1. About this Privacy Policy
1.1Such is Lyff Pty Ltd (ACN 701 483 954) trading as Lyff ("Lyff", "we", "us", "our") operates the Lyff platform, a secure digital vault for important documents, wishes and information, available at lyff.com.au and through associated web and mobile applications (the "Platform").
1.2This Privacy Policy explains what personal information we collect, why we collect it, how we hold, use and disclose it, and how you can access it, correct it or make a complaint.
1.3Our privacy commitment. Lyff has chosen to handle all personal information in line with the Privacy Act 1988 (Cth) (the "Privacy Act") and the 13 Australian Privacy Principles ("APPs"), whether or not an exemption for small businesses might otherwise apply to us. Given the kind of information people trust us with, we think this is the only responsible standard.
1.4This Policy applies to:
(a)subscribers and account holders on any Lyff plan, including beta testers;
(b)Lyff Guardians and Lyff Custodians who accept an invitation;
(c)people a subscriber shares items with, and Future Message recipients;
(d)people who provide documents or information in connection with an Incapacity or Passing release;
(e)Partner Marketplace listing partners, to the extent we hold their personal information;
(f)Care Card holders and Emergency Profile owners; and
(g)visitors to lyff.com.au and people who contact us.
1.5This Policy should be read with our Terms of Service, Platform Policy and Refund and Cancellation Policy. We also give you a short collection notice when you create an account.
2. How the Platform works
2.1Understanding a few Platform features helps explain how we handle your information.
| Feature | What it means for your information |
|---|---|
| Your vault | Each paid plan gives each adult their own independent vault. Vaults are never shared or merged, including on Complete Duo and Complete Circle. You must be 18 or over to hold a vault. |
| Sharing status (set per item) | Every item you store has one sharing status: Private, Share now, or Incapacity / Passing. You choose the status, the recipient, and (for Share now) whether they can View Only or View and Download. To send something to a person on a set date, you use a Future Message. |
| Private items | Protected with zero-knowledge encryption. Lyff cannot open them and they are never released to anyone, under any process (see clause 8). |
| Lyff Guardian and Lyff Custodian | Each paid vault may nominate one Guardian (a trusted person) and one Custodian (a professional firm, such as a law, accounting or financial planning firm, acting through one named contact person). They only ever see the individual items you share with them. They must create a free Lyff account. Guardians complete identity verification. For a Custodian, we verify the named contact's email address and that they work at the nominated firm. |
| Incapacity / Passing instructions | A standing instruction that releases specific items to your nominated recipient if you lose capacity or pass away. Releases only happen after document checks, a 7-day notice period and approval by an authorised Lyff manager (see clause 7). |
| Future Messages | Messages you write for delivery to a person on a set date. See clause 3.8 for how Future Messages work. |
| Lyff Check-In | A periodic reminder to review your vault. It is a reminder only. If you do not respond, nothing happens to your vault and nothing is released. |
| Preparedness Score | A progress indicator inside your vault, currently in development, that will show how complete your setup is. It will be visible only to you. |
| Care Card | A physical card and key tag that displays an Emergency Profile when its QR code is scanned. See clause 7A for how the Care Card works. |
3. Personal information we collect
3.1Information you give us
| Category | Examples |
|---|---|
| Identity and contact | Name, preferred name, date of birth, email address, mobile number, postal address |
| Account security | Password (stored only as a one-way hash), two-factor authentication settings, backup codes, Recovery Key status, trusted devices |
| Plan and billing | Plan, billing period, invoices and payment status. Card details are handled by Stripe and never reach Lyff's systems. |
| Vault contents | Documents, images, notes, wishes, account details and any other information you choose to store, together with the item details you set (title, category, sharing status, recipient, permissions, release instruction) |
| People you nominate | Name, email address, mobile number and relationship of your Guardian, Custodian, sharing recipients and Future Message recipients. For a Custodian, also the firm name and the name of your contact person at that firm. |
| Future Messages | Message content and delivery settings |
| Support and feedback | Messages to our support team or chatbot, concierge requests, beta tester survey responses and ideas you submit |
| Partner Marketplace | For listing partners: business name, contact person, contact details, professional registration details and listing content |
| Care Card and Emergency Profile | Emergency Profile fields you choose to complete (see clause 7A.3), consent record, activation record, card reference number and audit log |
3.2Information collected automatically
(a)Device and technical: IP address, browser, operating system and device type.
