Privacy Policy

Last updated: February 2026

POPIA Compliant - This policy complies with South Africa's Protection of Personal Information Act (POPIA), Act 4 of 2013

1. Introduction

urWill ("we," "our," or "us") is committed to protecting your personal information and your right to privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service at urwill.co.za.

Responsible Party: urWill.co.za is the responsible party for the processing of your personal information as defined by POPIA.

2. Information We Collect

2.1 Information You Provide

When you create a will, you may provide:

  • Personal Identifiers: Full name, South African ID number, date of birth, address, phone number, email address
  • Beneficiary Information: Names, relationships, ID numbers, percentages
  • Asset Information: Descriptions of property, vehicles, bank accounts, investments, estimated values
  • Executor Information: Name, contact details, relationship
  • Guardian Information: Name, address, contact details (if applicable)
  • Special Instructions: Any additional wishes or instructions

2.2 Automatically Collected Information

We may automatically collect:

  • Browser Information: IP address, browser type, device type
  • Usage Data: Pages viewed, time spent on site, interaction patterns
  • Cookies: Small data files stored on your device (see Cookie Policy below)

2.3 Will Registry Data

When you generate your will we create a SHA-256 hash — a cryptographic fingerprint — and record it in our will registry. Each day the fingerprints recorded since the last batch are combined into a single value which is published into the Bitcoin blockchain, so the date your will existed can be confirmed without relying on us. What we record:

  • Does not contain your name, ID number, or any other personal information
  • Cannot be reversed to reveal what your will says
  • Proves your will existed in that exact form on that date, and has not been altered since
  • Includes a keyed commitment that lets someone who already knows your name and ID number confirm a certificate belongs to you, without the registry ever storing either

Only the single combined daily value is published externally. Your individual record stays in our registry and can be deleted on request — see section 7.

3. How We Use Your Information

We use your information to:

  • Provide the Service: Generate your will document and certificate of authenticity
  • Store Drafts: Save work in progress in your browser so you can return to an unfinished will
  • Blockchain Storage: Create immutable proof of will existence
  • Improve Service: Analyze usage patterns to improve features
  • Legal Compliance: Comply with legal obligations and prevent fraud
  • Communication: Send important updates about your will (if you provide email)

4. Where Your Will Is Stored

Two places, for two different purposes

  • While you are filling in the form: your answers are saved in your browser on your own device, so you can close the tab and come back without losing progress. Clearing your browser data deletes that draft permanently.
  • Once you create your will — if you ask us to keep it: it is saved to our servers so you can sign in from any device, download it again, revise it, and generate an executor pack. Its contents are encrypted before they are stored, using keys held separately from the database.
  • If you ask us not to keep it: we store nothing of its content — not the document, not your beneficiaries or assets, not your identity number, not even your name. All that remains is your certificate: a fingerprint of the document, which reveals nothing about you and cannot be reversed. You are asked to choose when you create the will, and you can delete a stored will at any time afterwards.

You can delete a stored will at any time — see section 7.

5. Data Sharing and Disclosure

5.1 We Do Not Sell Your Data

We will never sell, rent, or trade your personal information. Not now, and not as a business model later.

Saying "we don't sell your data" is easy, and plenty of companies say it while doing everything short of a sale. So, specifically, we do not:

  • share your information with advertisers, ad networks, or data brokers;
  • build profiles of you for marketing, or let anyone else build one from what you tell us;
  • pass your details to insurers, banks, funeral providers, estate planners or anyone else who might like to sell you something — a person writing a will is exactly the customer those industries pay for, and we are not in that trade;
  • use your will, or anything in it, to train machine learning models;
  • send the contents of your will to any analytics service. We measure which step of the form people stop at, using field names and counts. Never a name, an identity number, a beneficiary, or an amount.

This holds whether or not you ask us to keep a copy of your will. Choosing to store it gives us a copy to look after — it does not give us permission to do anything else with it.

5.2 Service Providers

We may share data with trusted service providers:

  • Supabase: Database, file storage and account authentication. Your will contents and any documents you upload are encrypted by us before they reach Supabase
  • Vercel: Website and application hosting
  • Resend: Sending email such as account and will confirmations
  • Upstash: Rate limiting, to protect the service from abuse
  • Sentry: Error monitoring, so faults can be diagnosed and fixed
  • OpenTimestamps calendar servers: Receive only the single combined daily fingerprint value described in section 2.3. No personal information is sent
  • Analytics Providers: For usage analytics (anonymized data only)

All service providers are contractually obligated to protect your data and use it only for providing the Service.

