Privacy Policy

Effective date: July 15, 2026 Last updated: August 11, 2026

This Privacy Policy explains how RanMac LLC ("Beyond," "we," "us," or "our") collects, uses, discloses, and protects information in connection with the Beyond digital legacy vault service (the "Service"), available at https://app.your-beyond.com and related domains.

Beyond is a service that lets a person (an "Owner") securely store personal information, documents, and instructions and have them released to designated recipients ("Beneficiaries") after the Owner's death has been verified through the process described below.

By using the Service, you agree to this Privacy Policy. If you do not agree, please do not use the Service.

1. Who this policy covers

The Service involves several types of people, and we handle each one's information differently:

• Owners — people who create an account and store content in a vault.
• Witnesses — people an Owner designates to confirm or deny the Owner's death. Witnesses receive no vault content.
• Trusted contacts — people an Owner designates who may confirm the Owner is alive. Trusted contacts receive no vault content.
• Beneficiaries — people an Owner designates to receive specified vault content after a verified death.
• Visitors — anyone who visits our public pages.

2. Information we collect

2.1 Information you provide as an Owner

• Account information: name, email address, and password (stored only as a secure cryptographic hash — we never store your plaintext password).
• Profile and preferences: phone number (optional), check-in schedule, and related settings.
• Vault content, which may include:
  • Letters and written messages;
  • Documents and images (e.g., wills, deeds) uploaded as files;
  • Videos;
  • Credentials — service names, usernames, passwords, and notes you choose to store;
  • Financial account information — institution names, account types, account/routing numbers, balances, and notes you choose to store, whether entered manually or imported via a linked financial institution (see Section 4, Plaid).
• Designations: the names, email addresses, phone numbers, and (for Beneficiaries) relationship you provide for your Witnesses, Trusted Contacts, and Beneficiaries, and the access ("grants") and release timing you assign.

2.2 Information about Witnesses, Trusted Contacts, and Beneficiaries

When an Owner designates you, we collect the contact information the Owner provided about you, and we record your responses and actions (for example, a Witness's confirmation or denial, or a Beneficiary's enrollment and identity verification).

2.3 Information collected during the death-verification and claim process

• Records of check-ins and missed check-ins;
• Witness responses (confirmations and denials);
• Death certificates submitted for review, and the outcome of that review;
• Identity-verification results for Beneficiaries (see Section 4, Persona);
• An immutable, timestamped audit log of every step in the verification and release process, retained for dispute resolution and legal purposes.

2.4 Information collected automatically

• Technical/log data: IP address, request timing, routes accessed, and status information, used for security, rate limiting, and reliability. We do not log the contents of your requests (such as passwords).
• We use strictly necessary cookies to keep you signed in. On our public marketing pages only (not within your signed-in account), we use the Meta (Facebook) Pixel to measure the effectiveness of our advertising; we do not run this or any other third-party analytics inside the authenticated application, and we never share your vault activity with advertising networks.

3. How we use information

We use information to:

• Provide, operate, and secure the Service;
• Authenticate you and maintain your session;
• Store your vault content and release it according to your instructions and the verification process;
• Run the death-verification process (check-in reminders, grace periods, contacting Trusted Contacts and Witnesses, applying the mandatory holding period, and releasing content to Beneficiaries);
• Verify the identity of Beneficiaries before granting access;
• Send transactional communications (see Section 5);
• Maintain the audit log for security, dispute resolution, and legal compliance;
• Detect, prevent, and respond to fraud, abuse, and security incidents;
• Comply with legal obligations.

We do not sell your personal information. We do not use your vault content for advertising, and we do not use it to train machine-learning models.

4. Third-party services (subprocessors)

We use the following third-party service providers to operate the Service. Each processes information only as needed to provide its function:

We may update this list as our providers change; the current list will be maintained here.

4.1 Plaid (financial account linking)

If you choose to link a financial institution, we use Plaid Inc. to connect to your institution and retrieve account metadata only — such as the institution name, account type, a masked (partial) account number, and a balance snapshot. We do not store your banking login credentials, and we do not retain ongoing access to your accounts: the access token used to retrieve this metadata is discarded after the one-time import. We do not initiate any transactions or move any money.

