Privacy Notice

Our Privacy Officer

We have a designated person accountable for privacy at Eldridge Path. You can reach them at privacy@eldridgepath.com with any question, request, or complaint about how your information is handled.

What we collect and why

• Account details — name, email address, password credentials, and two-factor authentication data. Used to create and secure your account.
• Household and planning information — household members and relationships, home value and mortgage details, beneficiaries, executors, funeral wishes, inventories, checklists, notify contacts, family decisions, and uploaded documents. Used to provide the service to you and the people you invite.
• Conversations with the AI guide — the messages you send and the responses generated, so the guide can answer you in context.
• Support messages, invitations, and reminder emails — used to answer you, deliver household invitations, and send the nudges you opt into.
• Technical and usage data — IP address, device and browser information, log and error data. Used for security, fraud prevention, troubleshooting, and improving the product.

We collect only what is needed for these purposes. If we ever want to use your information for a new purpose, we will ask you first. Payment card details are collected and processed by Paddle, not by us — we never see or store your card number.

Consent and withdrawing it

You consent to the uses above by creating an account and entering information. Sensitive details — health, funeral, and estate information — are only collected when you choose to enter them. You can withdraw consent at any time by deleting the information, turning off reminders, or closing your account, subject to legal and contractual limits. Withdrawing consent for core processing means we can no longer provide the service.

Privacy by default

New households are private by default. Nothing is shared with another person until you invite them, and each person only sees what their role allows. Share links for your plan summary are off unless you create one, and you can revoke a link at any time. We do not use your information for advertising or profiling, and no decision affecting you is made by automated means alone.

Who we share it with

• People you invite — family members and executors you add to your household can see household information at the role you assign them.
• Service providers — hosting and database providers, our email delivery provider, and the AI model provider that powers the guide. They act on our instructions only, under contract.
• Paddle.com — our Merchant of Record, for the sale of subscriptions, payments, invoicing, subscription management, and tax compliance.
• Professional advisers — legal and accounting advisers, where reasonably necessary.
• Authorities — where we are required to disclose by law.

We do not sell your personal information, and we do not allow it to be used to train third-party AI models.

Storage outside Canada

Our hosting, database, email, and AI providers may store or process your information outside Canada, including in the United States and the European Union. While outside Canada, information may be accessible to foreign courts, law enforcement, and national security authorities under the laws of those countries. Before using a provider we assess the protection it offers and require contractual safeguards. To ask which providers we use, or where your data is held, email our Privacy Officer.

How long we keep it

We keep your information for as long as your account is active. If you close your account, we delete or anonymise your personal information within a reasonable period, except where we must keep records longer to meet legal, tax, or accounting obligations. Email delivery logs are kept for a short period for troubleshooting.

Your rights

You can access the information we hold about you, correct it, delete it, and get a portable copy — you can export your data and delete your account yourself from Settings at any time. You may also ask us to stop a particular use, withdraw consent, or explain how a decision was reached. We respond within 30 days.

In Quebec, Law 25 also gives you the right to ask that information be de-indexed or that its dissemination stop where the law allows.

To exercise any of these rights, email privacy@eldridgepath.com. If you are not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada, or to your provincial regulator — for example the Commission d'accès à l'information du Québec, or the Information and Privacy Commissioner in Alberta or British Columbia.

Security

We protect your information with technical, physical, and organisational safeguards appropriate to its sensitivity. These include encryption, strict access controls, and optional two-factor authentication on your account. We do not publish the details of our security measures, as doing so could weaken them; if you need assurance for a specific purpose, our Privacy Officer can respond to reasonable requests. No system is perfectly secure, but if a breach of security safeguards creates a real risk of significant harm we will notify you and the appropriate regulator as the law requires, and keep a record of the incident.

Cookies

We use essential cookies and similar browser storage to keep you signed in and to keep the service secure. These cannot be turned off without breaking sign-in. Our payment provider may set cookies necessary to complete checkout. We do not use advertising cookies. You can clear or block cookies in your browser settings, but parts of Eldridge will stop working if you block the essential ones.

If something goes wrong

We keep a written incident response process. If we suspect a confidentiality incident — unauthorised access, use, disclosure, or loss of personal information — we act on it immediately:

• Contain — we take reasonable steps to stop the incident and reduce the risk of further harm, including revoking sessions, share links, and credentials where needed.
• Assess — our Privacy Officer evaluates the sensitivity of the information and the likelihood it will be misused, to decide whether there is a real risk of serious injury.
• Notify — where that risk exists, we notify affected people and the Office of the Privacy Commissioner of Canada, and the Commission d'accès à l'information du Québec for Quebec residents, with reasonable promptness. Notices describe what happened, what information was involved, what we have done, and what you can do to protect yourself. We may also notify anyone able to reduce the risk of harm.
• Record — we keep a register of every confidentiality incident for at least 24 months and make it available to regulators on request.
• Learn — we review the cause and change our safeguards to prevent a repeat.

If you believe your account or your household's information has been compromised, email privacy@eldridgepath.com right away and revoke any active share links from Settings.

Retention clean-up

Revoked and expired share links are automatically deleted 30 days after they stop working, and invitations that are never accepted are deleted 90 days after they expire. We do not keep access tokens sitting in our database indefinitely.

Contact and changes

Questions, or a request about your data: privacy@eldridgepath.com. We may update this notice; material changes will be notified in the app or by email. See also our Terms & Conditions and Refund Policy. Cette politique est aussi offerte en français.