(b)Activity log: sign-ins, failed sign-in attempts, approximate location (city level, from IP address), and every access to your items by you, a Guardian, a Custodian or a sharing recipient. You can see this log in your vault.
(c)Website usage: pages visited and general interactions, collected with your consent through analytics cookies (see clause 13).
(d)Biometric sign-in: if you use Face ID, Touch ID or a fingerprint, the check happens entirely on your device. Lyff receives only a confirmation that it succeeded. We never receive or store biometric data.
3.3Sensitive information
Your vault may contain sensitive information, such as health information, as well as other highly personal records such as financial documents and identity documents. We collect this only because you choose to store it, and your act of uploading it is your consent to us holding it for the purpose of providing the Platform.
We never use vault contents for profiling, analytics, advertising or to train artificial intelligence or machine learning models. We do not read, index or extract information from your documents, including any government identifiers they contain.
3.4Verification of Guardians and Custodians
Before a Guardian can accept the role, they must verify their identity. This involves checking an identity document (such as a driver licence or passport) through our ID Verification Service, and may include a signed acknowledgement of the role.
Our ID Verification Service acts as a pass-through exchange: identity information passes directly from the participating bank or other identity provider to Lyff. The provider says it does not see or store that identity information. It receives transaction metadata about each exchange, which it says does not include the identity information itself.
Lyff collects only the minimum identity attributes needed to confirm that the person is who they say they are. Identity information received by Lyff is stored in AWS Sydney and is handled under Lyff's retention rules in clause 9.
The ID Verification Service provider's public materials state that its information is primarily stored with Australian providers, but that parts of its service are supported from the United Kingdom and that personal information may be disclosed to and stored in that location. This concerns the provider's own operational information and transaction metadata, not Lyff's vault contents or the identity information passed directly to Lyff.
We use the results only to confirm the person is who they say they are, and to keep a record that verification took place. We will update this Policy if our ID Verification Service or its processing arrangements change.
Custodians do not complete identity verification. A Custodian is a professional firm, and you nominate one named contact person at that firm. We verify the named contact's email address and check that the person works at the nominated firm, using sources such as the firm's website, public business registers (including ASIC), professional listings and email confirmation. We may use automated search tools to help with these checks, and a person reviews the result. We collect only the information needed to confirm the contact and the firm.
3.5Information collected for an Incapacity or Passing release
When a nominated recipient asks for a release, we collect only what is needed to check the request:
(a)Incapacity: a medical certificate from a registered medical practitioner stating the subscriber is unable to manage their own affairs, or a certified copy of a tribunal order to the same effect.
(b)Passing: a death certificate issued by an Australian Registry of Births, Deaths and Marriages.
(c)For both: the identity of the person making the request.
For incapacity, we check the practitioner's name and registration on the public Australian Health Practitioner Regulation Agency (Ahpra) register. We do not make any medical assessment. These documents may contain health information about the subscriber, and we protect them to the same standard as vault contents.
3.6Information about other people
When you nominate a Guardian, Custodian, sharing recipient or Future Message recipient, you give us their contact details. You confirm you are entitled to do so and that you will let them know. When we first contact a nominated person, we tell them who nominated them, what role or item is involved, what information we hold about them, and how to decline or ask us to delete their details.
3.7What we do not collect
We do not connect to your bank, email or social media accounts. We do not buy information from data brokers. We do not collect your tax file number, Medicare number or other government identifiers as data fields.
3.8Future Messages
A Lyff subscriber may create a Future Message and instruct Lyff to send it to a nominated email address on a selected date.
The subscriber must sign in to the Platform using their password and multi-factor authentication to create, change or cancel a Future Message. These security measures authenticate the subscriber's access to the Platform. They do not verify the identity of the person who controls the nominated recipient email address.
Lyff does not independently verify the identity, age or authority of a Future Message recipient. The subscriber is responsible for entering and checking the recipient's email address, selecting the delivery date and deciding whether delivery by email is suitable for the message.
On the selected date, the Platform automatically sends the Future Message to the nominated email address in accordance with the subscriber's instruction. Lyff cannot guarantee that the intended recipient still controls that address or that another person will not access the recipient's email account.
