Evaheld Privacy Policy

Effective date: 1 October 2026

Evaheld is designed to hold some of the most personal information a person may choose to preserve. Protecting that information is fundamental to how we operate.

This Privacy Policy explains how After I Go Pty Ltd trading as Evaheld (ABN 80 656 838 505) ("Evaheld", "we", "us" or "our") collects, holds, uses, discloses, transfers, retains and protects personal information when you use our websites, applications, Evaheld Legacy Vault and related products and services ("Services").

Our principal website is evaheld.com.

For applicable privacy laws, Evaheld is generally the organisation, controller or business responsible for the personal information described in this Policy.

This Privacy Policy should be read together with our Terms and Conditions and any specific privacy, collection or consent notice shown when information is collected.

1. Who this Privacy Policy applies to

This Privacy Policy applies to personal information we handle about people including:

Evaheld account holders and Legacy Vault owners;
people purchasing or gifting Vaults;
recipients of scheduled or posthumous content;
Trusted Parties;
family members, advisers and other people identified within a Vault;
visitors to our websites;
people who contact Evaheld;
event, newsletter or marketing subscribers; and
other people whose personal information is provided to Evaheld.

A Vault may contain personal information about people other than the Vault owner.

If you provide another person's personal information, you should do so only where you have an appropriate legal basis, permission or authority.

2. Personal information we collect

The information we collect depends on how you use Evaheld.

Account and identity information

This may include:

name and preferred name;
date of birth;
email address;
telephone number;
country or region;
postal or billing address;
account identifiers;
authentication information;
profile information; and
account preferences.

Legacy Vault content

You may choose to create, upload or store:

stories and memories;
photographs and images;
video and audio recordings;
letters and messages;
future-dated and posthumous messages;
documents and uploaded files;
family history;
personal wishes;
funeral or memorial wishes;
important household and personal records; and
other content you choose to preserve.

Health and care information

You may choose to store:

health conditions;
medical history;
medications;
allergies;
emergency information;
care preferences;
Advance Care Directives;
information about carers or substitute decision-makers;
end-of-life wishes; and
other health or care information.

Health information is sensitive information under Australian privacy law and may be special-category personal data under European and UK data-protection law.

We apply heightened protections to this information.

Estate, legal and financial information

You may choose to store information including:

wills and estate records;
powers of attorney;
guardianship information;
executors and beneficiaries;
assets and property;
financial and account information;
insurance information;
tax-related records;
identity documents; and
professional adviser information.

Passwords and digital-account information

Where Password Manager functionality is available, you may choose to store:

usernames;
passwords;
account names;
digital account information; and
digital-asset instructions.

We treat this information as highly sensitive.

Contacts, recipients and Trusted Parties

You may provide:

names;
email addresses;
telephone numbers;
relationship information;
recipient information;
adviser information;
Trusted Party information; and
delivery instructions.

Death, identity and authority information

Where reasonably necessary to administer posthumous functionality or resolve access issues, we may collect information required to verify:

death;
identity;
recipient identity;
Trusted Party identity;
executor or representative status;
legal authority; and
disputes concerning access or delivery.

Payment and subscription information

We may collect or receive:

plan purchased;
subscription status;
transaction identifiers;
payment status;
billing country;
billing history;
refund information; and
limited payment-method information supplied by payment providers.

Where payment details are entered directly into a third-party payment processor, Evaheld may not receive or store complete card details.

Communications and support information

If you contact us, we may collect:

emails and correspondence;
support requests;
complaints;
feedback;
survey responses; and
other information you choose to provide.

Device, technical and usage information

We may automatically collect information including:

IP address;
browser and device information;
operating system;
approximate location derived from technical information;
referring website or page;
pages or screens viewed;
clicks and interactions;
timestamps;
session information;
feature usage;
error and diagnostic information;
cookie and similar identifiers; and
security or fraud-prevention signals.

