Privacy Policy

LegacyLists is operated by Testate Technologies Ltd (“we”, “us”, “our”), which is the data controller for the personal data described in this policy. We are registered in England & Wales, company number 17145634, with a registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom.

For any privacy question or to exercise your rights, contact us at richard@mediahq2.com.

Testate Technologies Ltd runs a family of related services: LegacyLists, MyFamilyInherits, InheritWills, AwkwardEstates. Where you have given consent, we may use a secured (hashed) identifier to recognise you across these brands for the advertising purpose described in section 6.

• Account details — your email, name and password (stored securely hashed by our authentication provider). Lawful basis: performance of our contract with you.
• Your collection — the items, photos, valuations, wishlists, listings and related content you add. Lawful basis: performance of our contract / our legitimate interests in providing the service.
• Waiting list — your email and whether you agreed to be contacted. Lawful basis: consent.
• Technical and security data — logs and error diagnostics used to keep the service working and secure. Lawful basis: our legitimate interests.

We use one essential cookie (ll_marketing_consent) to remember your cookie choice. With your consent, we also load the Meta Pixel, which sets Meta’s fbp and fbc cookies. No advertising or analytics technologies are loaded until you accept, and you can decline or change your mind at any time (see section 7).

We show contextually relevant third-party listings (e.g. eBay) and record — on our own servers, with no third-party tracking pixels — which placements you see and click. Affiliate links may earn us a commission; clicking one takes you to the retailer, which sets its own cookies.

We use trusted providers that process data only on our instructions to run the service: Supabase (hosting, database and authentication), Vercel (hosting), Resend (email delivery) and Sentry (error monitoring).

With your consent, we share a secured, hashed identifier — your email address hashed with SHA-256, never your email in the clear — together with Meta’s own fbp/fbc cookie identifiers, with Meta Platforms Ireland Ltd (Facebook and Instagram). Meta is a recipient of this data.

The purpose is to (a) measure sign-ups generated by our advertising and (b) match you to a “custom audience” so that we — and the brand family listed in section 2 — can show you, and people like you, more relevant ads on Meta’s platforms.

Lawful basis: consent. We share this data only if you accept the cookie banner. If you decline, nothing is sent to Meta.

• Choose Decline in the cookie banner, or clear the ll_marketing_consent cookie to be asked again.
• Click unsubscribe in any marketing email we send you.
• Email us at richard@mediahq2.com to withdraw consent or update your choices.

Withdrawing consent does not affect any processing we carried out before you withdrew it.

We keep personal data only as long as we need it for the purposes above, then delete or anonymise it. You can delete your account at any time, which removes your collection data.

You have the right to access, correct, delete, restrict and port your personal data, and to object to processing. You can withdraw consent at any time (section 7).

You also have the right to complain to the Information Commissioner’s Office (ico.org.uk), though we would welcome the chance to help you first. Contact us at richard@mediahq2.com.