monitoring tells us what went wrong and where. We hide email addresses, long numbers and security tokens before it leaves, and we don’t send cookies, form contents or recordings of your screen.
6. How we protect it
Your data is encrypted in transit and at rest. Staff access is limited to those who need it and is logged. You can switch on two-step verification, which asks for a code from an authenticator app when you log in, in Settings. We lock an account for 15 minutes after repeated wrong passwords.
Some of our suppliers, such as hosting, payments and error monitoring, may process data outside the UK and the European Economic Area. Where they do, it is under UK adequacy regulations or approved safeguards such as the ICO’s International Data Transfer Agreement or Addendum.
7. How long we keep it
While your account is open. If you close it, we delete your account and everything in it 30 days after you ask, unless you change your mind first. Payment records are kept by our payment provider for 6 years, as the law requires. After a death, we keep the account for 2 years from when the estate is released so executors can finish their work, then we delete it.
Emails you forward to your inbox are kept until you delete them or close your account, and their attachments are saved in your Documents. Your Documents count towards a storage allowance of 1 MB without a subscription and 1 GB with one. If a subscription ends, we keep your files for 30 days and email you before anything is removed. After that, files over 1 MB are deleted and your oldest are kept.
Sign-in history is kept for 12 months. Technical logs of the requests we send to other services are kept for 90 days, with account numbers and security tokens hidden. A death certificate and identity check result are kept only for as long as we need them to deal with the request.
8. Your rights
You can ask to see, correct, download or delete your data, object to how we use it, or withdraw consent. Most of this you can do yourself in Settings, including downloading everything we hold (your details, documents and the files themselves, and your sign-in history), or email privacy@willfull.co.uk. We’ll respond within one month.
If you’re unhappy with how we handle your data, you can complain to the Information Commissioner’s Office at ico.org.uk.
9. Cookies
We use essential cookies to keep you logged in, to keep your account secure and to remember your cookie choice. Our bot check (Cloudflare Turnstile) may set a cookie to tell people from automated programs. These can’t be turned off.
With your permission, we also use analytics (Vercel Analytics, Google Tag Manager and Google Analytics) to count which pages are visited and how people find us, so we can see what works. This runs only on our public website, not on the pages you use when signed in. We don’t use cookies for adverts. You can change your choice at any time: .
10. Changes to this policy
If we make important changes, we’ll email you before they take effect.