Subscribers should not use a Future Message as the only means of communicating legally operative, urgent or time-sensitive instructions.
If a Future Message cannot be delivered, Lyff may record the delivery failure and notify the subscriber while their account remains active. Unless the Platform expressly states otherwise, Lyff does not guarantee that a recipient has received, opened, read or acted on a Future Message.
4. How we use personal information
4.1We use personal information only for the purpose it was collected, a related purpose you would reasonably expect, with your consent, or where the law requires or allows it.
| Purpose | What this involves |
|---|---|
| Providing the Platform | Creating your account, storing and encrypting your vault, applying your sharing settings, and giving you access to your items |
| Sharing and releases | Sending invitations, verifying Guardians and Custodians, delivering items and Future Messages, and processing Incapacity and Passing releases exactly as you instructed |
| Security | Two-factor authentication, re-authentication when you set an Incapacity / Passing instruction, device alerts, the activity log, and fraud and misuse prevention |
| Account recovery | Helping you regain access to your account through password reset, your Recovery Key, or Recovery Assistance (see clause 8.4) |
| Lyff Check-In | Sending periodic reminders to review your vault |
| Billing | Processing payments, applying offers (such as beta tester access or Lyff First 50), and keeping tax records |
| Service messages | Account, security, billing and grace period notices. These are not marketing and are needed to run your account. |
| Support | Answering questions through our support team, chatbot or concierge service |
| Improving Lyff | Using de-identified, aggregated usage information and beta feedback to improve the Platform. This never involves vault contents. |
| Marketing | Newsletters and offers, only if you opt in. You can unsubscribe at any time. |
| Legal obligations | Responding to lawful requests, meeting record-keeping duties and handling data breaches |
| Care Card and Emergency Profile | Creating and managing your Emergency Profile, linking it to your Care Card, displaying it when the QR code is scanned, and maintaining consent, activation and audit records |
5. Who we disclose personal information to
5.1People you choose
Most disclosures on Lyff happen because you instruct them. We disclose an item only to the recipient you chose, at the time you chose, with the permission you chose:
(a)Share now: available to the recipient straight away.
(b)Incapacity / Passing: available to the recipient only after the release process in clause 7 is complete.
Guardians and Custodians see only the items shared with them, never your whole vault. When a release occurs, we notify the recipient and deliver access through secure, time-limited links that require the recipient to sign in with multi-factor authentication.
Future Messages are how you send something to a person on a set date. They are delivered by email to the address you nominate on the date you select. The recipient does not need a Lyff account and is not required to complete multi-factor authentication to receive a Future Message. See clause 3.8 for further detail.
Lyff does not give vault contents to executors, family members or anyone else you have not nominated, unless the law requires it (see clause 5.4).
5.2Service providers
We use trusted providers to run the Platform. They may use personal information only to provide their service to us, must protect it appropriately, and may not use it for their own purposes or to train artificial intelligence models. No provider receives vault contents except our hosting provider, which stores them in encrypted form.
| Provider | Purpose | Information | Location |
|---|---|---|---|
| Amazon Web Services | Hosting, storage, encryption key management | All Platform data, including encrypted vault contents | Australia (Sydney region) |
| Stripe | Payments and subscriptions | Name, email, billing details | United States |
| HubSpot | Customer relationship management, transactional and marketing email, and website forms | Name, email, marketing preferences, transactional email delivery information | Australia (server storage requested; some support access, processing, backups or subprocessors may operate outside Australia as confirmed by our contractual arrangements with HubSpot) |
| Twilio | SMS verification codes and generic service or release notifications | Mobile number and generic notification message only. Twilio does not receive vault contents or the contents of any item or Future Message. | United States |
| Zendesk | Support tickets and knowledge-base chatbot | Name, email, support messages and anything you type into the chatbot. The chatbot answers questions using Lyff help content and cannot access your account or vault contents. | Australia (server storage confirmed; some support access or subprocessors may operate outside Australia as confirmed by our contractual arrangements with Zendesk) |
| Google Analytics | Website usage analytics, with your consent | Device and usage data | United States and other countries |
| ID Verification Service (an Australian identity-verification provider) | Guardian identity verification, and identity checks on release requests where required | Transaction metadata that does not include identity information. Identity information passes directly from the participating bank or identity provider to Lyff. The provider says it does not see or store that identity information. | Australia (primarily); United Kingdom (parts of the service are supported from the United Kingdom and information may be disclosed to and stored in that location, as stated in the provider's privacy policy) |
| Creative Plastic Cards | Printing and, if applicable, storing and dispatching unassigned Care Card and key tag stock | Card artwork, print-ready QR image containing a random token, and non-identifying card reference number. Delivery name and address only if it prepares or dispatches the delivery. No Emergency Profile, health information, vault contents, activation code or separate token data. | Melbourne, Australia (subject to written supplier confirmation of printing, file storage and stock-storage locations) |
| Australia Post | Delivery of the Care Card and key tag | Recipient name, delivery address and delivery information | Australia |
5.3Partner Marketplace
The Partner Marketplace lists independent professionals. Lyff does not pass your information to a partner. If you choose to contact a partner, what you send them is handled under their own privacy policy. Partners never have access to your vault. A partner only sees a vault item if you separately nominate them as your Custodian and share that item with them.
