MyImprint Personal – Privacy Policy

Last updated: [DATE]

MyImprint Personal (“MyImprint”, “we”, “us”) is a digital legacy vault operated by Great-a-tude, Edenvale, Johannesburg, South Africa. This policy explains what personal information we collect, why we collect it, how we protect it, and your rights under the Protection of Personal Information Act, 2013 (POPIA).

1. Who is responsible for your information

The responsible party (as defined in POPIA) is:

Great-a-tude Tracey Bosch Edenvale, Johannesburg, South Africa Email: tracey@great-a-tude.co.za

2. What information we collect

Account information: your name, email address, and a password. We never store your actual password, only a secure cryptographic hash of it.

Vault contents: the information you choose to store in your vault. Depending on what you enter, this may include personal, medical, financial, legal, insurance, and account details, as well as documents and files you upload, and personal messages you record for loved ones.

Trusted contact (guardian) information: the name and email address of any trusted contacts you nominate to access your vault, along with the access PIN we generate for them (stored only as a secure hash).

Access records: we keep an audit log of significant events, such as when a trusted contact accesses your vault or downloads a file, so that you have a record of who accessed what and when.

Technical information: basic technical data such as IP addresses, used only for security purposes like limiting repeated failed login attempts.

3. Why we collect it (purpose)

We collect and process your information solely to:

• Provide the MyImprint vault service to you
• Verify your identity and secure your account
• Enable the trusted contact access you have set up
• Send you essential service emails (account verification, password resets, and access notifications)
• Protect the service against unauthorised access and abuse

We do not sell your information, use it for advertising, or share it with third parties for marketing.

4. How your information is protected

We take the security of your vault seriously:

• Vault contents and uploaded files are encrypted at rest using AES-256-GCM encryption before being written to the database
• The encryption key is stored separately from the database, so a database breach alone cannot expose your data
• Passwords and trusted contact PINs are stored only as bcrypt hashes and cannot be read by anyone, including us
• All connections to MyImprint are secured with HTTPS encryption in transit
• Access attempts are rate-limited to protect against password and PIN guessing
• Trusted contact access is recorded in an audit log visible to you

Please note that MyImprint uses server-side encryption. This means our systems hold the encryption key in order to display your vault to you and your trusted contacts. No system is completely immune to compromise, and you should exercise your own judgement about what you store.

5. Who can see your information

Your vault is visible only to:

• You, when signed in to your account
• Your nominated trusted contacts, only under the access conditions you have configured, and only after verifying their identity with their access PIN

We (the operators of MyImprint) do not access your vault contents in the ordinary course of business. Limited technical access may occur only where strictly necessary to maintain the service or where required by law.

6. Third-party service providers (operators)

We use a small number of reputable service providers to run MyImprint:

• Replit, Inc. hosts the application and its database. Data may be stored on servers located outside South Africa.
• Resend delivers our service emails (verification, password reset, and notification emails) from servers located in the European Union (Ireland).

These providers process information only on our instructions and are bound by their own security and confidentiality obligations. Because these servers are located outside South Africa, your information is transferred across borders to jurisdictions with data protection laws; we only use providers whose safeguards are consistent with the protection required by POPIA.

7. How long we keep your information

We keep your information for as long as your account is active, since the purpose of MyImprint is long-term safekeeping of your legacy information. If you delete information from your vault, it is removed from the live database. If you close your account, we will delete your account and vault data within a reasonable period, except where we are required by law to retain specific records.

8. Your rights under POPIA

You have the right to:

• Access the personal information we hold about you
• Correct any information that is inaccurate or out of date
• Delete your information or close your account
• Object to processing of your information
• Withdraw consent where processing is based on consent
• Lodge a complaint with the Information Regulator of South Africa

To exercise any of these rights, email us at tracey@great-a-tude.co.za. We will respond within a reasonable time and in accordance with POPIA.

The Information Regulator can be contacted at: Website: https://inforegulator.org.za Email: enquiries@inforegulator.org.za

9. Children

MyImprint is intended for use by adults (18 years and older). We do not knowingly collect personal information from children.

10. Changes to this policy

We may update this policy from time to time. The latest version will always be available within the app, and the date at the top shows when it was last revised. If we make material changes, we will notify you by email.

11. Contact us

If you have any questions about this policy or how your information is handled, contact:

Tracey Bosch, Great-a-tude tracey@great-a-tude.co.za