EU and UK data protection

Your data rights

What you can ask for, how to ask, and what we will do

Last updated: November 12, 2026

The GDPR gives you rights over the information we hold about you. This page says what they are in plain words, and what each one means for a service whose whole job is to pass information on after you die.

What you can ask for

A copy of everything

We will tell you what we hold, why, who it has been shared with and how long it will be kept. You can also export a readable copy yourself from your settings, straight away; the privacy policy says what that export leaves out.

A correction

Anything wrong, you can fix yourself or ask us to fix.

Deletion

Delete your account and everything in it from your settings. We hold it through a grace period so an impulse can be undone, then destroy it. The audit record that an account existed and was deleted survives.

Your data in a usable file

A structured export you can take somewhere else and read without us. It leaves out the records the service keeps to run and secure the account and what other people wrote, and only the encrypted ZIP format carries your uploaded files. The privacy policy has the details.

A pause

Ask us to stop processing while something is disputed. On this service that also pauses the check-in switch, so nothing is released while the dispute runs.

An objection

Object to anything we do on the basis of legitimate interests, and we will stop unless we can show a compelling reason not to.

Consent back

Analytics, marketing and AI are all consent-based and all reversible, with no effect on the rest of your account.

A complaint

To us first, if you will. And to your national data protection authority whenever you want, whether or not you came to us. In the United Kingdom that is the Information Commission.

What we rely on to process your data

The full table of purposes and legal bases is in the privacy policy. In summary: running your account and delivering what you left is contract; security, the audit trail and the delivery record are legitimate interests; analytics, marketing and AI are consent; tax records are legal obligation; passing on medical notes and care instructions at the moment of death can be vital interests.

If somebody named you

You may be in our records because a friend or a relative added you as a contact, a recipient or a trusted verifier. You did not sign up and you did not consent, and you still have every right above.

You can ask what we hold about you and who named you.
You can correct your details, which is worth doing: a wrong address means what was left for you never arrives.
You can ask to be removed entirely. We will do it. It also means that whatever that person left for you will not reach you, and we cannot tell them, because the whole point is that by then they are not there.
You can object to being contacted at all, and we will stop.

The rights of someone who has died

The GDPR does not apply to the personal data of the dead. Several countries have their own rules that do, and some give the next of kin rights of their own. Where national law gives your family a right, we follow it.

This is what we do in practice, regardless of which law applies. An executor or another personal representative of the estate can ask us to close the account and to confirm what was delivered. That confirmation is a log with the date and time of each delivery and the recipient's contact address only, never the contents, the text or the names of private files, and we give it only once we have a certified death certificate and the court's papers appointing them. They can stop a delivery that has not gone out yet only if the account holder allowed it in the setup, which is off unless the account holder turns it on, and we always follow a court order. We act once they have shown us proof of death, proof of who they are and the papers that give them that authority. A relative's request alone does not stop a delivery. We will not hand over box contents to somebody the account holder did not name for them, because that is the one promise the whole product rests on.

This is not a will

What you are reading is a record of what this person wrote down and asked to be passed on. It is a statement of their wishes, not a will and not a legal document, and by itself it does not change what anyone owns, owes or inherits. Anything that has to be settled goes through whoever is handling the estate.

How to make a request

Do it yourself

Most of it is in your settings and takes a minute:

Export a copy of your data: Settings, then Export
Correct your details: Settings, then Profile
Change notification and marketing preferences
Turn AI assistants off
Delete your account

Or write to us

Anything else, and anything on behalf of somebody who has died, goes to the privacy contact below. We answer within 30 days and we will tell you if we need longer and why. We will verify your identity first: a request to hand over or delete a box is exactly what an attacker would send.

None of this costs anything. We only charge for a request that is manifestly excessive or repeated, and we will say so before we do.

Who is responsible for your data: Humanful LLC
Registered address: 8 The Green, Suite R, Dover, DE 19901, United States
Governing law and courts: State of Delaware, USA
Privacy contact: [email protected]
Data Protection Officer: No Data Protection Officer has been appointed. Gentle Handover is run by a very small team and does not meet the conditions in Article 37 that make one compulsory. Privacy questions go to the contact address above and are answered by the person who runs the service.
EU representative (GDPR Article 27): No representative in the European Union has been appointed yet. If you are in the EU and you need one, write to the privacy contact above and say so; until a representative is named, your request is handled directly.
UK representative (UK GDPR Article 27): No representative in the United Kingdom has been appointed yet.
Supervisory authority: You may complain to us first, and to the data protection authority of the country you live in. The European Data Protection Board publishes the list of national authorities in the European Union and the European Economic Area. In the United Kingdom the regulator is the Information Commission.

Complaining to a regulator

You can complain to us, at the privacy contact on this page, and to the data protection authority of the country you live in, whether or not you have raised it with us first. In the European Union and the European Economic Area, the European Data Protection Board publishes the list of national authorities. In the United Kingdom the regulator is the Information Commission, which replaced the Information Commissioner's Office.

European Data Protection Board members

The Information Commission, the regulator in the United Kingdom