Such is Lyff Pty Ltd (ACN 701 483 954) trading as Lyff (“Lyff”, “we”, “us”, “our”) operates the Lyff platform, a secure digital life vault and document storage service, accessible at lyff.com.au and through associated web and mobile applications (“the Platform”).

We are an Australian company. All vault contents and core account data collected through the Platform are stored exclusively on servers located in Australia (Amazon Web Services, Sydney region) and are handled in accordance with Australian law.

This Privacy Policy explains how Lyff collects, holds, uses and discloses personal information in connection with the Platform, in accordance with the Privacy Act 1988 (Cth) (“Privacy Act”) and the Australian Privacy Principles (“APPs”) contained in Schedule 1 of that Act. It is the policy we are required to maintain under APP 1.

We ask you to read this Privacy Policy before creating an account. By creating an account or using the Platform, you acknowledge that you have been given the opportunity to read and understand this Policy. Where the Privacy Act requires your consent for a particular collection, use or disclosure (for example, direct marketing or the handling of sensitive information beyond the purpose for which you provided it), we will seek that consent separately and specifically, and you may withdraw it at any time.

This Privacy Policy applies to: all subscribers and account holders; Lyff Guardians and Custodians who accept invitations through the Platform; Future Message recipients and Emergency Contacts to the extent Lyff holds their personal information; and visitors to lyff.com.au.

A separate collection notice, provided at the point of account creation, sets out the matters required by APP 5. This Policy should be read together with that notice, our Terms of Service, and the Lyff Inactivity Safeguard and Account Lifecycle Policy.

Lyff is a secure digital life vault that allows subscribers to store important documents, record their wishes, nominate trusted contacts, schedule messages to loved ones, and make arrangements for their family’s access to important information if the subscriber can no longer manage things themselves.

Key Platform features relevant to this Privacy Policy include:

• **My Vault: encrypted storage for personal documents, financial records, legal documents, medical information, wishes and account passwords

• **Lyff Guardians: a trusted contact role allowing subscribers to designate individuals to access a designated Guardian folder within the vault, either while the subscriber is alive or following verified notification of death or incapacity

• **Lyff Custodians: a professional contact role (for example, financial planners, legal firms and estate administrators) with designated access to specific vault sections for professional purposes

• **Future Messages: written or video messages created by the subscriber and scheduled for delivery to nominated recipients on a specified date, or on a verified notification trigger

• **Inactivity Safeguard: a welfare check system that contacts the subscriber at intervals they choose, and initiates a structured notification and verification sequence if the subscriber is unreachable

• **Partner Marketplace: a directory of professional service providers listed on the Platform

3.1 Information you provide directly

When you create an account and use the Platform, you may provide us with:

• **Identity information: full name, date of birth, gender (optional), profile photograph

• **Contact information: email address, phone number, postal address

• **Account credentials: password (stored as an Argon2 hash, never in plain text) and two-factor authentication settings

• **Payment information: billing details processed by Stripe. We do not store card numbers. Stripe is the payment processor and holds card data under its own PCI DSS compliance framework

• **Vault contents: documents, images, notes, records, wishes and other personal information you choose to store in your vault

• **Guardian and Custodian nominee details: name, email address and relationship of persons you nominate

• **Future Message content and recipient details: message content (text or video) and the name and email address of intended recipients

• **Emergency contact details: name and email address of a person you nominate as an emergency contact

• **Inactivity Safeguard settings: your chosen check-in interval and preferences

3.2 Information collected automatically

When you access the Platform, we automatically collect:

• **Technical information: IP address, browser type and version, operating system, device type and identifier

• **Usage information: pages visited, features accessed, timestamps, session duration and clickstream data

• **Authentication events: sign-in attempts (successful and unsuccessful), device information, and approximate location (city level) derived from IP address

• **Biometric confirmation events: where you use biometric sign-in (Face ID, Touch ID or fingerprint), we receive only a cryptographic confirmation from your device that authentication succeeded. We do not receive, store or process your biometric data. The biometric check occurs entirely on your device using the WebAuthn/FIDO2 standard

3.5 Information about other people that you provide

When you nominate a Guardian, Custodian, Future Message recipient or Emergency Contact, you provide us with that person’s name and email address (and, for Guardians and Custodians, their relationship to you). By providing this information you confirm that you are entitled to provide it. We use it only for the purpose for which it was provided.