By linking an account, you also agree to Plaid's end-user privacy policy, available at https://plaid.com/legal/#end-user-privacy-policy. Plaid's handling of your data is governed by Plaid's policy.

4.2 Persona (identity verification)

If an Owner requires government-ID verification for a Beneficiary, that Beneficiary's identity documents and selfie are processed by Persona to confirm identity before any vault content is released. Persona's handling of that data is governed by Persona's privacy policy.

5. Communications

We send transactional communications only — messages triggered by a user's own action or by the operation of the Service, such as: email confirmation, password reset, one-time verification codes, check-in reminders, Witness confirmation requests, Beneficiary invitations, and vault-release notices. We do not send marketing or promotional email. Some of these communications are essential to the Service and cannot be opted out of while you maintain an account.

6. How information is shared

We share information only:

• With the recipients you designate, and only as your instructions and the verification process dictate — for example, releasing specific vault items to a specific Beneficiary after a verified death and any release delay you set.
• With our subprocessors (Section 4), as needed to operate the Service.
• For legal reasons — to comply with law, legal process, or lawful requests, or to protect the rights, safety, and property of Beyond, our users, or the public.
• In a business transfer — in connection with a merger, acquisition, or sale of assets, subject to this Privacy Policy.

We do not otherwise sell or rent personal information.

7. The death-verification and release process

A core function of the Service is releasing an Owner's vault content after death. This necessarily involves processing information about the Owner's status and sharing designated content with Beneficiaries. Key safeguards:

• Content is never released instantly; a mandatory holding period applies.
• The Owner can halt the process at any time by re-authenticating.
• Release requires multiple independent signals (missed check-ins plus Witness confirmations, or an approved death certificate).
• Beneficiaries must verify their identity before accessing content.

Full details of the process are described in our public materials and Terms of Service.

8. Security

We implement technical and organizational measures designed to protect information, including: encryption in transit (TLS) and at rest; row-level access controls so that accounts can access only their own data; isolation of privileged/server-side credentials from client code; single-use, time-limited tokens for sensitive actions; and rate limiting. Sensitive text content (such as credentials and financial details) is stored in encrypted form.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your password confidential. In the event of a data breach affecting your personal information, we will notify you and the relevant authorities as required by applicable law.

9. Data retention

• We retain your account and vault content for as long as your account is active.
• After a vault is released, records may be retained as needed to complete the release, resolve disputes, and comply with legal obligations.
• The audit log of verification events is retained on a longer basis because it is the evidentiary record of the release process, and may be kept for up to seven (7) years for legal and dispute-resolution purposes.
• When you delete your account, we delete or de-identify your personal information within 30 days, except where retention is required by law or for legitimate dispute-resolution purposes (such as portions of the audit log).

10. Your rights and choices

Depending on where you live, you may have rights to access, correct, delete, port, or restrict the processing of your personal information, and to object to certain processing. To exercise these rights, contact us at cormacconners@gmail.com. We will respond as required by applicable law.

• Account information and vault content: you can view, edit, and delete most of your content directly in the Service, and you can delete your account.
• Designated individuals: if you are a Witness, Trusted Contact, or Beneficiary and wish to have your contact information removed, contact us or the Owner who designated you.

If you are located in a region with specific privacy laws — such as the European Union or United Kingdom (GDPR) or California (CCPA/CPRA) — those rights apply to you, including rights of access, correction, deletion, and (where applicable) to lodge a complaint with your data-protection authority. We do not sell or share your personal information for cross-context behavioral advertising. To exercise any of these rights, contact us at the address below.

11. Children

The Service is not directed to children and is intended for adults (18 and older). We do not knowingly collect personal information from children.

12. International users

The Service is operated from the United States, and information may be processed in the United States and other countries where our subprocessors operate. If you access the Service from outside the United States, you consent to the processing of your information in those locations, which may have different data-protection laws than your own.

13. Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated version with a new "Last updated" date and, for material changes, provide additional notice as required by law.

14. Contact us

Questions or requests regarding this Privacy Policy:

RanMac LLC 8 The Green, Suite B, Dover, DE 19901 cormacconners@gmail.com