5.4Other disclosures
We may also disclose personal information:
(a)when required or authorised by law, including a court order, subpoena or warrant;
(b)to establish, exercise or defend a legal claim;
(c)to lessen or prevent a serious threat to someone's life, health or safety, as the Privacy Act allows;
(d)to a buyer of Lyff's business, on the condition they protect it in line with this Policy; and
(e)with your express consent.
If we are legally compelled to hand over Private items, we can only provide them in the encrypted form we hold, because we cannot open them. We will tell you about a request unless the law prevents us.
We never sell personal information and we do not share it with advertising networks or data brokers.
6. Overseas disclosure and data residency
6.1Vault contents, including Private items, shared items and release documents, are hosted and stored in encrypted form using Amazon Web Services in the Sydney region. Our hosting arrangements use service providers under contract. We do not permit HubSpot, Zendesk or Twilio to access vault contents.
6.2We will give you advance notice if we propose to change the country in which vault contents are primarily hosted or stored.
6.3Account, support, analytics and communications information may be processed outside Australia as described in clause 5.2. Before doing so, we take reasonable steps to make sure those providers handle it consistently with the APPs, including through contract terms. We remain accountable for how they handle it.
6.4ID Verification Service. Our ID Verification Service acts as a pass-through exchange for identity verification. Identity information passes directly from the participating bank or identity provider to Lyff and is stored in AWS Sydney. The provider's public materials state that its information is primarily stored with Australian providers, but that parts of its service are supported from the United Kingdom and that personal information may be disclosed to and stored in that location. This concerns the provider's own operational information and transaction metadata, not vault contents or the identity information passed directly to Lyff.
7. Incapacity and Passing releases
7.1How a release works
An Incapacity / Passing release happens only because you set a standing instruction for a specific item. When you set or change that instruction, you must re-confirm your identity with two-factor authentication, so we know the instruction is genuinely yours.
Incapacity release
(a)Your nominated recipient submits a complete release application, including a medical certificate from a registered medical practitioner stating you are unable to manage your own affairs, or a certified copy of a tribunal order to the same effect, together with the information required to verify their identity.
(b)We check the application, certificate and the practitioner's registration on the Ahpra register. We do not make any medical assessment, interpret a will or determine legal entitlement.
(c)We notify you by email and SMS that a release has been requested. A 7-day notice period starts when we send that notice. You can stop the release during that period using the secure Stop Release link in the notice or another identity-verified process. Signing in to your account does not, by itself, stop the release.
(d)At the end of the notice period, an authorised Lyff manager reviews the application and, if the requirements are met, approves the release.
(e)We release only the items you marked Incapacity / Passing for that recipient, unless the release has been paused because of suspected fraud, invalid documents, a dispute, a court order or another legal requirement.
Passing release
(a)Your nominated recipient submits a complete release application, including a death certificate issued by an Australian Registry of Births, Deaths and Marriages and the information required to verify their identity.
(b)We check the application, certificate and the recipient's identity. We do not interpret a will or determine who is legally entitled to receive your information.
