Privacy Policy

Who we are

EverPlan is operated by HyperianLabs (“HyperianLabs”, “we”, “us”). This policy explains what personal information we collect through EverPlan, why we collect it, how it's protected, and the rights you have over it under South Africa's Protection of Personal Information Act (POPIA).

Information we collect

What you provide directly, organized by how sensitive it is:

• Account information: name, date of birth, email, password (stored as a salted hash, never in plain text), and marital status/property regime.
• Estate-planning content: the assets, retirement benefits, life policy nominations, beneficiaries, guardianship designations, executor nominations, business interests, charitable bequests, and personal instructions you enter to build your plan.
• Especially sensitive fields: account/policy numbers and medical information (blood type, allergies, medications, conditions) are encrypted at the field level (AES-256-GCM) before storage — see Security below.
• Payment information: handled directly by Paystack, our payment processor — we never see or store your card details. We retain only the transaction record (amount, product, status, Paystack's reference).
• Security & technical information: sign-in history, approximate IP address, device/browser info, and a log of document downloads — used to alert you to activity on your account and to investigate suspicious access.

How we use it

To operate the service you've signed up for: building and generating your estate plan documents, granting the access you've configured to family members and executors, sending security alerts (new sign-in, password changed, document downloaded), processing payments, and providing support when you contact us.

We do not sell your personal information, and we do not use it for advertising.

How it's protected

• Row-level security ensures every query is scoped to your own account — there is no shared table another user's session can read from.
• Financial account/policy numbers and medical information are encrypted at the field level (AES-256-GCM) in addition to database-level protections. Most pages show a masked preview (e.g. “····4821”); the underlying value is only decrypted on your explicit request.
• Optional two-factor authentication (TOTP authenticator app) is available and recommended for every account.
• Every access grant to family members or executors is logged in an audit trail you can review at any time.

Who can access your information

By default, only you. You control everything beyond that:

• Family members you explicitly invite, at the access level you choose.
• Executors only through a two-tier verification process requiring supporting evidence (such as a death certificate or Letters of Executorship) before any access is granted — access itself does not confer legal authority to act as executor; that comes only from the Master of the High Court.
• HyperianLabs staff only when necessary to provide support you've requested, or to investigate a security issue.

Third parties who process data on our behalf

• Supabase — database hosting and authentication. Your data is stored on infrastructure in the EU (Ireland), meaning it is transferred outside South Africa in the course of normal operation. [Placeholder — counsel to confirm POPIA s72 cross-border transfer requirements are met and add the required safeguard language here.]
• Resend — delivery of transactional emails (security alerts, password resets). Sends your email address and the alert content only.
• Paystack — payment processing for subscriptions and one-time purchases. We never receive or store your card details.

How long we keep it

[Placeholder — counsel to set the final POPIA s14 retention/deletion period. Provisional anchor only: we currently intend to retain your data for as long as your account is active, and for approximately 3 years after account closure or confirmed death, pending final confirmation.]

Your rights

Under POPIA, you have the right to access the personal information we hold about you, request correction of inaccurate information, request deletion of your information (subject to any legal retention obligations), and object to certain processing. You can exercise most of these yourself directly in your account, or by contacting us.

[Placeholder — counsel to confirm and add: our appointed Information Officer, and the process for lodging a complaint with the Information Regulator of South Africa if you're unsatisfied with our response.]

Cookies & tracking

EverPlan currently uses only the essential cookies required to keep you signed in. We do not run third-party analytics or advertising trackers at this time; this section will be updated if that changes.

Age requirement

EverPlan is not available to anyone under 16, in line with the minimum age to make a valid will under South African law.

Changes to this policy

If this policy changes materially, we'll notify you by email before the change takes effect.

Contact

Questions about this policy or your data: everplan@hyperianlabs.com.