When we first contact a person you have nominated, we tell them who nominated them, what role they have been invited to take, what personal information of theirs we hold, and how they can decline the role or ask us to delete their details. This is how we meet our APP 5 notification obligations to individuals whose information we collect from someone other than themselves.

3.6 Information we do not collect

Lyff does not: collect your tax file number, Medicare number or other government identifiers as data fields (you may choose to store copies of identity documents in your vault, but we do not extract, index or use identifier numbers from those documents for any purpose); connect to your bank accounts, email accounts or other third-party services; collect genetic information; or collect information about you from social media platforms or data brokers.

Under APP 6, we use and disclose personal information only for the primary purpose for which it was collected, for a directly related secondary purpose that you would reasonably expect, with your consent, or where otherwise required or authorised by law. Our purposes are:

We will never use vault contents (the documents, notes, wishes and records you store) for any purpose other than providing the Platform services to you. Vault contents are never analysed, used to train machine learning or artificial intelligence models, or shared with any party other than those you have explicitly authorised through the Platform’s access controls, except where disclosure is required by law.

5.1 Disclosures you authorise

The primary disclosures of personal information through the Platform are those you explicitly authorise by nominating Guardians, Custodians, Future Message recipients and Emergency Contacts. These disclosures are made:

• **To Lyff Guardians: access to the contents of the Guardian folder you have created for them, according to the permissions and timing you have set

• **To Lyff Custodians: access to the vault sections you have designated for professional access

• **To Future Message recipients: delivery of the message content and any video you have recorded, on the date or trigger condition you have specified

• **To Emergency Contacts: notification and contact in connection with the Inactivity Safeguard process

5.3 Service providers

We disclose personal information to third-party service providers who assist us in operating the Platform, where those providers are contractually bound to use the information only for the purposes we specify and to maintain security appropriate to the sensitivity of the information. Our current service providers are:

We do not permit service providers to use your personal information for their own purposes, and we do not permit any service provider to use your personal information to train artificial intelligence models.

5.5 Other disclosures

We may disclose personal information in the following additional circumstances:

• Where required or authorised by law, including under a court order, subpoena, warrant, or a lawful direction from a regulatory authority

• Where necessary to establish, exercise or defend a legal claim involving Lyff

• Where we reasonably believe disclosure is necessary to lessen or prevent a serious threat to the life, health or safety of any individual, in accordance with the Privacy Act

• To a proposed purchaser or acquirer of Lyff’s business or assets, subject to appropriate confidentiality obligations, provided the acquiring party agrees to handle personal information in a manner consistent with this Privacy Policy

• Where you have given your explicit consent to a specific disclosure

We will never sell your personal information. We do not share your personal information with data brokers or advertising networks.

All vault contents and core account data are stored on servers physically located in Australia (AWS Sydney region, ap-southeast-2). Vault contents do not leave Australia. Our commitment to Australian data residency for vault contents is unconditional and will not change without prior notice to subscribers.

Limited categories of personal information are disclosed to overseas service providers so that we can operate the Platform. Payment and billing information is processed by Stripe in the United States. SMS verification and Inactivity Safeguard notifications are sent via Twilio, also based in the United States. Email delivery and marketing communications are handled by HubSpot on its Sydney data centre, so this category of personal information does not leave Australia. No overseas provider receives vault contents.

Before disclosing personal information to an overseas recipient, we take reasonable steps as required by APP 8.1 to ensure the recipient does not breach the APPs in relation to that information, including through contractual protections that restrict use of the information to the purposes we specify and require security measures appropriate to its sensitivity. Under section 16C of the Privacy Act, Lyff remains accountable for the acts and practices of overseas recipients in relation to your personal information, and this accountability is a factor in how we select and contract with providers.

