Privacy Policy

Legacy Locker holds your family's most private papers, so this policy explains in plain words what we collect, why, where it is kept and who can see it. We have written it to be read, not skimmed, and we have avoided legal jargon wherever we could.

In this policy, "we", "us" and "our" mean Legacy Locker Pty Ltd, trading as Legacy Locker. "You" means the person using Legacy Locker, whether as a family member or as a professional such as an estate lawyer or accountant.

This policy covers the Legacy Locker website at legacylocker.me, the Legacy Locker application (the locker itself, the Executor's Ledger, the Estate Discovery Agent and the Estate Readiness Score), and any email, phone or in-person contact you have with us.

We handle your personal information in line with the Privacy Act 1988 (Commonwealth) and the 13 Australian Privacy Principles, and we have chosen to do so whether or not the law requires it of a business our size. Where this policy promises more than the law asks, the promise still stands.

This policy was last updated on 5 November 2026 (version 1.1). The current version is always at legacylocker.me/privacy.

If you read nothing else, read this. Every line here is explained in full further down.

• Your documents belong to you. We never sell them, rent them, or use them for advertising.
• Your documents are stored encrypted, with a separate key for your account.
• Your documents are read by private software running on our own servers. We never send them to public artificial intelligence (AI) services such as ChatGPT, and nothing we use learns from your papers.
• Nobody sees your locker unless you choose to share it. Our own staff cannot browse it, and any access by us for support is logged and visible to you.
• You can download everything in your locker at any time as one organised file, and you can close your account at any time. Nothing you put in is ever destroyed, so a document you delete or a locker you close can be brought back for you on request.
• We will not contact your bank, super fund, insurer or anyone else about your affairs without your clear say-so.
• If something goes wrong with your information, we will tell you.
• You can ask us what we hold about you, ask us to fix it, or complain, by emailing privacy@legacylocker.me.

We collect only what we need to run your locker, keep it safe, and bill you for it. The table below lists each kind of information, with examples.

Sensitive information

Some of what you put in your locker is "sensitive information" under Australian privacy law. This can include health information (for example, in an advance health directive or a medical power of attorney), details of your religion (for example, funeral wishes), or your membership of a professional or trade association. We collect this only because it is in the documents you choose to store, and only with your consent, which you give by uploading the document. We use sensitive information for no other purpose than filing it and showing it back to you and the people you authorise.

Identity documents

Passports, driver's licences, birth certificates, Medicare cards and similar documents are stored so that an executor can find them when needed. We do not use them to verify your identity, and we do not pass them to any identity-checking service. Please see section 13 on tax file numbers.

Almost everything we hold comes straight from you. We collect information in these ways:

1. When you sign up and manage your account. You give us your name, email address, mobile number and payment details.
2. When you upload documents. You take a photo, scan a paper, or upload a file (PDF, Word, Excel or an image). The locker reads it and files it.
3. When you forward emails. You can send emails to your locker's private email address, or set up a standing rule in your own email so that regular statements (for example, from your super fund or bank) are forwarded automatically. We receive whatever you forward, including attachments.
4. When you answer questions. The locker asks you about things it cannot work out from the papers alone.
5. Automatically, when you use the service. Our systems record sign-ins, the pages you visit and technical details about your device. Section 14 explains cookies.
6. From a professional acting for you. If your lawyer or accountant sets up a locker on your behalf, they give us your details and your documents. They are responsible for having your permission to do so.
7. From a family member. A family member you have authorised may add documents or answer questions about the estate.

We do not buy information about you, and we do not collect information about you from data brokers, social media or public registers to add to your locker. If a feature is ever added that looks something up on your behalf (for example, a share registry search), it will be something you ask for each time, and we will update this policy first.

We use your information to run your locker and for nothing that would surprise you. In particular, we use it to:

• Create and run your account, sign you in, and keep your account secure.
• File your documents into the right drawers and read the details out of them.
• Build and keep up to date your Executor's Ledger, the list of what exists and where it is, with the document behind each line.
• Work out your Estate Readiness Score and show you what would lift it.
• Remind you about dates that matter, such as a policy renewal or a nomination that is about to run out.
• Answer the questions you ask about your own documents, with the source shown.
• Send you a regular personalised email summary of your locker, if you have chosen to receive one.
• Produce statements of assets and liabilities as at any date you choose.
• Take your payments, send receipts, and manage your subscription.
• Reply to you when you contact us, and help you if something is not working.
• Keep the service safe, detect misuse and investigate security incidents.
• Understand, in a general way, which features are used and where people get stuck, so we can improve the service.
• Meet our legal obligations, for example keeping tax and accounting records, or responding to a lawful request from a court or regulator.

