Privacy Policy

Cedar Wills is committed to protecting your personal information. This policy describes what we collect, how we use it, who we share it with, and the choices you have, in compliance with the federal Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws.

• Account information: email address, password (via our authentication provider, Clerk).
• Will draft information: the answers you enter into the wizard (names, addresses, family relationships, beneficiary information, executor information, asset descriptions). This data is encrypted at rest with AES-256-GCM.
• Generated documents: the DOCX/PDF files produced by the tool, stored in Cloudflare R2 with access via short-lived pre-signed URLs.
• Payment information: processed by Stripe. We do not store full card numbers. We retain the last 4 digits, brand, and expiry for reference.
• Usage data: anonymous analytics events, IP address, browser, device, and pages visited. Used to improve the product and detect fraud.

• To provide the will-template service and generate your documents.
• To process payments and manage your subscription/entitlements.
• To send service emails (account confirmation, document ready, password reset).
• To respond to support inquiries.
• To improve the product, fix bugs, and detect abuse.
• To comply with legal obligations.

We do not sell your personal information. We do not use your draft contents for marketing or third-party data sharing.

• Will draft answers are encrypted at rest with AES-256-GCM.
• All data in transit is protected by TLS 1.2 or higher.
• Generated documents are stored in private R2 buckets and accessible only via short-lived pre-signed URLs scoped to the document owner.
• Server logs are scrubbed of personal identifiers (names, emails, addresses) before storage.
• Access to production systems is limited to authorized engineers with two-factor authentication.

We rely on the following service providers, each contractually bound to handle data appropriately:

• Clerk — authentication and identity management.
• Stripe — payment processing.
• Cloudflare R2 — encrypted document storage.
• Hostinger VPS — application hosting (Canadian/EU region depending on plan).
• Sentry — error monitoring (PII-scrubbed).
• Mailgun — transactional email delivery.

• Access: request a copy of the personal information we hold about you.
• Correction: ask us to correct inaccurate information.
• Deletion: request deletion of your account and associated data. You can initiate this from your account settings. Soft-deleted accounts are hard-deleted after a 30-day grace period; after hard deletion, we cannot recover your information. Some data (e.g. transaction records required for tax compliance) may be retained for the periods required by law.
• Withdraw consent: for non-essential processing (e.g. marketing emails) at any time.
• Complaint: you have the right to complain to the Office of the Privacy Commissioner of Canada at priv.gc.ca.

• Active account: data retained as long as your account is active.
• After account deletion request: 30-day grace period (allows recovery if deletion was accidental), then permanent hard delete of drafts, generated documents, audit logs, and account record.
• Transaction records (invoices, refund logs): retained for 7 years as required by Canadian tax law.
• Server logs: 90 days, then aggregated or deleted.

We use essential cookies for authentication and a small number of analytics cookies for product improvement. We do not use advertising cookies. You can disable non-essential cookies in your browser without breaking the core functionality.

The service is not intended for users under 18 years of age. We do not knowingly collect information from minors. If you believe a minor has provided us with personal information, please contact us so we can delete it.

We may update this policy from time to time. Material changes will be communicated by email to registered users at least 14 days before they take effect.

For privacy questions or to exercise your rights, contact us at privacy@cedarwills.ca.