This Privacy Policy explains how SafeTech BV (“SafeTech“, “we“, “us“, “our“), registered at Witte Patersstraat 4, 1040 Etterbeek, Belgium, VAT/company number BE 0704.931.167, and its affiliate Safe Haven Tech PTE. LTD., collect, use, and protect personal data across the Inheriti ecosystem (together, the “Services“):
Access to any of these Services begins with a single SafeID Account: the common account you use to authenticate to SafeTech Services. Creating a SafeID Account does not by itself grant access to every product — your available features depend on the product you access, any Organisation your account is associated with, and any subscription, entitlement, or programme approval (e.g. approval to participate in the Inheriti® Reseller Program).
We apply the standard set out by the EU General Data Protection Regulation (GDPR) and Belgian data protection law across all Services worldwide, regardless of where a user is located, as our baseline standard of protection.
Contact for privacy matters: [email protected]
The following categories of personal data are collected, in some form, across the Inheriti product family, generally in connection with your SafeID Account. Product-specific detail is set out in Section 3.
This section describes the additional personal data we process in connection with specific products and services.
Inheriti® Consumer allows individuals (“Plan Owners”) to create protection plans for sensitive data, documents, credentials, digital assets, and other information. Depending on how a plan is configured, you may create:
A protection plan uses encryption and secret-sharing technology to divide protected data into separate shares, distributed according to the configuration the Plan Owner selects (which may include Plan shares held by Beneficiaries, Validator shares associated with the plan’s activation/verification process, and Recovery shares). The required shares must be recombined through the applicable recovery or merge process before the protected data can be accessed.
In addition to the data listed in Section 2, Inheriti® Consumer collects and processes:
Inheriti® Consumer includes self-service tools allowing you to request an export of your account data, and to deactivate, reactivate, or permanently delete your account, directly from the app (see also Section 10).
Inheriti® Business is provided through an Organisation Account and is built around encrypted Protection Plans of two types: Data Backup Plans, which preserve protected data for access on request by an authorised Member, and Business Continuity Plans, which support access when a defined continuity event occurs and may use an inactivity-based Dead Man Switch.
Within an Organisation, we process data about the following roles and their activity: Organisation Owners and Organisation Managers, together “Organisation Administrators”; Organisation Members; Team Members; Team Admins; and Plan Moderators. An Organisation Member may also create a Private Plan. Organisation Administrators can see that a Private Plan exists and can see associated plan metadata, but cannot access or view the protected data within the plan. They may take limited administrative actions, such as deleting a draft or destroying a completed plan, but cannot edit the plan’s protected content or start an access request for it.
During plan creation, the data supplied is encrypted using the SSDP+ protocol and divided into data shares. The SSDP+ key is divided into key shares using Shamir’s Secret Sharing. A unique symmetric Plan Key is created for each Protection Plan, wrapped using the Organisation Key, and sealed using the Organisation HSM Key inside a managed Hardware Security Module. The private key used for that operation never leaves the HSM. Each Protection Plan also includes a Custodian Share Pair consisting of a data share held in the custodian depot and a corresponding key share claimed by an authorised Member and stored on that Member’s SafeKey Mobile or SafeKey Pro device.
Encrypted validator key shares associated with certain Protection Plan operations are processed through InheritiChain, a permissioned distributed-ledger component. Encrypted data shares are stored in Inheriti® Vault and may also be copied to an Organisation-authorised backup Storage Layer, as described in Section 4.
We process the following data in connection with Inheriti® Business, in addition to the categories in Section 2:
Master and Plan Key material is protected using a Hardware Security Module and Inheriti® Vault. Account or Plan recovery is supported through the mechanisms described above and any applicable recovery-code process.
For Organisation Account processing, the Organisation generally acts as the controller for the personal data and Protection Plan content that it determines to upload, configure, access, retain, or otherwise use through Inheriti® Business. SafeTech generally acts as the Organisation’s processor for that data where SafeTech processes it to provide Inheriti® Business and related functionality on the Organisation’s documented instructions. This allocation applies only to the relevant data and processing activities. SafeTech may act as an independent controller for its own account, billing, support, security, compliance, fraud-prevention, and service-management processing. The role of an external Storage Layer provider is limited to the specific data elements and processing activities applicable to the Organisation’s authorised integration, as described in Section 4.