What we never do

• We never sell, rent or trade your personal information or your documents.
• We never use your documents or the details in them for advertising, or to build a profile of you to sell to anyone.
• We never use your documents to train or improve any artificial intelligence model, ours or anyone else's.
• We never send marketing to you on behalf of other companies.
• We never contact your bank, super fund, insurer, share registry, lawyer or any other third party about your affairs, unless you ask us to in writing for a specific purpose.
• We never give or sell lists of our customers to anyone.

Marketing from us

We may email you about Legacy Locker itself, for example new features, changes to pricing, or tips on getting more from your locker. Every such email has an unsubscribe link, and you can also turn these emails off in your account settings. Emails we must send to run your account (receipts, security alerts, changes to this policy) cannot be turned off while your account is open.

Legacy Locker reads your documents with software so that nobody has to type anything in. This is the part of the service people ask about most, so here is exactly how it works.

Where the reading happens. When you upload a document, it is encrypted straight away. To file it, the locker opens it on our own servers, where private document-reading software reads it, picks out the details, and writes those details into your ledger. The document is then closed and stays encrypted.

What software is used. The reading is done by artificial intelligence (AI) software that runs privately for Legacy Locker. Your documents are never sent to public AI services such as ChatGPT, Gemini, Copilot or Claude, and never to any service that could keep a copy or learn from them. If we ever use a third-party AI provider, it will be one bound by a written contract that forbids keeping or learning from your data, and we will name it in this policy before we start.

What is kept. The software keeps nothing after reading. Only the details written into your ledger remain, and each of those shows the document it came from, so you can check it. Anything the software was unsure about is marked as uncertain rather than guessed.

Answering your questions. When you ask the locker a question (for example, "What is the excess on the house insurance?"), the same private software looks through your own documents and answers with the source quoted. It never looks anywhere other than your locker.

Decisions made by software

Some things in Legacy Locker are worked out by software with no person involved: the drawer a document is filed into, the lines added to your Executor's Ledger, the dates you are reminded about, and your Estate Readiness Score. None of these decisions has any legal effect on you, changes any right you have, or is passed to anyone outside your locker. Each one can be checked, because every line and every point of the score shows the document, answer or date it came from, and you can correct any of them yourself.

Legacy Locker does not make, and will not make, any automated decision about you that significantly affects your rights or interests, such as whether to accept you as a customer or what price to charge you. If that ever changed, we would tell you in this policy first.

A locker belongs to its owner. Nothing in your locker is shown to anyone else unless you choose to share it.

Our staff. Our staff cannot browse your locker or read your documents in the ordinary course of their work. In two situations a named, authorised member of our team may need to look at part of your locker: when you ask us for help with a specific problem and agree to it, or when we are investigating a security incident. Every such access is recorded in your locker's activity log, which you can read at any time, and is limited to what is needed to fix the problem.

Family sharing. You can invite named family members to see all or part of your locker, and you can take the invitation away again at any time. Before you invite someone, we show you exactly what they will be able to see and do, and every action they take appears in the activity log.

Handing over to an executor. You can name the person or firm who should receive your Executor's Ledger and documents when the time comes, and set the conditions for that handover. Until those conditions are met, that person sees nothing. The handover rules, including how we confirm that the conditions have been met, are set out in the handover settings inside your locker and in our terms and conditions at legacylocker.me/terms, and we will tell you before we change them.

Professional accounts. If a lawyer, accountant or other professional organises your papers in Legacy Locker, they can see the locker they manage for you. Their access is governed by their agreement with you and by their own professional and legal duties. We ask every professional to confirm they have your permission before they create a locker in your name.

Information about other people. Your documents will name other people: a spouse, children, beneficiaries, an executor, an attorney. We hold their details only as part of your locker, we do not contact them, and we do not use their details for any other purpose. If you are putting someone else's documents into a locker, please make sure you are entitled to do so.

We share your information only with the companies that help us run Legacy Locker, and only as much as each needs to do its job. None of them may use your information for their own purposes.

We will keep this table up to date. If we change a provider, or add one, we will update this policy.

