Privacy policy
Last updated: 12 November 2026
You're trusting us with some of the most personal things in your life, and with the people you love. We take that seriously. In short: we never sell your data, we never ask for passwords, PINs or card numbers, and not even afterbox can open your vault.
On this page
1. Who we are
afterbox ("afterbox", "we", "us") is the controller of your personal information.
Contact us about privacy at privacy@afterbox.co.uk.
2. What we collect
When you visit our website: basic technical information, such as your device, browser and pages visited, collected by our hosting provider to keep the site running and secure.
When you create an account: your name, email address, sign-in details, and your plan and payment status. Payments are handled by Stripe; we never see or store your full card number.
What you add to your record: information about your accounts, policies, pensions, property and wishes; where to find documents and keys; and your messages (video, voice and written). We never ask for passwords, PINs, full card numbers or security codes. Please don't add them.
About the people you name: their names, contact details and relationship to you, so we can reach them when the time comes. Before you add someone, please make sure you're comfortable sharing their details with us. We won't contact them while you're alive except as you ask (for example, to let them know you've named them).
If you connect your bank (optional): with your consent, read-only information about your accounts, balances and transactions, provided through an open banking provider authorised by the Financial Conduct Authority (FCA). We use it only to help you build your record.
When a death is verified: the executor's details and the death certificate (or equivalent document) they provide, and records of our verification checks.
Family support: if you use our family support service, the information you share about the person who died and about you, so we can help you settle their affairs.
When you contact us: whatever you choose to tell us.
3. How we use it, and why we're allowed to
| What we do | Our lawful basis |
|---|---|
| Provide afterbox: store, protect and deliver your record and messages | To perform our contract with you |
| Verify a death and release your record to the right people | To perform our contract with you, and our legitimate interest in preventing fraud |
| Use your bank information to suggest things to add | Your consent, which you can withdraw at any time |
| Take payment and keep financial records | Contract and legal obligation |
| Keep afterbox secure and prevent misuse | Legitimate interests |
| Send you service messages (for example, "you bought a home, add it?") | Contract and legitimate interests; you can change these in settings |
| Send you marketing | Only with your consent; unsubscribe at any time |
| Introduce you to a professional you've chosen | Your request (contract) |
A death certificate can include information about health. Where we handle it, we do so only to verify a death, with extra protections.
4. How we protect it
- Not even afterbox can open your vault. Your sealed record is protected with split-key encryption. The key is split so that no single party, including us, can reconstruct it alone. Releasing it requires a verified death and your executor's own credential.
- Your bank information is kept separately from your sealed record, and only what's needed is kept.
- We use encryption in transit and at rest, strict access controls and regular security reviews.
5. Who we share it with
We never sell your data. We share information only:
- With the people you chose, when the time comes, each seeing only what you left for them.
- With service providers who help us run afterbox, such as hosting, storage, payments, email, identity and document checks, and open banking. They act on our instructions and must protect your information.
- With a professional you ask us to introduce you to, and only what's needed for that introduction.
- When the law requires it, or to protect people from fraud or harm.
- If afterbox is ever sold or restructured, the new owner must honour this policy and your record stays sealed.
6. Where it's stored
We store your information in the UK. If any provider processes it elsewhere, we make sure it's protected by approved safeguards, such as the UK International Data Transfer Agreement.
7. How long we keep it
- Your record and messages: while your account is open, and after a verified death for as long as is needed to deliver everything to the people you chose and for them to access it (5 years), unless they ask us to delete it sooner.
- If you close your account: we delete your record and messages within 60 days, except for anything we must keep by law.
- Payment records: 6 years, as UK law requires.
8. Your rights
You can ask us to:
- give you a copy of your information;
- correct anything that's wrong;
- delete your information;
- restrict or object to how we use it;
- give your information to you or another service in a portable format;
- stop using it where we rely on your consent (this won't affect what we did before).
Email privacy@afterbox.co.uk. We'll respond within one month. If you're unhappy with how we've handled your information, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We'd appreciate the chance to help first.
9. After you die
UK data protection law covers living people. Even so, we'll treat your record with the same care after you die, release it only as you chose, and never use it for anything else.
10. Children
afterbox is for adults (18+). You can name children as people to receive messages, and we'll only contact them in the way you choose, or through their parent or guardian.
11. Cookies
We use only the cookies needed to run the website and keep you signed in.
12. Changes to this policy
If we make a change that matters, we'll tell you before it takes effect.
13. Contact us
afterbox · privacy@afterbox.co.uk