We do not require precise location merely to use the ordinary Legacy Vault unless a particular feature expressly requires it.

3. How we collect personal information

We may collect information:

directly from you;
when you create or use a Vault;
when you create or upload content;
when you purchase, receive or activate a plan;
when another user nominates you as a recipient, contact or Trusted Party;
when an authorised person provides information relating to a Vault;
when you contact us;
through cookies and similar technologies;
through our applications and technical systems;
from payment, authentication, communications and infrastructure providers;
from integrations you choose to connect;
where reasonably necessary to verify death, identity or authority; and
from lawful public or official sources where reasonably necessary.

Where we collect information about you from another person, we handle it in accordance with applicable law.

4. Why we use personal information

We may collect, hold, use and disclose personal information to:

create and administer accounts;
provide and secure the Legacy Vault;
store and organise User Content;
provide Rooms, Content Requests, contacts and sharing functionality;
administer recipients and Trusted Parties;
perform scheduled and posthumous delivery;
provide emergency-access functionality;
provide Password Manager functionality;
process purchases, subscriptions and refunds;
authenticate users;
prevent fraud and unauthorised access;
protect the security and integrity of Evaheld;
provide customer support;
communicate important account, billing, security, storage, deletion and delivery information;
personalise features requested by users;
provide AI-assisted functionality;
understand and improve how our Services perform;
diagnose technical problems;
conduct internal analytics and product development;
comply with legal and regulatory obligations;
respond to lawful requests;
establish, exercise or defend legal claims;
investigate complaints and disputes;
enforce our Terms;
manage lawful corporate transactions; and
send marketing communications where permitted and subject to your preferences.

We will not use personal information for a materially different purpose without an appropriate legal basis and, where required, further notice or consent.

5. Sensitive personal information

Evaheld may hold especially sensitive information including:

health information;
identity information;
financial information;
passwords and digital-account information;
estate and end-of-life information;
confidential communications;
information about family or personal circumstances; and
other sensitive information a user chooses to preserve.

We collect or process sensitive information only where permitted by applicable law.

For Australian users, this may include circumstances where you have consented and the information is reasonably necessary for our functions or activities, or another lawful exception applies.

Where GDPR or UK GDPR applies, we identify an applicable Article 6 lawful basis and, where required, an applicable Article 9 condition for special-category personal data.

We apply access, handling and security controls appropriate to the sensitivity of the information.

6. Legal bases under GDPR and UK GDPR

Where GDPR or UK GDPR applies, the legal basis for processing depends on the information and purpose involved.

We may rely on:

Performance of a contract where processing is necessary to create and operate your account, store your Vault, provide purchased functionality, perform delivery instructions, process billing or otherwise provide Services you request.

Consent where you have provided valid consent, including where consent or explicit consent is required for sensitive information, optional processing, marketing or non-essential technologies.

Legitimate interests where necessary for interests such as protecting Evaheld, preventing fraud, maintaining security, improving the Service and operating our business, provided those interests are not overridden by your rights and interests.

Legal obligation where processing is required to comply with applicable law or lawful regulatory requirements.

Legal claims where processing is necessary to establish, exercise or defend legal rights or claims.

Other lawful bases or special-category conditions may apply where permitted by law.

Where we rely on consent, you may withdraw it at any time. Withdrawal does not make earlier lawful processing unlawful and may affect functionality that requires the relevant information.

Closing your Evaheld account is not the only way to withdraw consent.

7. Health and care information

Evaheld recognises the heightened sensitivity of health and care information.

We use private health and care information principally to:

provide health, care and emergency functionality requested by the Vault owner;
store and display the information to the Vault owner;
make information available to people authorised by the Vault owner;
support Advance Care Directive and related care functionality selected by the user;
administer authorised delivery or sharing; and
operate and secure the Service.

We do not use the contents of private health or care records for targeted advertising.