5.3 Legal Requirements

We may disclose your information if required by law:

  • To comply with court orders or subpoenas
  • To protect our rights or property
  • To prevent fraud or illegal activities
  • To cooperate with law enforcement

6. Data Security

We implement security measures to protect your data:

  • Encryption: All data transmitted over HTTPS (TLS 1.3 encryption)
  • Encryption at rest: Will contents and uploaded documents are encrypted with AES-256-GCM before storage, using keys we hold separately from the database
  • External anchoring: Daily fingerprints are published into the Bitcoin blockchain, so the date a will existed can be confirmed without relying on us
  • Rate Limiting: Protection against abuse (5 wills per hour per IP)
  • Input Validation: Prevents injection attacks and malicious data
  • Security Headers: HSTS, CSP, X-Frame-Options, etc.

However: No method of transmission over the Internet is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

6A. Our Legal Basis for Processing

Section 11 of POPIA requires a lawful justification for processing your personal information. We rely on the following:

  • Performance of a contract: we cannot generate your will without the details it must contain — your name, identity number, address, beneficiaries and executor.
  • Your consent: for anything beyond that, such as email about your will. You may withdraw consent at any time.
  • Our legitimate interests: keeping the service secure and working — rate limiting, error monitoring, fraud prevention — balanced against your right to privacy.
  • Legal obligation: where we are required to retain or disclose information by law.

We do not process special personal information as defined in section 26 of POPIA, and we do not knowingly process the personal information of children.

7. Your Rights (POPIA)

Under POPIA, you have the following rights:

7.1 Right to Access

You have the right to request a copy of the personal information we hold about you.

7.2 Right to Correction

You have the right to request correction of inaccurate or incomplete personal information.

7.3 Right to Deletion

You have the right to request deletion of your personal information, subject to legal obligations.

7.4 Right to Object

You have the right to object to the processing of your personal information in certain circumstances.

7.5 Right to Lodge a Complaint

You have the right to lodge a complaint with the Information Regulator of South Africa:
Website: www.justice.gov.za/inforeg
Email: inforeg@justice.gov.za

7.6 How to Exercise Your Rights

To exercise any of these rights, contact us at privacy@urwill.co.za. We will respond within 30 days.

8. Data Retention

We retain your data as follows:

  • LocalStorage (Your Device): Until you clear browser data or delete it manually
  • Your will: Kept until you delete it. Its contents are encrypted at rest, so they are unreadable to anyone who obtains a copy of our database
  • Registry fingerprints: Kept while your will exists, and deleted with it. They contain no personal information
  • Documents you upload: Encrypted at rest and deleted with your account
  • Usage Logs: Retained for 90 days for security and analytics

What we cannot withdraw: the single combined daily value published into the Bitcoin blockchain. It is a number derived from many wills at once, it identifies nobody, and it cannot be traced back to you or to your will's contents. Everything we hold about you can be deleted on request.

9. Cookies and Tracking

We use minimal cookies and tracking:

  • Essential Cookies: Required for the Service to function (localStorage for draft saving)
  • Analytics Cookies: To understand how users interact with the Service (anonymized)

You can disable cookies in your browser settings, but this may affect Service functionality.

10. Children's Privacy

Our Service is NOT intended for individuals under 18 years old. We do not knowingly collect personal information from minors. If you believe we have collected information from a minor, please contact us immediately.

11. International Data Transfers

Your data is stored outside South Africa, on infrastructure operated by Supabase in the European Union (Ireland). We ensure adequate protection through:

  • Storage in a jurisdiction subject to the GDPR, which POPIA recognises as offering comparable protection
  • Encryption of will contents and uploaded documents before they leave our systems, so the hosting provider cannot read them
  • Standard contractual clauses
  • Supabase's security certifications (SOC 2 Type II, HIPAA)

12. Changes to Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by:

  • Updating the "Last Updated" date at the top of this page
  • Displaying a prominent notice on our website
  • Sending an email notification (if we have your email address)

13. Contact Information

For questions about this Privacy Policy or to exercise your rights, contact us at:

Email: privacy@urwill.co.za

Information Officer: the owner of urWill. Under section 55 of POPIA the head of a responsible party is its Information Officer by default, and must be registered with the Information Regulator.

Summary: Your Privacy Matters

  • Your will is stored on our servers, encrypted, so you can reach it from any device
  • Encryption means a copy of our database does not reveal what any will says
  • We NEVER sell your data to third parties
  • Blockchain hashes are anonymized (cannot reveal personal info)
  • You have full rights under POPIA to access, correct, or delete your data