We take reasonable steps, as required by APP 11, to protect personal information we hold from misuse, interference, loss, and unauthorised access, modification or disclosure, commensurate with the sensitivity of the information involved. Our security measures include:

7.1 Encryption

• All data is encrypted in transit using TLS 1.3

• All vault contents and sensitive account data are encrypted at rest using AES-256, with per-user encryption keys

• Passwords are hashed using Argon2. Plaintext passwords are never stored

• Encryption keys are managed through AWS Key Management Service (Sydney region)

LYFF-SPECIFIC CLAUSE 7.2 Encryption architecture and staff access Lyff operates two different encryption models. Which one applies to a given item in your vault depends on how you have chosen to share it, through your Sharing Setting.

Private items (My Vault). Items you keep private, not shared with any Lyff Guardian or Lyff Custodian, are protected using zero-knowledge encryption. The encryption key for these items is derived from your password and never leaves your device in a form Lyff could use. Lyff does not hold this key and cannot access, recover or restore these items under any circumstances, including a lost password. If you lose both your password and your Recovery Key, private My Vault items cannot be recovered, by Lyff or by anyone else. This is an intentional design choice: genuine privacy requires that nobody but you can open these items, not even us.

Shared items (Guardian and Custodian access). Items you choose to share with a Lyff Guardian or Lyff Custodian, whether immediately, on a future date, or on a verified Inactivity Safeguard trigger, use a managed encryption model instead. For these items, Lyff holds key material (via AWS Key Management Service, Sydney region) that allows the item to be verified and released through the Lyff Release Process described in Section 11 and the Lyff Inactivity Safeguard and Account Lifecycle Policy, without requiring your password. This is what allows a Guardian or Custodian to actually receive access when the time comes, rather than access depending on a credential only you held.

Administrative account recovery. In limited circumstances, such as a verified identity recovery request from an account holder who has lost access to their account, an administrative process may be used to restore access to the account and to any managed-encryption (shared) items. This process requires multi-step identity verification, is restricted to authorised senior personnel, and is fully logged and auditable. This process cannot recover zero-knowledge (private My Vault) items, for the reasons described above.

7.3 Access controls

• Vault contents are accessible only to the account holder and to persons the account holder explicitly authorises through the Platform’s access control features

• Lyff staff are bound by confidentiality obligations and undergo background checks

• Internal access to production systems is restricted to authorised personnel on a need-to-know basis

• All administrative access to production data is logged and audited

• Multi-factor authentication is required for all internal system access

7.4 Authentication and account security

• Two-factor authentication (authenticator app, SMS or biometric) is required for all account holders

• Biometric authentication uses the WebAuthn/FIDO2 standard. Biometric data is processed on the user’s device and is never transmitted to or stored by Lyff

• Sign-in from unrecognised devices triggers an automated security alert to the account holder

• Rate limiting and account lockout protections apply to login attempts

7.5 Infrastructure and monitoring

• The Platform is hosted within a private Amazon Web Services VPC (Virtual Private Cloud) in the Sydney region

• Web Application Firewall (WAF) protection is in place for DDoS mitigation, bot protection and rate limiting

• Automated daily backups of all data are performed, with encrypted backup storage

• Security monitoring and intrusion detection are in place

Despite these measures, no system is completely immune from security risks. If you have concerns about the security of your account, please contact us immediately using the details in Section 15.

8.1 Active accounts

We retain personal information for as long as you maintain an account with us, and for as long as necessary to fulfil the purposes for which it was collected. If you cancel a paid subscription, your vault is retained in read-only mode for 90 days after your paid access ends, or for any approved extension of up to six months, and is then permanently and irreversibly deleted unless a preservation hold applies. This process is set out in full in clause 16.1 of our Terms of Service.

8.2 Account closure

When you close your account, we permanently and irreversibly delete all vault contents and de-identify your account record. Billing and transaction records required for legal and regulatory compliance are retained for 7 years in accordance with the Corporations Act 2001 (Cth) and taxation law. Activity logs are retained in de-identified form for 7 years.

8.4 Verification documents

Documents provided in connection with the verification process (death certificates, medical certificates, statutory declarations and identity documents) are retained only for as long as necessary to complete the verification and access process, and are then securely deleted. If a legal dispute arises, such documents may be retained for the duration of that dispute and a reasonable period afterwards.