Inheriti® Partners is the SafeTech product and associated Partners Platform through which a “Partner” (a person or legal entity approved to participate in the Inheriti® Reseller Program) manages their participation in that programme. Access to Inheriti® Partners is granted to a SafeID Account once the account holder is approved to participate in the Reseller Program.
In addition to the data listed in Section 2, Inheriti® Partners collects and processes:
SafeTech may reject a Partner application or a proposed profile change, restrict Partners Platform access, or suspend or terminate Reseller Program participation, including for compliance, security, fraud, or payment-related reasons; related records are processed as described above.
SafeTech uses Stripe Connect as its designated payout service for Partner commission payments. Stripe processes Partner information to provide connected-account onboarding, identity and business verification, compliance checks, payment administration, and payouts. Stripe may process certain information as SafeTech’s service provider or processor and may process other information as an independent controller for purposes such as financial compliance, fraud prevention, security, legal obligations, and administration of Stripe accounts. Stripe’s processing is also subject to Stripe’s applicable terms and privacy notice.
In addition to SafeTech’s default storage infrastructure (Section 7), an Organisation using Inheriti® Business may activate and authorise an external, supported cloud-storage service as an additional storage layer for Plan share data (a “Storage Layer”). The Organisation selects and authorises the Storage Layer and is responsible for maintaining its own account, permissions, credentials, and settings with that provider.
Plan share data stored through a Storage Layer is handled by SafeTech as encrypted, opaque data: SafeTech does not possess the decryption capability and cannot access the underlying plaintext share. SafeTech does process metadata required to identify, locate, authenticate, retrieve, return, synchronise, and monitor an encrypted share through the Storage Layer — for example, identifiers, object locations, Plan/Organisation associations, timestamps, status information, access records, and technical connection information.
For Plan share data and associated metadata stored in or accessed through an Organisation-authorised Storage Layer: the Organisation determines the purposes for which the Storage Layer is used and is responsible for establishing the lawful basis and instructions for that processing. To the extent SafeTech processes that data solely to provide the Storage Layer and related Inheriti® Business functionality on the Organisation’s instructions, SafeTech acts as a processor on behalf of the Organisation.
The external cloud-storage provider is selected and authorised by the Organisation, not by SafeTech. Depending on the provider’s own services and terms, that provider may act as a processor for the Organisation in relation to Plan share data and/or as an independent controller for its own other processing (such as account administration, security, billing, legal compliance, or service analytics). The provider remains responsible for its own processing activities and sub-processors, and the Organisation remains responsible for assessing and authorising its chosen provider — SafeTech does not select or appoint that provider on the Organisation’s behalf and is not responsible for the provider’s independent processing.
Separately, individual users of Consumer and Business may connect Google, Microsoft, or Dropbox accounts for OAuth sign-in and, where selected, file import (see Section 7).
If your access to Inheriti® Business is provided through an Organisation (for example because your employer, financial institution, or law firm has an Organisation Account and has invited you to join), some of your personal data is visible to that Organisation, depending on role:
Invitation records, Team membership, role data, Protection Plan metadata, and full Protection Plan access history are visible to Organisation Administrators as described above. Access to Protection Plan content depends on the plan’s privacy setting and the applicable role-based permissions. Organisation Administrators do not have access to the protected content of Private Plans. Organisation Owners and Organisation Managers may also access organisation-level analytics, storage analytics, storage-layer operational details, and storage-layer logs, as applicable to their roles and the Organisation’s configuration.
The Services use strictly necessary cookies (e.g., session and authentication cookies) required for the Service to function, and, where applicable, analytics or support-widget cookies. You can control non-essential cookies through your browser or, where offered, an in-app cookie preference tool. Marketing communications are sent only with your consent and can be withdrawn at any time.
