Privacy Policy

Last updated: July 8, 2026

1. Introduction

Perpetua (“we,” “us,” or “our”) ”) provides services designed to assist authorized individuals and representatives in identifying, preserving, administering, or otherwise managing digital assets, online accounts, digital footprints, and other information relating to deceased individuals (“Legacy Data”).

This Privacy Policy describes how we collect, access, use, disclose, store, retain, transfer, protect, and delete information.

For purposes of this Privacy Policy, “Legacy Data” means information relating to a deceased individual that is collected, received, generated, or processed in connection with the Service, including digital assets, online accounts, account identifiers, metadata, communications, documents, photographs, and digital footprints.

Although information relating solely to deceased individuals may not be protected by all privacy laws applicable to living persons, Perpetua voluntarily applies safeguards substantially similar to those applied to personal information relating to living persons.

By using the Service, you acknowledge the processing activities described in this Privacy Policy.

Depending on the circumstances and applicable law, Perpetua may process information on the basis of one or more lawful grounds, including performance of a contract, legitimate interests, compliance with legal obligations, or consent where required by law. Where consent is obtained for a particular processing activity, Perpetua may nevertheless rely on any other lawful basis available under applicable law to the extent such basis independently applies.

2. Information We Collect

2.1 General

We seek to collect only information reasonably necessary to provide the Service.

We seek to apply principles of necessity, proportionality, purpose limitation, and data minimization when collecting personal information and Legacy Data. This includes:

  • Sender metadata from your email account (email addresses and domain names of messages you have received);
  • Identity information provided by Customers;
  • Contact information;
  • Account information;
  • Communications with Perpetua;
  • Information supplied in connection with authority verification.

2.2 Legacy Data

In order to provide the Service, we may collect and process data of a deceased person, which may include:

  • names of deceased individuals;
  • email addresses;
  • usernames;
  • account identifiers;
  • social media profiles;
  • photographs;
  • publicly available information;
  • digital asset inventories;
  • online account information;
  • metadata associated with digital assets;
  • information supplied by authorized representatives.

2.3 Authority Verification Information

In order to provide the Service, we may collect information necessary to verify authority to act on behalf of a deceased individual (“Authority Verification Information”), including:

  • death certificates;
  • probate filings;
  • letters testamentary;
  • grants of administration;
  • court orders;
  • government-issued identification;
  • notarized declarations;
  • documentation establishing family relationships.

2.4 Connected Account Data

When you authorize Perpetua to access a third-party account through OAuth, API authorization, delegated access, or similar authorization mechanisms, we may access limited account information necessary to provide the Service.

For example, when you, we access limited Gmail data through connect your Google account to Perpetua Google's OAuth 2.0 mechanism. The specific Google user data accessed is limited to:

Gmail sender metadata (email addresses and sending domain names of messages you have received).

We do not access the body content of emails, attachments, drafts, calendar events, Google Drive files, or other Google account content.

Where Google account access is used in connection with Legacy Data, Perpetua processes only the information necessary to perform the requested services and applicable verification procedures.

2.5 OAuth Scopes

Perpetua seeks to request the least-privileged access reasonably necessary for the requested service.

To operate, our application requests only the OAuth scopes necessary to read email metadata. Example scopes we request include:

openid email profile https://www.googleapis.com/auth/gmail.metadata

The scopes listed above are provided as examples of the minimal scopes our application uses to access sender metadata. The precise scopes granted will be visible to you on Google's consent screen at the time you authorize the application.

3. How We Use the Information

We use the information we collect for the following purposes:

  • To identify online accounts and services associated with your email address;
  • To generate a private report summarizing connected accounts for your use;
  • To improve our detection algorithms and overall service quality via aggregated, anonymized analytics;
  • To operate and maintain our service and respond to user support requests;
  • To verify the client's authority to act on behalf of a deceased individual;
  • To identify, preserve, administer, memorialize, or otherwise manage Legacy Data;
  • To communicate with third-party platforms regarding Legacy Data;
  • To comply with legal obligations relating to succession, probate, fiduciary administration, inheritance, digital assets, or estate administration;
  • To prevent fraud and unauthorized requests.

We do not use user data for advertising, marketing, or profiling purposes outside the operation of the service described above.

3.A Lawful basis for processing

Where applicable, Perpetua processes information on one or more of the following bases:

  • performance of a contract;
  • legitimate interests;
  • compliance with legal obligations;
  • instructions provided by verified representatives acting on behalf of a deceased individual;
  • consent where required by law.