Where applicable, we handle health information consistently with relevant Australian health-privacy requirements, GDPR, UK GDPR and applicable consumer-health privacy legislation.

Where a jurisdiction requires a separate consumer-health notice, that notice supplements this Privacy Policy.

8. Passwords and other highly sensitive Vault content

Private Vault contents including:

Password Manager data;
identity documents;
health records;
estate records;
confidential messages;
uploaded private documents; and
private recordings

are not collected for targeted advertising.

We do not disclose private Vault contents to advertising partners for cross-context behavioural advertising.

Where you expressly instruct Evaheld to share or deliver particular information to another person, we use that information to carry out your instruction.

9. AI-assisted functionality and automated processing

Evaheld may provide AI-assisted functionality, including Charli.

Depending on the feature, AI systems may process information supplied by a user in order to:

personalise prompts;
identify relevant tasks;
organise information;
suggest categories or actions;
assist navigation; or
generate a response or suggestion requested by the user.

We aim to limit information supplied to external AI systems to what is reasonably necessary for the relevant functionality.

Where a third-party AI provider processes personal information on our behalf, appropriate contractual, privacy and security requirements apply.

Evaheld does not intend to use AI as the sole basis for decisions producing legal or similarly significant effects about users without an appropriate lawful basis and safeguards.

Automated decision-making

Computer programs may make or assist with activities such as:

authentication and account security;
fraud or abuse detection;
account or subscription-status controls;
technical access controls;
processing user-selected delivery conditions;
prioritising prompts or tasks; and
generating personalised recommendations.

Depending on the process, the kinds of personal information used may include:

account and authentication information;
subscription status;
security and device information;
account activity;
delivery settings;
user preferences; and
information reasonably necessary to perform the relevant function.

Where a computer program makes, or performs an action substantially and directly related to making, a decision that could reasonably be expected to significantly affect an individual's rights or interests, Evaheld will provide the information, safeguards and review mechanisms required by applicable law.

10. Cookies, analytics and similar technologies

We use cookies, pixels, software development kits and similar technologies for purposes including:

authentication;
account and website security;
maintaining sessions;
remembering preferences;
measuring website and product performance;
understanding usage;
diagnosing technical problems;
improving user experience;
measuring marketing campaigns; and
advertising where permitted.

Depending on which services are enabled, technologies may be supplied by providers such as:

Google;
Microsoft Clarity;
PostHog;
TikTok;
Plerdy; and
other analytics, security, functionality or advertising providers.

Our providers may change over time.

Cookie categories

Strictly necessary technologies are required for security, checkout, authentication or essential functionality.

Functional technologies support preferences and optional functionality.

Analytics technologies help us understand usage and performance.

Advertising technologies may measure or support marketing and advertising campaigns.

Where applicable law requires prior consent for non-essential cookies or similar technologies, we will not intentionally activate those technologies until the required consent has been obtained.

You may manage available privacy and cookie choices through the controls we provide.

Disabling optional technologies may affect some functionality.

11. Marketing

We may send marketing communications where permitted by law.

You can unsubscribe from marketing emails using the unsubscribe mechanism in the communication or available account settings.

Opting out of marketing does not prevent us from sending operational communications that are reasonably necessary to administer your account, including security, billing, Recovery Mode, deletion, delivery or legal notices.

12. Sale and sharing of personal information

Evaheld does not sell private Legacy Vault content for money.

We do not sell private:

health records;
Password Manager contents;
estate information;
uploaded Vault documents;
private messages; or
confidential Vault media

for advertising purposes.

Where analytics or advertising technologies are enabled, identifiers, device information and internet or activity information may be disclosed to service providers or advertising partners.

Under some privacy laws, including California law, certain advertising-related disclosures may constitute a "sale" or "sharing" even where no money is exchanged.

Where those laws apply, eligible users may exercise applicable opt-out rights.

Where required by law, we recognise applicable opt-out preference signals, including Global Privacy Control, for the processing to which the signal applies.

