Who is responsible for your data
ClairHeritage is the controller of your personal data within the meaning of the General Data Protection Regulation (GDPR). For any question, write to privacy@clairheritage.com.
What data we collect
Your email address and your password (hashed) to identify you. The items you enter in your vault: titles, descriptions, estimated values, photos. The information you mark as confidential, encrypted before storage. The allocation preferences expressed by your heirs. Technical security logs, kept for thirty days.
Why we process it
To perform the service you ask of us (GDPR article 6.1.b): keeping your inventory, delivering your invitations, computing the sharing, producing your folder. To secure the service and prevent abuse (legitimate interest, article 6.1.f). We do no targeted advertising, no resale of data, and no training of artificial intelligence models on your data.
How long we keep it
For as long as your account exists. On account deletion, your data is erased within thirty days, backups included. Security logs are kept for thirty days. No data is retained for commercial purposes after deletion.
Who has access
You. The heirs you invite, only for the belongings you share. Our technical subprocessors, listed below, strictly as needed. Our teams access an account only at your explicit support request, and can never decrypt your confidential information.
Our subprocessors
Vercel (application hosting, United States and European Union). Supabase (database, authentication, storage, European Union). The model providers used by the assistant Claire, only for the text of your question: no data from your vault is sent to them. All transfers outside the European Union rely on the European Commission's standard contractual clauses.
Your rights
You have the right of access, rectification, erasure, restriction, objection and portability. Export and deletion are directly available from your settings, without having to write to us. You may lodge a complaint with the CNIL (France) or the supervisory authority of your country.
California and United States residents
Under the CCPA and CPRA, you may request to know the categories of data collected, obtain their deletion, and opt out of any sale or sharing. We do not sell or share your personal data within the meaning of those laws, so no opt-out request is necessary. We apply no price discrimination linked to the exercise of your rights.
United Kingdom and Switzerland
The UK GDPR and the Swiss FADP apply respectively to UK and Swiss residents, with rights equivalent to those described above. The same channels are open to exercise them.
Minors
The service is not intended for people under eighteen and we do not knowingly collect their data.
Changes
Any substantial change to this policy will be announced in the application at least thirty days before it takes effect.