We share personal data with the following categories of processors and third parties, strictly to the extent necessary to operate the Services:
| Category | Provider | Used by |
|---|---|---|
| Cloud file storage | Amazon Web Services (AWS S3) | Consumer, Business, Partners |
| Identity & authentication | Keycloak (self-hosted, “SafeID”) | Consumer, Business, Partners |
| Payments | Stripe | Consumer, Business (subscription payments) |
| Partner commission payouts and connected-account onboarding | Stripe Connect | Partners |
| Mailgun | Consumer, Business, Partners | |
| SMS / OTP | Twilio, SMSAPI | Consumer, Business |
| Push notifications | Firebase Cloud Messaging | Consumer, Business (mobile app) |
| Customer support | Chatwoot | Consumer, Business, Partners |
| Key management | Hardware Security Module (HSM); Inheriti® Vault (self-hosted) | Business; comparable secret-sharing logic is built into Consumer directly |
| Distributed ledger | InheritiChain (permissioned distributed ledger) | Business (validator key shares) |
| Blockchain / wallet infrastructure | Venly (Business); VeChain, Ethereum, Optimism networks (Consumer); on-chain smart-contract storage option (Consumer) | Consumer, Business |
| Location / fraud prevention | MaxMind GeoIP | Consumer, Business, Partners |
| Social/OAuth login | Google, Microsoft, Dropbox | Consumer, Business |
For Partner commission payouts, SafeTech shares with Stripe Connect the information necessary to create and administer a Partner’s connected account, conduct identity, business, tax, fraud, sanctions, and other compliance checks, calculate or reconcile commission amounts, and execute and monitor payouts. The information shared may include the Partner’s name, contact details, legal-entity information, address, country, tax information, verification information, Stripe connected-account identifier, commission and payout amounts, currency, payout status, and related technical or payment-service information.
Stripe Connect may collect bank-account, debit-card, identity-document, and other sensitive payout information directly from the Partner through Stripe Connect onboarding. SafeTech does not intentionally collect or store full bank-account or card details obtained directly by Stripe Connect. SafeTech may receive and retain limited information necessary to administer the Partner relationship and payouts, such as connected-account identifiers, onboarding and verification status, payout dates, amounts, currency, failure or rejection reasons, and limited masked or tokenised payment information.
Stripe may act as a processor or service provider for processing carried out on SafeTech’s instructions and may act as an independent controller for processing for which Stripe determines its own purposes and means, including financial compliance, fraud prevention, security, legal obligations, and administration of Stripe accounts. Stripe may use its own service providers and subprocessors in accordance with its applicable terms and privacy notice. SafeTech does not determine or control Stripe’s independent processing activities, but remains responsible for its own selection of, instructions to, and disclosures concerning Stripe in connection with the Services.
Personal data may also be shared internally between Inheriti services operated by SafeTech, for example where a SafeID Account is used across Consumer, Business, and Partners. SafeTech determines its role separately for each processing activity: it may act as a controller for SafeID Account administration, account security, support, fraud prevention, compliance, and service management, and as a processor where it processes Organisation-controlled data on an Organisation’s documented instructions.
We do not sell personal data. We may disclose personal data where required by law, to enforce our Terms of Service, or to protect the rights, property, or safety of SafeTech, our users, or others.
Some of the providers listed in Section 7 may process data outside the European Economic Area (EEA), including in the United States. Where this occurs, we rely on appropriate safeguards recognised under GDPR, such as the European Commission’s Standard Contractual Clauses, or the provider’s certification under an approved transfer framework.
Subject to applicable law, you have the right to: access the personal data we hold about you; request rectification of inaccurate data; request erasure (“right to be forgotten”); request restriction of processing; object to processing based on legitimate interest or for direct marketing; request data portability; and withdraw consent at any time where processing is based on consent.
For Inheriti® Consumer and Business, many of these rights can be exercised directly within the Service: you can request an export of your data and delete, deactivate, or reactivate your account from your account settings. For Inheriti® Partners, you can maintain your Partner profile and payout information directly through the Partners Platform. For any other request, or if you are a Beneficiary, Heir, Partner Client, or other end-user without a direct SafeID Account, contact [email protected]. We will respond within the timeframes required by GDPR (generally one month).
You also have the right to lodge a complaint with a supervisory authority. In Belgium, this is the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données), Drukpersstraat 35, 1000 Brussels, www.dataprotectionauthority.be. If you reside in another EU/EEA member state, you may also lodge a complaint with your local supervisory authority.
The Services are intended for individuals who are at least 18 years old; we rely on self-declaration and do not independently verify age.
SafeTech BV: Witte Patersstraat 4, 1040 Etterbeek, Belgium
Email: [email protected]
Nederlands 
Français 
Español 
Deutsch