Privacy policy

Appointed Executor: Your Step-by-Step Probate Plan (“we”) is a product of Code 418, Mariahof 3, 5056 SG Berkel-Enschot, the Netherlands, registered with the Dutch Chamber of Commerce under number 68957157. We are the data controller for personal data processed through executorsteps.com. Questions about this policy? Email [email protected].

We are established in the Netherlands and offer this service to people in the United Kingdom. Both the UK GDPR and the EU GDPR apply to how we handle your data, and we apply the same standard to everyone.

What we process, and why

Account and signing in

• Your email address, and your first name if you give it. We do not use passwords — you sign in through a one-time link sent to your email, so we store short-lived sign-in tokens and a session record instead. Lawful basis: performance of the contract.

Payments

• Payments are handled by Paddle.com Market Ltd, our merchant of record. Paddle collects your payment and billing details directly and acts as its own data controller for them; we receive your payment status and a payment reference, never your full card or bank details. Lawful basis: performance of the contract, and legal (tax) obligations.

Your progress

• Which steps and check questions you have completed, and your checkpoint results — needed for the product to work (tracking where you are, not repeating questions you have already seen). Lawful basis: performance of the contract.

The practice area

• Prompts you enter in the practice area are sent, in order to generate an answer, via OpenRouter (United States), which routes your question to three models: Anthropic (Claude), OpenAI (ChatGPT) and Google (Gemini), all in the United States. Your conversations are stored in your account so you can return to them. Please never include sensitive details in the practice area — medical, financial, legal or login information. It is not needed for the exercises, and you remain responsible for checking anything an AI tells you. Lawful basis: performance of the contract.
• We record how much of your practice credit you have used, to limit abuse and cost. Lawful basis: legitimate interests.

Reviews

• If you submit a review, we store what you wrote and your first name. We only publish it if you tick the box giving us permission, and you can withdraw that at any time by emailing us. Lawful basis: consent.

How you found us

• If you arrive through an advert or a link, we store the campaign parameters in the address (utm_source, utm_medium, utm_content), the referring website and the page you landed on, so we can tell which channels are worth continuing. This is linked to your account once you create one. Lawful basis: legitimate interests.

Email

• Account emails (sign-in links, purchase confirmations) are sent via Scaleway. Lawful basis: performance of the contract.
• Marketing emails are only sent with your prior consent, and every one contains an unsubscribe link. Lawful basis: consent.

Technical and security

• We use IP addresses and technical logs briefly, for security and to limit abuse (rate limiting). Lawful basis: legitimate interests.
• Analytics and marketing only run after you agree through the cookie banner — see the cookie policy. Lawful basis: consent.

Advertising measurement (only if you agree)

If, and only if, you accept marketing cookies, we measure whether our adverts lead to purchases. This involves sending data to Meta (United States) and Google:

• In your browser: the Meta pixel and the Google Ads tag, which set and read their own cookies.
• From our server to Meta: a one-way (hashed) version of your email address, your IP address, your browser's user agent, and Meta's own click identifiers (_fbp and _fbc) if present. Hashing means Meta cannot read your address directly, but this is still personal data.

If you do not accept marketing cookies, none of this happens: the browser tags do not load and our server does not send anything. Google runs in its restricted “consent denied” mode by default.

Who we share data with

• Our own database, on a server in the Netherlands — account details, progress and conversations.
• Paddle — payment processing and merchant of record.
• OpenRouter (US) — routes your practice prompt to the AI models.
• Anthropic (US), OpenAI (US) and Google (US) — generate the answers in the practice area.
• Scaleway (FR) — email delivery.
• Cloudflare — security, CDN and DNS.
• Umami — visitor statistics, running on our own server, only with your consent.
• Meta (US) and Google — advertising measurement, only with your consent, as described above.

We never sell personal data. Where data goes to a country outside the UK or the EEA, we rely on an approved transfer mechanism — standard contractual clauses together with the UK International Data Transfer Addendum, or an adequacy decision where one applies.

How long we keep data

• Account details, progress and conversations: for as long as your account exists. After you delete it, we erase them within 30 days.
• Purchase and invoice records: 7 years, which is the retention period Dutch tax law requires of us as a Dutch business. Where Paddle is the merchant of record, Paddle issues your invoice and keeps its own records under its policy.
• Technical logs: 30 days at most.

Your rights

You have the right to access your data, to have it corrected or erased, to restrict or object to processing, and to receive it in a portable form. Where we rely on consent, you can withdraw it at any time; that does not affect anything done before you withdrew it. Email [email protected] and we will respond within one month.

If you are unhappy with how we have handled your data, you can complain to a supervisory authority. In the UK that is the Information Commissioner's Office (ICO), ico.org.uk. In the Netherlands, where we are established, it is the Autoriteit Persoonsgegevens.

Security

Traffic to this site is encrypted. Sign-in links are single-use and short-lived. Access to the database is restricted to what is needed to run the service.

Changes

If we change this policy we will update the date at the top. Material changes will be announced on the site or by email.