(c)We notify you by email and SMS that a release has been requested. A 7-day notice period starts when we send that notice. If the request is wrong, you or someone acting for you can stop it during that period using the secure Stop Release link in the notice or another identity-verified process. We will also pause the release if we receive credible information that you may be alive.
(d)At the end of the notice period, an authorised Lyff manager reviews the application and, if the requirements are met, approves the release.
(e)We then release only the items you marked Incapacity / Passing for that recipient, unless the release has been paused because of suspected fraud, invalid documents, a dispute, a court order or another legal requirement.
The same 7-day notice period applies to both Incapacity and Passing releases. No item is released before the notice period has ended and an authorised Lyff manager has approved the release.
Only items you marked Incapacity / Passing for that recipient are released. Private items are never released. Lyff acts only on your instructions and the documents provided. We do not judge who should receive your information.
We may pause a release where documents appear invalid, there is a dispute, or a court order or other legal process requires it.
7.2Information of people who have passed away
The Privacy Act protects living people. Even so, Lyff continues to protect a subscriber's information after they pass away to the same standard it did during their life.
7A. Care Card and Emergency Profile
7A.1What the Care Card is
The Lyff Care Card is a physical card and key tag that displays an Emergency Profile when its QR code is scanned. It is designed to give first responders and others access to information you choose to make available in an emergency. The Care Card is a separate product from your vault. Vault contents are never displayed through the Care Card.
You must have a Lyff account to buy a Care Card. A free account is enough. A Free account is valid for 12 months. After that, your Care Card and Emergency Profile continue to work, but Free plan features are no longer available (see clause 9).
7A.2What the Emergency Profile is
Your Emergency Profile is a set of fields you choose to complete. It is separate from your vault. You decide what to include. The Emergency Profile may include health information, such as medical conditions, allergies and medications, as well as emergency contacts and other information you consider relevant.
The Emergency Profile is not protected by zero-knowledge encryption. It is designed to be readable by anyone who scans the QR code, without a Lyff account or authentication. You should include only information you are comfortable being seen by a first responder or member of the public.
7A.3What we collect for the Care Card
We collect:
(a)the Emergency Profile fields you choose to complete;
(b)a record of your consent, including the policy version, the fields you selected and the date and time you acknowledged the display terms;
(c)a card reference number (a serial or batch number that does not identify you outside Lyff) linking the physical card to your Emergency Profile;
(d)your activation record; and
(e)a change and audit log recording actions taken in relation to the Care Card and Emergency Profile.
7A.4How the QR code works
Each QR code contains only a random token of at least 128 bits. It does not contain your name, health information, Lyff account identifier or card reference number. The token does not provide access to an Emergency Profile until the card has been assigned by Lyff and activated by you.
7A.5Who can see your Emergency Profile
Anyone who scans the QR code on an active Care Card can view your Emergency Profile. No Lyff account, login or authentication is required to view it. You should not include information in your Emergency Profile that you would not want a stranger to see.
7A.6Consent
Before your Emergency Profile is activated, we show you a preview of how it will appear when scanned. You must acknowledge that the information will be publicly visible before activation proceeds. We record your consent, including the policy version, the fields you selected and the date and time of acknowledgement.
7A.7Updating and deactivating your Emergency Profile
You can update or deactivate your Emergency Profile at any time from within the Platform. Changes take effect immediately. A deactivated Emergency Profile displays no personal or health information when the QR code is scanned.
7A.8Inactive, cancelled or replaced cards
A paused, cancelled, replaced, lost or inactive Care Card displays only the neutral message: "This Care Card is not currently active". It does not display any personal or health information.
7A.9Care Card printing and delivery
Your Care Card and key tag are printed by Creative Plastic Cards in Melbourne, Australia. See clause 5.2 for what information Creative Plastic Cards receives.
Your card and key tag are delivered by Australia Post. Australia Post receives your delivery name and address for this purpose.
We email your activation code to you separately. The activation code is not printed on the card and is not provided to Creative Plastic Cards or Australia Post.
7A.10Overseas processing
The Emergency Profile is hosted in AWS Sydney. It is not stored or processed outside Australia except as described in clause 5.2 for account and communications information.