13. Who we disclose personal information to

We may disclose personal information to the following categories of recipients.

People you choose

This may include:

recipients;
Trusted Parties;
family members;
advisers;
carers;
emergency contacts; and
other people you authorise.

Service providers and processors

We may use providers supporting:

cloud infrastructure and hosting;
databases and storage;
media processing;
authentication;
cybersecurity;
payment processing;
email and communications;
customer support;
analytics and product insights;
marketing measurement;
AI-assisted functionality; and
other technical services.

These providers may process personal information only as appropriate to the function they perform, subject to applicable contractual and legal requirements.

Professional advisers

We may disclose information to lawyers, accountants, auditors, insurers or other professional advisers where reasonably necessary.

Legal and regulatory recipients

We may disclose information where reasonably necessary to:

comply with applicable law;
respond to valid legal process;
protect rights or safety;
investigate fraud, abuse or security incidents; or
establish, exercise or defend legal claims.

Corporate transactions

If Evaheld undergoes a lawful merger, acquisition, financing, restructuring or sale, relevant information may be disclosed or transferred subject to applicable privacy requirements.

14. We do not make your Vault public by default

Legacy Vault content is private unless:

you choose to share it;
you instruct Evaheld to deliver it;
you use functionality expressly intended to publish information;
an appropriately authorised person lawfully obtains access;
disclosure is required by law; or
another lawful basis permits disclosure.

Purchasing a Vault for someone else does not automatically give the purchaser access to that person's private Vault after activation.

Storage pooling does not give linked Vault owners access to one another's private content.

15. International processing and transfers

Evaheld is based in Australia and uses technology and service providers that may process personal information in other countries.

Depending on the Service and provider, personal information may be processed in:

Australia;
the United States;
the United Kingdom;
countries within the European Economic Area; and
other countries in which contracted service providers lawfully operate.

We manage international transfers and disclosures in accordance with applicable law.

For Australian personal information, we take reasonable steps required by applicable cross-border privacy obligations.

Where GDPR requires an international-transfer safeguard, we may rely on:

an adequacy decision;
approved Standard Contractual Clauses; or
another lawful transfer mechanism.

Where UK GDPR requires an international-transfer safeguard, we may rely on:

applicable UK adequacy regulations;
the International Data Transfer Agreement;
the UK Addendum to approved contractual clauses; or
another lawful transfer mechanism.

Privacy and data-protection laws in another country may differ from Australian law.

16. EU/EEA and UK representatives

Where Evaheld is required by Article 27 GDPR or UK GDPR to appoint a local representative, the appointed representative will act as a contact point for relevant individuals and supervisory authorities.

European Union / EEA Representative

\[Insert appointed representative's legal name\]
\[Address\]
\[Email / contact method\]

United Kingdom Representative

\[Insert appointed representative's legal name\]
\[Address\]
\[Email / contact method\]

If an applicable representative obligation does not apply to Evaheld, this section may be updated accordingly.

17. How long we retain personal information

We retain personal information only for as long as reasonably necessary to:

provide the applicable Service;
fulfil the purpose for which it was collected;
comply with legal requirements;
resolve disputes;
enforce agreements; or
protect legitimate legal interests.

Different categories of information have different retention periods.

Free Vaults

An actively used Free Vault may remain available indefinitely.

Where a Free Vault has had no meaningful account activity for more than 2 years, we may classify it as inactive or abandoned.

We will use reasonable efforts to provide advance notice before permanently deleting an inactive Free Vault.

Monthly and Annual Premium

Premium content remains actively stored while the applicable paid subscription remains current.

When a Monthly or Annual subscription expires, content outside the Free-plan entitlement enters a 12-week Recovery Mode.

During Recovery Mode, eligible content may be accessed for retrieval or downloaded.

Unless an eligible Premium plan is reactivated, content outside the Free entitlement may then be deleted or permanently rendered inaccessible.