Other times we may share

• With people you authorise. Family members or professionals you have chosen to share with (section 7).
• With our professional advisers. Our lawyers, accountants, auditors and security assessors, who are bound by confidentiality. They see your information only when needed for their work, for example a security audit.
• When the law requires it. If a court, regulator or law enforcement agency requires us to hand over information, and we are satisfied the request is lawful, we will comply. Unless the law forbids it, we will tell you.
• To protect people. If we reasonably believe sharing is needed to prevent a serious threat to someone's life, health or safety.
• If the business changes hands. If Legacy Locker is sold or merges with another company, your information will pass to the new owner only on terms at least as protective as this policy. We will tell you before that happens and give you time to download your locker and close your account if you wish.

We do not share your information with anyone else, and we do not share it for any other reason.

Your documents and your ledger are stored, read and backed up only by our hosting provider in section 8, always encrypted. For security, we don't publish where. We will not move your documents to another provider or place without changing this policy first and telling you.

Some of the companies that help us run the service, such as our payment or email provider, may process a small amount of your information overseas. This is limited to the details listed in section 8 for each provider, and never includes your documents or the details read from them. Where a provider is overseas, we choose providers that are bound by privacy laws at least as strong as Australia's, or we put a written contract in place requiring them to protect your information in line with the Australian Privacy Principles. We will name each overseas provider and the countries involved in section 8.

If you open your locker while travelling, your documents stay where they are stored. Only the pages you look at travel to your screen, over an encrypted connection.

Security is the reason Legacy Locker exists, so this section is longer than it would be in most privacy policies.

Encrypted from the moment it arrives. Every document is encrypted on its way to us and while it is stored. Your account has its own encryption key that no other account shares. The keys are stored separately from the documents, so that someone who got hold of the storage alone could not read what is in it.

Opened only to be read. A document is decrypted only on our own servers, only for as long as it takes to read it or show it to you, and only when you or software acting for you asks for it.

A password alone never opens your locker. Every account uses two-factor sign-in. To open your locker you need your password and a second check, such as a code sent to your mobile or an authenticator app. We will never ask you for your password by email or phone.

Everything that happens in your locker is written down. Your activity log records every sign-in, every document added, every document deleted, every change, every export, and every time a member of our staff accesses your locker and why. You can read the log at any time, and it cannot be edited or deleted, by you or by us.

Limited staff access. Only named staff can access the systems that run Legacy Locker, each with their own login and two-factor sign-in. Access to any customer's locker is granted for a specific reason, for a limited time, and is logged.

Tested and checked. We test our systems for weaknesses, we apply security updates promptly, and we have independent security specialists review our systems. Legacy Locker is designed to meet the ISO 27001 information security standard, and we are working towards formal certification. When we achieve it, we will say so here.

Backups. Your locker is backed up so that a hardware failure cannot lose your documents. Backups are encrypted.

No system is perfect. Nobody can promise that information will never be lost, stolen or misused. What we can promise is that we take every reasonable step to prevent it, and that we are honest with you if it happens.

If something goes wrong

If we become aware of a data breach that is likely to result in serious harm to you, we will tell you as soon as we reasonably can, explain what happened, what information was involved, and what you can do. We will also notify the Office of the Australian Information Commissioner, as the Notifiable Data Breaches scheme requires. We will do this whether or not the law requires it of us at the time.

What you can do

Keep your password private and do not reuse it on other websites. Keep your mobile number up to date so your second sign-in check reaches you. Sign out when using a shared computer. If you think someone else has got into your locker, change your password and contact us straight away.

Nothing you put in your locker is destroyed. When you delete a document it leaves your locker and your ledger, but an encrypted copy stays in storage. A locker whose subscription runs out, or that is closed, is archived rather than deleted. We do this because estate papers have a way of mattering years after someone thought they were finished with them, and a hidden document can be the one that settles a question. Here is what happens in each situation.

Alongside an archived locker we keep:

• Your name, email address and the dates your account was open, so that we can identify you if you ask for the locker back, and so that a closed account cannot be impersonated.
• The activity log, so that there is a record of everything that happened to the locker, including who asked for it back and when.
• Anonymous usage statistics that cannot be linked back to you.

Because nothing is destroyed, there is no moment at which a mistake becomes permanent. The price of that is that we hold your papers for a long time, which is why everything in section 10 applies to archived lockers and deleted documents exactly as it does to live ones.

It is your information, and you stay in control of it. You can do most of these things yourself inside your locker, and we will help with the rest.

See what we hold. Everything we hold about you is visible in your locker and your account settings. If you want a full copy of what we hold, including the activity log and account records, email privacy@legacylocker.me and we will provide it within 30 days, free of charge. We may ask you to confirm your identity first, because we must not hand your information to the wrong person.