7A.11Care Card and Emergency Profile retention
| Situation | What happens |
|---|---|
| Emergency Profile fields | Deleted within 60 days after deactivation or account closure, unless we are required by law to retain particular information |
| Consent records, activation records and audit logs | Retained for 7 years after the relevant action or account closure. These records do not include the deleted Emergency Profile fields. |
| Care Card order, payment, tax and delivery records | Retained for the period required by law |
| Print files and supplier exports | Deleted after Creative Plastic Cards confirms receipt or completion of production |
7A.12Card supplier information
Our card printer, Creative Plastic Cards, receives only:
(a)the card and key tag artwork;
(b)a print-ready QR image containing a random token; and
(c)a card reference number, such as a serial or batch number, that does not identify you or reveal the token outside Lyff.
The cards and key tags are printed as unassigned stock. The random token does not provide access to an Emergency Profile until Lyff assigns the stock and the owner activates the card.
Creative Plastic Cards does not receive the token as a separate text field, your activation code, Emergency Profile, health information, vault contents or Lyff account identifier.
If Creative Plastic Cards prepares or dispatches the delivery, it also receives the delivery name and address solely for that purpose. Otherwise, the delivery name and address are disclosed only to Australia Post and any provider needed to arrange delivery.
We email the activation code separately. Print files and related supplier exports are deleted after Creative Plastic Cards confirms receipt, subject to confirmation of the supplier's documented deletion process.
7A.13Limitations of the Care Card
The Care Card is not a substitute for a medical alert bracelet, advance care directive, will or other legal document. Lyff does not verify the accuracy of the information you include in your Emergency Profile. You are responsible for keeping your Emergency Profile current.
Lyff cannot guarantee that a first responder or other person will scan the QR code, view the Emergency Profile or act on the information it contains.
7A.14Separate actions and retention
Cancelling a Care Card, deactivating an Emergency Profile, deleting vault contents and closing a Lyff account are separate actions.
(a)Cancelling or replacing a Care Card disables the QR code for that card. It does not delete your Emergency Profile, vault contents or Lyff account. You may link an existing Emergency Profile to a replacement card.
(b)Deactivating your Emergency Profile stops the profile from being displayed through any linked Care Card. It does not cancel your Care Card order, delete your vault contents or close your Lyff account. We delete the Emergency Profile fields within 60 days after deactivation, unless we are required by law to retain particular information.
(c)Deleting your vault contents permanently deletes the information stored in your vault in accordance with clause 9. It does not cancel your Care Card, deactivate or delete your Emergency Profile, or close your Lyff account.
(d)Closing your Lyff account deactivates every Care Card linked to the account, deactivates the Emergency Profile and starts the applicable deletion periods for the Emergency Profile and other account information.
(e)Consent records, activation records, change records and audit logs relating to the Care Card and Emergency Profile are retained for 7 years after the relevant action or account closure. These records do not include the deleted Emergency Profile fields.
(f)Care Card order, payment, tax and delivery records are retained for the period required by law.
7A.15Discontinuation of the Care Card service
If Lyff discontinues the Care Card service, we will give you reasonable advance notice. We will delete Emergency Profile fields within 60 days after the service ends.
8. Security
8.1We take reasonable steps to protect personal information from misuse, interference, loss and unauthorised access, change or disclosure. Our measures include the following.
8.2Encryption
(a)All data is encrypted in transit using TLS 1.3.
(b)All vault contents are encrypted at rest using AES-256.
(c)Passwords are stored only as a one-way Argon2 hash, never in readable form.
8.3Two encryption models, set by sharing status
Private items: zero-knowledge. Private items are encrypted with a key that only you control, based on your password and Recovery Key. Lyff never holds a usable key. We cannot open, recover or release Private items for anyone, for any reason. If you lose both your password and your Recovery Key, your Private items cannot be recovered by anyone, including Lyff.
Shared items: managed encryption. Items set to Share now or Incapacity / Passing, and Future Messages, are encrypted with keys managed securely by Lyff through Amazon Web Services Key Management Service in Sydney. This is what allows the right person to receive an item when the time comes, without needing your password. Lyff staff do not view shared items. Key use is restricted, controlled and logged.
When you change an item from Private to a shared status, it moves to managed encryption. When you change it back to Private, it returns to zero-knowledge encryption.
8.4Access controls
(a)Only you, and the people you share items with, can access your items.
(b)Lyff staff access to systems is limited by role, requires multi-factor authentication, and is logged.