Lifetime Vaults

Eligible Lifetime content may be retained throughout the Vault owner's lifetime and for the period required to perform valid future or posthumous delivery instructions.

Eligible instructions may be scheduled for delivery up to 30 years from the date on which the relevant delivery instruction is created or last validly updated.

After an eligible Lifetime content item has been successfully delivered, it is ordinarily retained for a further 12 weeks before removal from active storage, subject to legal requirements, genuine delivery disputes or other lawful exceptions.

Backups

Deletion from active systems does not necessarily result in instantaneous deletion from every protected backup.

Residual copies may remain temporarily until they are deleted, overwritten, placed beyond use or de-identified through documented backup-retention processes.

We take reasonable steps to destroy or de-identify personal information that we no longer lawfully require, including backup copies where applicable law requires this.

Legal and transactional records

Billing, tax, fraud-prevention, security, complaint and legal records may be retained for longer periods where required or permitted by law.

18. Security

We use technical and organisational measures designed to protect personal information against:

misuse;
interference;
loss;
unauthorised access;
unauthorised modification; and
unauthorised disclosure.

Depending on the information and system, these measures may include:

encryption;
access controls;
authentication;
logging and monitoring;
secure hosting;
restricted administrative access;
backup and disaster-recovery controls;
vendor-security requirements; and
incident-response processes.

No internet-connected system can guarantee absolute security.

Users should also take reasonable steps to protect their credentials, devices and authorised access arrangements.

19. Data breaches

Evaheld maintains processes for identifying, investigating and responding to suspected privacy and security incidents.

Where a breach triggers a legal notification obligation, we will notify affected individuals, regulators or other authorities as required by applicable law.

This may include obligations under:

Australia's Notifiable Data Breaches scheme;
GDPR;
UK data-protection law; and
applicable US federal or state law.

20. Your privacy rights

Depending on your location and the law that applies, you may have rights relating to:

information about our processing;
access to your personal information;
correction of inaccurate information;
deletion or erasure;
restriction of processing;
data portability;
objection to processing;
withdrawal of consent;
certain automated decisions;
opt-out of certain sale or sharing;
opt-out of targeted advertising;
limitation of certain uses of sensitive personal information;
appeals of certain privacy decisions; and
complaints to a regulator.

These rights may be subject to legal conditions and exceptions.

21. European Union, EEA and UK privacy rights

Where GDPR or UK GDPR applies, you may have rights including:

the right to be informed;
access;
rectification;
erasure;
restriction of processing;
data portability;
objection;
withdrawal of consent;
rights concerning certain automated decision-making; and
the right to complain to an applicable supervisory authority.

If processing is based on consent, withdrawal does not affect processing that was lawful before withdrawal.

Where processing is based on legitimate interests, you may have a right to object in applicable circumstances.

22. United States privacy rights

Residents of certain US states may have additional privacy rights.

Where applicable, these may include rights to:

know or access personal information;
obtain information about collection, use and disclosure;
correct inaccurate information;
delete personal information;
obtain portable information;
opt out of certain sales or sharing;
opt out of targeted advertising;
limit certain uses of sensitive personal information;
appeal certain privacy-request decisions; and
exercise privacy rights without unlawful discrimination.

California

Where the California Consumer Privacy Act applies to Evaheld, California residents may have applicable rights to:

know;
access;
correct;
delete;
obtain information about categories and disclosures;
opt out of sale or sharing;
limit certain uses of sensitive personal information; and
exercise those rights without unlawful discrimination.

Evaheld does not sell private Vault content for monetary consideration.

Advertising-related identifiers or activity information may nevertheless be disclosed in ways that qualify as "sharing" under California law where those technologies are enabled.

Where required, applicable users can exercise relevant choices through Your Privacy Choices or a legally recognised opt-out preference signal.

23. Australian privacy rights

Where the Privacy Act 1988 (Cth) applies, you may request access to and correction of personal information Evaheld holds about you.

