Privacy Policy

Willful UK Ltd (“Willful”, “we”, “us”) is a company registered in England and Wales. We operate willful.uk — an online platform for creating legally valid wills with professional solicitor review.

We are the data controller for personal data collected through our service. We are applying for authorisation as an Alternative Business Structure (ABS) under the Legal Services Act 2007, regulated by the Solicitors Regulation Authority (SRA).

We collect the following categories of personal data:

• Identity data — full legal name, date of birth, address, nationality
• Contact data — email address, phone number
• Will data — beneficiaries, executors, guardians, estate information, funeral wishes, capacity statements
• Identity verification data (special category) — when you complete identity verification, we use Stripe Identity to process images of your identity document (UK passport or photocard driving licence) and a live selfie photograph. This constitutes biometric data and is classified as special category personal data under UK GDPR Article 9. See Section 5 for full details.
• Technical data — IP address, browser type, device identifiers, access logs
• Usage data — how you interact with the platform
• Payment data — processed by Stripe. We do not store card numbers.

We process your personal data on the following legal bases:

• Contract performance — to provide the will-writing service you have requested
• Legal obligation — to comply with anti-money laundering regulations, identity verification requirements, and our SRA obligations
• Legitimate interests — to prevent fraud, maintain platform security, and improve our service
• Consent — for marketing communications (you can withdraw at any time)
• Explicit consent (special category data) — for the processing of biometric data during identity verification. You provide explicit consent at the point of verification. You may withdraw this consent at any time by contacting privacy@willful.uk, though this may prevent us from completing your will.

We share data with the following third parties, all of whom are bound by appropriate data processing agreements:

• Supabase — database and authentication infrastructure (EU region)
• Vercel — hosting and content delivery (London region)
• Anthropic — AI drafting assistance (data is not used to train models)
• Stripe Identity — identity document and biometric verification (see Section 5)
• Stripe — payment processing
• Resend — transactional email
• CFH Docmail / Royal Mail — physical document dispatch where requested
• Our solicitors — for professional review of your will

We do not sell your personal data to any third party.

To comply with our legal and regulatory obligations, we require you to verify your identity before your will can be submitted for solicitor review.

We use Stripe Identity (provided by Stripe, Inc.) to perform this verification. The process involves:

• Capturing an image of your identity document (UK passport or photocard driving licence)
• Capturing a live selfie photograph to match against your document
• Automated comparison of document details against the information you have provided

What we receive: We receive a verification result (verified / not verified), the document type used, and a Stripe reference ID. We do not receive, process, or store raw biometric data or document images on our own systems.

What Stripe holds: Stripe retains verification data including document images and biometric data in accordance with their own privacy policy and applicable law. By default, Stripe retains this data for a limited period. You can request deletion directly from Stripe at stripe.com/privacy.

Legal basis: Processing of biometric data is based on your explicit consent (UK GDPR Article 9(2)(a)) given at the point of verification, and on compliance with legal obligations relating to identity verification under anti-money laundering legislation.

Your rights: You may withdraw consent for biometric processing at any time by contacting privacy@willful.uk. Withdrawal does not affect the lawfulness of processing already carried out. Note that withdrawing consent may mean we are unable to complete your will service.

Will documents are retained for a minimum of 7 years after your death or the last interaction with your account, in accordance with legal requirements and our SRA obligations.

Identity verification results (verified/not verified status and provider reference) are retained for the duration of your account and for 5 years after closure, in line with AML record-keeping requirements.

If you delete your account, we will erase your personal data within 30 days, except where retention is required by law (such as for anti-money laundering records — 5 years).

You have the following rights:

• Right of access — request a copy of your personal data
• Right to rectification — correct inaccurate data
• Right to erasure — “right to be forgotten” where legally permitted
• Right to restrict processing
• Right to data portability
• Right to object to processing based on legitimate interests
• Right to withdraw consent for special category data (including biometric verification)
• Rights related to automated decision-making

To exercise any of these rights, contact us at privacy@willful.uk. We will respond within 30 days.

You have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

We apply technical and organisational measures to protect your data, including AES-256 encryption at rest, TLS in transit, access controls, and audit logging of all data access. Our infrastructure undergoes regular security review.

We use strictly necessary cookies for session management. We do not use advertising or tracking cookies. Analytics cookies are only set with your consent.

Data Controller: Willful UK Ltd
Email: privacy@willful.uk