(c)Every release requires approval by an authorised manager.
(d)Staff are bound by confidentiality obligations.
(e)Two-factor authentication is required for all accounts, with optional device biometrics.
(f)Sign-ins from new devices trigger a security alert.
8.5Account recovery
If you lose access to your account, start with normal account recovery or your Recovery Key. Where those are not available, Recovery Assistance may be available, in which an eligible Guardian or Custodian helps confirm it is really you. Access is restored to you only.
Recovery Assistance never gives a Guardian, Custodian or Lyff access to your vault, does not change your sharing instructions, and cannot open Private items. Private items can only be recovered with your password or Recovery Key.
8.6Infrastructure
The Platform runs in a private network on Amazon Web Services in Sydney, with a web application firewall, security monitoring, and automated daily backups stored in encrypted form. No system is completely secure, so please contact us straight away if you think your account has been compromised.
9. How long we keep information
9.1We keep your information for the periods set out below.
| Situation | What happens |
|---|---|
| Active account | We keep your information while your account is active. |
| Free plan | A Free account lasts 12 months, followed by a 90-day grace period to export or upgrade. After that, vault contents are permanently deleted. If you hold an active Care Card, your account stays open so your Care Card and Emergency Profile keep working, but Free plan features are no longer available. |
| A paid plan ends or is cancelled | Paid access continues to the end of the paid period. A 90-day grace period follows, during which you can view, export or upgrade. Reminders are sent before deletion. At the end of the grace period, vault contents are permanently deleted. A paid account does not move onto the Free plan. |
| You close your account | Vault contents are permanently deleted and your account record is de-identified, subject to the records below. |
| After a subscriber passes away | Released items remain available to recipients for 12 months. A recipient may ask for one 90-day extension. Vault contents are then permanently deleted. |
| Release, verification and identity check documents | Kept for the minimum period required by law, then securely deleted, unless a dispute or legal hold applies. |
| Deletion record | A record that deletion took place (not the contents) is kept for 7 years and can be provided to the estate on request. |
| Billing and tax records | Kept for the period required by tax and corporations law (currently 7 years). |
| Activity and audit logs | Kept for the minimum period required by law, in de-identified form after account deletion. |
| Future Message recipient details | Deleted within 90 days after delivery, unless the recipient has their own Lyff account. |
| Identity verification records (ID Verification Service) | Identity attributes received through our ID Verification Service are kept for the minimum period required by law, then securely deleted, unless a dispute or legal hold applies. |
| Care Card and Emergency Profile | See clause 7A.11. |
9.2We may keep information longer if a legal hold, dispute or law requires it. De-identified information will not be re-identified except where required by law or court order.
10. Direct marketing
10.1We only send marketing emails if you opt in. Every marketing email has an unsubscribe link, or you can email us. Service, security, billing and grace period messages are not marketing and will continue while you have an account.
11. Automated processes and artificial intelligence
11.1Automated decisions
Lyff does not use computer programs to make decisions that significantly affect you without human involvement. In particular:
(a)No item is ever released automatically. Every Incapacity and Passing release is reviewed and approved by an authorised Lyff manager.
(b)Lyff Check-In only sends reminders. A missed check-in never triggers any action.
(c)Future Messages are sent automatically on the date you set, because that is your instruction.
(d)Identity verification for Guardians uses an automated document check through our ID Verification Service. If a check fails, the person can contact us for a manual review. Custodian checks are carried out by Lyff and reviewed by a person.
(e)The Emergency Profile is displayed automatically when a valid QR code is scanned and the profile is active. This is your instruction, not an automated decision by Lyff.
Automated security tools (such as sign-in limits and fraud detection) may temporarily block access to protect your account. You can contact us to have this reviewed.
11.2Support chatbot and concierge
Our support chatbot answers questions using Lyff's published help content. It cannot see your vault or account. Please do not type sensitive personal details into it.
If you use our human concierge service, the concierge can help you organise your vault but has no access to your vault contents.
We never use your vault contents to train artificial intelligence.
12. Access, correction and your choices
12.1You can view, download, update and delete your vault contents and most account details at any time in the Platform. You can also see who has accessed your items in your activity log.