You may also complain if you believe we have breached the Australian Privacy Principles.

Where Australian state or territory health-privacy legislation applies, additional rights may exist regarding health information.

24. Exercising your privacy rights

To exercise a privacy right, contact:

Privacy Officer
After I Go Pty Ltd trading as Evaheld
Email: [email protected]

608 Harris Street
Ultimo NSW 2007
Australia

Please identify the right you wish to exercise and provide enough information for us to understand your request.

We may need to verify your identity before providing access to sensitive information or acting on certain requests.

We will respond within the period required by applicable law.

Where applicable law requires an additional request method, we will provide it.

Authorised agents may make requests where applicable law permits and appropriate authority is established.

25. Advertising choices and opt-out preference signals

Where optional advertising or marketing technologies are used, you may be able to manage them through:

Evaheld's privacy or cookie controls;
browser or device controls;
advertising-provider settings;
unsubscribe mechanisms;
Your Privacy Choices; and
legally recognised opt-out preference signals.

Where applicable law requires recognition of an opt-out preference signal such as Global Privacy Control, we will honour that signal for the processing to which it applies.

Browser "Do Not Track" signals do not currently have one universal legal or technical meaning, and support may vary unless applicable law requires us to treat a particular signal as an enforceable privacy choice.

26. Children and young people

Evaheld is not intended to be independently purchased or operated by children who lack legal capacity to enter into the relevant contract.

Where a Vault is established for a child or young person, it should be established or managed by a parent, guardian or another appropriately authorised person where required.

We do not knowingly use children's private Vault information for targeted advertising.

If you believe personal information relating to a child has been collected or handled without appropriate authority, contact us at [email protected].

27. Information after death

Privacy laws differ in how they apply to deceased people.

Evaheld may continue to hold and process Legacy Vault information following a Vault owner's death where reasonably necessary to:

carry out valid scheduled or posthumous delivery instructions;
administer the Service;
verify authority;
resolve disputes;
protect legal rights; or
comply with applicable law.

Information about living people contained within a deceased person's Vault remains subject to applicable privacy protections.

Posthumous delivery and access are also governed by our Terms and Conditions.

28. Complaints

If you believe we have mishandled your personal information, contact:

Privacy Officer
[email protected]

Please provide enough information for us to understand and investigate the issue.

We will investigate privacy complaints and respond within the timeframe required by applicable law.

For Australian complaints, we generally aim to provide a substantive response within 30 days.

If you are not satisfied with our response, you may have a right to complain to an applicable regulator, including:

the Office of the Australian Information Commissioner (OAIC);
an applicable Australian state or territory health-privacy regulator;
the competent EU or EEA data-protection supervisory authority;
the UK Information Commissioner's Office;
the California Privacy Protection Agency or California Attorney General where applicable; or
another competent privacy authority.

29. Service providers and processors

We assess privacy and security considerations when engaging service providers that handle personal information on our behalf.

Depending on their role and applicable law, contractual arrangements may address matters including:

confidentiality;
permitted processing;
security;
breach notification;
deletion or return of information;
subprocessing; and
international transfers.

Our provider environment may change as Evaheld develops.

The use of infrastructure providers does not give those providers ownership of private Vault content.

30. Changes to this Privacy Policy

We may update this Privacy Policy to reflect changes in:

law or regulation;
our Services;
technology;
service providers;
security practices; or
our information-handling practices.

The current version will display its effective date.

Where a change is material, we will provide additional notice where reasonably appropriate or required by applicable law.

We will not use an updated Privacy Policy to retrospectively legitimise processing that was unlawful when it occurred.

31. Contact us

For privacy questions, requests or complaints:

Privacy Officer
After I Go Pty Ltd trading as Evaheld
ABN 80 656 838 505

608 Harris Street
Ultimo NSW 2007
Australia

Email: [email protected]