Correct it. You can change your account details yourself. You can correct any line in your ledger, and the correction will show that it was made by you. If you think we hold something about you that is wrong, tell us and we will fix it or explain why we think it is right.

Download everything. At any time you can download your whole locker as one organised file (a zip file) with every document and your ledger laid out in folders. You own it, and you can take it with you.

Delete it, or close your account. You can delete any document from your locker yourself, and the deletion is recorded in your activity log. You can close your account from your account settings. Section 11 explains that an encrypted copy of a deleted document, and a closed locker, stay in storage rather than being destroyed, and how they can be brought back on request.

Turn marketing off. Use the unsubscribe link in any marketing email, or turn marketing off in your settings.

Choose what you upload. You decide which documents go into your locker. If you do not want a document read, do not upload it. You can also ask us not to collect a particular kind of information, and we will tell you honestly if that means part of the service will not work.

Withdraw consent. Where we rely on your consent, for example to hold sensitive information that is in your documents, you can withdraw it at any time by deleting the document or closing your account. From then on the document is not read, shown or used for anything, though an encrypted copy stays in storage as section 11 explains.

Use a different name. The law lets you deal with us anonymously or under a different name where that is practical. Because a locker is tied to a real family's affairs and to a paid subscription, we cannot run a locker for a person we cannot identify. You can, however, ask us general questions about the service without giving your name.

Complain. Section 16 explains how.

We will never charge you for exercising any of these rights, and we will never treat you differently for doing so.

Many of the documents you store, such as tax returns, superannuation statements and share holding statements, show a tax file number (TFN). Tax file numbers are protected by their own rules under Australian law, on top of the Privacy Act.

We do not ask you for your tax file number, we do not record it as a separate field, and we do not use it to identify you or to look anything up. Where it appears inside a document you have stored, it stays inside that document, encrypted, and is shown only to you and the people you have authorised. We never pass a tax file number to anyone else.

The same applies to Medicare numbers, driver's licence numbers, passport numbers and Centrelink reference numbers. They are stored as part of your documents so an executor can find them, and for no other reason.

A cookie is a small file a website saves on your device to remember you. We use as few as we can.

Cookies we must use. When you sign in, a cookie keeps you signed in as you move between pages. It is deleted when you sign out or after a period of inactivity. Without it the locker cannot work.

Cookies that remember your choices. If you choose a setting such as larger text, a cookie remembers it so you do not have to choose it again.

Analytics. We use an analytics service to understand how the website and application are used, for example which pages people visit and where they give up. This tells us about pages and features, never about the contents of your locker. You can decline analytics cookies when you first visit the website, or in your account settings, and the service will work just the same.

No advertising cookies. We do not use advertising or tracking cookies, and we do not allow advertising networks or social media companies to place cookies on our site.

Our website may link to other websites, for example a super fund or a government service. Those sites have their own privacy policies, and we are not responsible for how they handle your information.

Legacy Locker is for adults. You must be 18 or over to open an account, and we do not knowingly collect information from anyone under 18 directly. Documents in a locker may of course mention children, for example as beneficiaries in a will, and we hold those details only as part of the owner's locker, as explained in section 7. If you believe a child has opened an account, please tell us and we will close it and delete the information.

If you have a concern. Email privacy@legacylocker.me. Tell us what happened and what you would like us to do. We will confirm we have received your complaint within five business days, look into it properly, and give you a written answer within 30 days. If it will take longer, we will tell you why and when to expect an answer.

If you are not satisfied. You can complain to the Office of the Australian Information Commissioner (OAIC), the national privacy regulator. You can do this at any time, but the OAIC usually asks that you give us a chance to resolve the matter first.

• Website: www.oaic.gov.au
• Phone: 1300 363 992
• Post: GPO Box 5288, Sydney NSW 2001

Changes to this policy. We will update this policy when the service changes, when the law changes, or when we find a clearer way to say something. Small changes, such as a new service provider or clearer wording, will be posted at legacylocker.me/privacy with a new date and version number. Any change that reduces your protection, or that lets us use your information in a new way, will be emailed to every account holder at least 30 days before it takes effect, and you can close your account and download your locker before then if you do not agree. Earlier versions are kept, and you can ask us for any of them.

Privacy questions, requests and complaints go to our privacy officer.

• Email: privacy@legacylocker.me

For help using your locker, use the help option inside the application or email info@legacylocker.me.

Legacy Locker Pty Ltd. Legacy Locker, Executor's Ledger, Estate Discovery Agent and Estate Readiness Score are trade marks of Legacy Locker Pty Ltd.