12.2You may ask us for access to, or correction of, any other personal information we hold about you by emailing hello@lyff.com.au. We will respond within 30 days. We do not charge for requests unless providing access involves significant effort, in which case we will tell you the fee first.
12.3We may refuse a request only where the APPs allow, for example where it would unreasonably affect someone else's privacy. If we refuse, we will explain why in writing and how to complain.
12.4Nominated people (such as a Guardian or a sharing recipient) can decline a role or ask us to delete their details at any time, although this may stop a subscriber's sharing instruction for them from working.
13. Cookies
13.1Essential cookies keep you signed in and the Platform secure. They cannot be switched off.
13.2Analytics cookies (Google Analytics) help us understand how our website is used. We only use them with your consent, which you give or refuse through our cookie banner and can change at any time.
13.3Marketing cookies from HubSpot support website forms and our newsletter, only with your consent.
13.4We do not use advertising cookies that track you across other websites. Analytics and tracking tools are not used on our Safe Access page, and never inside your vault.
14. Children
14.1Lyff is for adults. You must be 18 or over to create an account or hold a vault, including on Complete Circle. If we learn that a person under 18 has created an account, we will close it and delete their information.
14.2You may store information about your children in your vault, and you may address a Future Message to a young person. Please consider sending it to a parent or guardian's email address. We do not verify the age of message recipients.
14.3The Care Card is for adults. You must be 18 or over to order a Care Card or activate an Emergency Profile. You may not create an Emergency Profile for a child.
15. Beta testers
15.1If you join our beta program, you use Lyff for real, and this Policy applies in full. We also collect the feedback, survey answers and ideas you give us, and use them to improve Lyff under the Beta Participation Agreement. Feedback is kept separately from your vault and we will not publish anything that identifies you without your permission.
16. Data breaches
16.1If we suspect a data breach, we will assess it promptly and within 30 days. If it is likely to cause serious harm, we will notify affected people and the Office of the Australian Information Commissioner (OAIC) as soon as practicable, and take steps to contain it. Any incident involving vault data or Emergency Profile data is treated as our highest priority.
17. Questions and complaints
17.1You can contact us about privacy as follows.
| Contact | Details |
|---|---|
| hello@lyff.com.au (please mark your email "Privacy") | |
| Post | Privacy Officer, Such is Lyff Pty Ltd, PO Box 189, Elwood VIC 3184, Australia |
| Response times | We acknowledge complaints within 5 business days and aim to resolve them within 30 days. |
17.2If you are not satisfied, you can contact the OAIC at www.oaic.gov.au, on 1300 363 992, or at GPO Box 5288, Sydney NSW 2001.
18. Changes to this policy
18.1We may update this Policy as the Platform or the law changes. For a significant change, we will email you at least 30 days before it takes effect. The current version is always at lyff.com.au/privacy.
19. Definitions
19.1In this Policy, the following terms have the meanings set out below.
| Term | Meaning |
|---|---|
| APPs | The Australian Privacy Principles in Schedule 1 of the Privacy Act |
| Care Card | A physical card and key tag that displays an Emergency Profile when its QR code is scanned |
| Custodian | A professional firm nominated by a subscriber to receive specific items for professional purposes, acting through one named contact person. One per paid vault. |
| Emergency Profile | A set of fields a subscriber chooses to complete for display through the Care Card |
| Future Message | A message created by a subscriber for delivery to a nominated email address on a selected date |
| Guardian | A trusted person nominated by a subscriber to receive specific items. One per paid vault. |
| Incapacity / Passing | A sharing status that releases an item only after the process in clause 7 |
| Lyff Check-In | A periodic reminder to review your vault. It never triggers a release. |
| Personal information | Has the meaning in the Privacy Act |
| Private item | An item protected by zero-knowledge encryption that Lyff cannot open and that is never released |
| Recovery Assistance | Lyff's identity-verified process to help a subscriber regain access to their account |
| Recovery Key | A code created when you set up your account, used to recover your account and Private items |
| Sensitive information | Has the meaning in the Privacy Act, and includes health information |
| Sharing status | The setting on each item: Private, Share now, or Incapacity / Passing |
| Vault contents | Everything a subscriber stores in their vault |
Questions about your privacy?
Email us and mark your message "Privacy". We acknowledge complaints within 5 business days and aim to resolve them within 30 days.
hello@lyff.com.au →