3.B Customer Responsibility for Information Submitted

Customers are responsible for ensuring that information, documentation, Legacy Data, credentials, permissions, authorizations, and personal information submitted to Perpetua may be lawfully disclosed, transferred, and processed for the purposes requested by the Customer.

Perpetua may rely on representations made by Customers regarding the legality of such disclosure and processing except where applicable law requires independent verification.

4. Data Sharing and Disclosure

Perpetua does not sell, rent, or otherwise disclose personal user data (including Legacy Data) to third parties for their direct marketing or advertising purposes.

We may disclose non-identifying, aggregated, or anonymized information for research or statistical purposes provided such information cannot reasonably be used to identify an individual.

We may disclose personal data if required to do so by law, regulation, subpoena, or other legal process, or to protect the rights, property, or safety of Perpetua, our users, or others in imminent danger, as well in case our Customers require it.

Perpetua may disclose information, including Legacy Data, to the following categories of recipients where reasonably necessary to provide the Service:

  • online platforms;
  • social media providers;
  • email providers;
  • search engines;
  • domain registrars;
  • hosting providers;
  • legal advisors;
  • fiduciaries;
  • estate representatives;
  • courts;
  • governmental authorities;
  • service providers assisting with requested Services.

5. Data Storage & Protection

All communications with third party providers are performed over secure, encrypted channels (OAuth 2.0 and HTTPS). Verification documents are accessible only to personnel with a legitimate operational need.

We do not permanently store raw message content, only processed metadata is persisted where necessary for service operation.

Processed data is stored in access-controlled systems and encrypted at rest. Administrative and technical safeguards are employed to prevent unauthorized access or disclosure.

Perpetua employs administrative, technical, and organizational safeguards designed to protect information against unauthorized access, disclosure, alteration, or destruction.

6. Data Retention & Deletion

Retention practices are as follows:

Data provided by the client (including Customer Data, Legacy Data, Authority Verification Information, Legal Hold Data) shall be retained only for as long as reasonably necessary to provide requested services, comply with legal obligations, resolve disputes, or protect legal rights. In many cases, information is deleted within approximately 30 days following completion of the requested Services; however, retention periods may vary depending on operational requirements, legal obligations, dispute resolution needs, security requirements, customer requests, or other legitimate business purposes.

Authority-verification documents may be retained for up to seven (7) years following completion of services unless a longer retention period is required by law.

If you request deletion, we will remove your account data from our systems in accordance with applicable law and within a reasonable time frame (no later than 30 days after receipt of a verifiable deletion request, subject to legal or technical constraints).

Where a dispute regarding authority, inheritance, ownership, or administration exists, Perpetua may retain information for the duration of the dispute and any applicable limitation period.

To request deletion or to inquire about retention, contact: signup@withperpetua.com.

7. User Rights & Controls

Subject to applicable law, you may at any time:

  • Revoke Perpetua's access to your Google account via Google Account permissions;
  • Request a copy of information we hold about you;
  • Request correction or deletion of your personal data;
  • Object to or restrict processing of your data to the extent permitted by law.

Verified representatives may request access to, correction of, deletion of, restriction of processing of, portability of, or objection to the processing of Legacy Data, subject to verification of authority, technical feasibility, and applicable law.

Perpetua may require reasonable evidence of authority before acting upon requests concerning Legacy Data.

To exercise these rights, contact us at: signup@withperpetua.com.

7.A Third-Party Information

Legacy Data may contain information relating to living individuals, including family members, correspondents, contacts, beneficiaries, fiduciaries, and other third parties.

Perpetua processes such information only to the extent reasonably necessary to provide the requested Services.

7.B Sensitive Information

Customers should avoid providing unnecessary sensitive information.

Where sensitive information is processed, Perpetua seeks to limit access and use to what is reasonably necessary for the requested Services.

7.C International Transfers

Information processed by Perpetua may be transferred to, stored in, or processed in the United States or other jurisdictions where Perpetua, its affiliates, service providers, or business partners operate.

Where required by applicable law, Perpetua will implement appropriate safeguards for international transfers of personal information.

8. Children's Privacy

Perpetua's services are not directed to children, that is, individuals under the age of 18. We do not knowingly collect personal information from children. If you believe we have collected such information, please contact us and we will take prompt steps to delete it.

9. Policy Changes

We may update this Privacy Policy from time to time to reflect operational, legal, or regulatory changes. Material changes will be posted at https://www.withperpetua.com/privacy with an updated “Last updated” date and, where required, notification will be provided to affected users.

The application of safeguards to Legacy Data does not constitute an admission that Legacy Data is subject to any particular privacy law, nor does it create statutory rights where none otherwise exist under applicable law.