8.5 Data relating to Future Message recipients

The name and email address of a Future Message recipient are retained until the message is delivered or deleted by the subscriber. Following delivery, the recipient’s contact details are deleted within 90 days, unless the recipient has created their own Lyff account.

As an Australian business subject to the Privacy Act, Lyff is bound by the 13 Australian Privacy Principles. The following is a plain-English summary of how each APP applies to your information.

You have the right to request access to the personal information we hold about you, and to request correction of information that is inaccurate, out of date, incomplete, irrelevant or misleading. To make an access or correction request, contact our Privacy Officer at hello@lyff.com.au. We will respond within 30 days.

Vault contents (the documents, notes and records you store) are accessible to you directly through the Platform at any time, so you do not need to make a formal access request for them. An access request under this section relates to the account-level personal information we hold about you, such as account details, billing records and activity logs.

We may refuse access in the limited circumstances permitted by APP 12, for example where providing access would have an unreasonable impact on the privacy of other individuals, would be unlawful, or relates to existing or anticipated legal proceedings. If we refuse access or correction, we will give you written reasons, tell you how to complain about the refusal, and, where we refuse a correction request, take reasonable steps to associate a statement with the information noting that you consider it inaccurate, out of date, incomplete, irrelevant or misleading, if you ask us to.

We do not charge for making an access or correction request. We may charge a reasonable fee for giving access where the request is complex or requires significant effort, and we will notify you of any applicable fee before proceeding. We never charge for correcting information.

We use cookies and similar technologies to operate the Platform, including:

• **Essential cookies: required for the Platform to function, including session management and authentication

• **Functional cookies: used to remember your preferences and settings

• **Analytics cookies: used to collect aggregate, de-identified data about Platform usage to help us improve the product. We do not use vault content for analytics

We do not use advertising cookies or tracking cookies that follow you across third-party websites. You can manage cookie preferences through your browser settings. Disabling essential cookies may affect Platform functionality. The Platform does not currently respond to browser Do Not Track signals. Most modern browsers no longer provide a consistent standard for this signal, so we rely on the cookie and consent controls described above to give you control over tracking.

The Platform is not directed at persons under 18 years of age, and account holders must be at least 18. We do not knowingly collect personal information from children under 18 as account holders. If we become aware that a person under 18 has created an account, we will close the account and delete the associated personal information as soon as practicable.

A subscriber may store information about their minor children in their vault (for example, in connection with guardianship wishes or family documents). This information is subject to the same encryption and access controls as all other vault contents.

Lyff is subject to the Notifiable Data Breaches (NDB) scheme under Part IIIC of the Privacy Act. If we suspect an eligible data breach may have occurred, we will conduct a reasonable and expeditious assessment within 30 days. If we form the view that an eligible data breach has occurred (that is, a breach likely to result in serious harm to one or more individuals), we will:

• Take immediate steps to contain the breach and mitigate harm

• Notify the Office of the Australian Information Commissioner (OAIC) as soon as practicable

• Notify affected individuals directly where practicable, or by prominent public statement where direct notification is not reasonably practicable

We maintain an internal data breach response plan that sets out the steps Lyff will take in the event of a suspected or actual data breach. Given the sensitive nature of vault contents, any incident involving vault data is treated as a highest-priority incident.

If you have a question about this Privacy Policy, or you believe Lyff has handled your personal information in a manner inconsistent with this Policy or the APPs, you may contact our Privacy Officer:

If you are not satisfied with our response, you may refer your complaint to the Office of the Australian Information Commissioner (OAIC):

• Website: www.oaic.gov.au

• Phone: 1300 363 992

• Post: Office of the Australian Information Commissioner, GPO Box 5218, Sydney NSW 2001

The OAIC has the power to investigate complaints, make recommendations and make determinations, including requiring us to take specific action.

We may amend this Privacy Policy from time to time to reflect changes in the Platform, our information handling practices, or applicable law. When we make a material change, we will notify you by email to your registered email address at least 30 days before the change takes effect, and we will update the effective date at the top of this Policy.

If you do not agree with a material change, you may close your account before the change takes effect, in which case Section 8.2 applies. We encourage you to review this Policy periodically. The current version is always available at lyff.com.au/privacy.