Legal · v1
Privacy Policy
We collect as little as we can, and we encrypt what we must keep.
Who we are
lastword.to ("we", "us") operates the lastword.to service and is the data controller for the personal data described in this notice. Contact us about privacy at privacy@lastword.to.
What we collect, why, and on what legal basis
- Account data (email, display name, password hash) — to create and operate your account. Legal basis: performance of a contract.
- Encrypted instructions you create — to store and deliver per your switch settings. Legal basis: performance of a contract.
- Activity and security logs (sign in/out, edits, switch changes, email, IP address, user agent) — to operate the Service, investigate abuse, and protect accounts. Legal basis: legitimate interests (security and fraud prevention) and legal obligation.
- Payment metadata (transaction ID, amount, country, last 4 of card via our processor) — to confirm purchases, handle billing inquiries, and meet tax/accounting requirements. We never see full card numbers. Legal basis: performance of a contract and legal obligation.
- Support messages you send us — to respond to you. Legal basis: legitimate interests.
How we protect it
Instruction contents are encrypted server-side with per-user keys before being written to the database. Authentication uses industry-standard hashing and optional TOTP 2FA. Database access is gated by row-level security policies. Data is transmitted over TLS.
Who we share it with
- Paddle.com Market Ltd — our Merchant of Record. Paddle processes payments, handles subscription and billing operations, tax compliance, invoicing, and customer service for orders. See Paddle's privacy policy.
- Infrastructure and service providers — hosting, database, email delivery, and error monitoring vendors acting as our processors under contract.
- Recipients you designate — when your dead man's switch fires, your encrypted instructions are delivered to the email addresses you specified.
- Professional advisers (legal, accounting) and authorities where required by law.
We do not sell personal data and do not use it for advertising.
International transfers
Some of our service providers (including Paddle) operate in jurisdictions outside your country of residence. Where required, we rely on Standard Contractual Clauses or equivalent safeguards.
How long we keep it
- Account and instruction data: for as long as your account exists.
- Unpaid accounts with no activity for 1 year are deleted automatically.
- Security and access logs: up to 12 months, then deleted or anonymised.
- Payment and tax records: as long as required by tax and accounting law (typically 6–10 years), held by Paddle as Merchant of Record.
When you delete your account, your account and instruction data are removed irreversibly and any pending execution is cancelled.
Your rights
Subject to applicable law (including the GDPR for users in the UK/EEA), you have the right to access, rectify, erase, restrict, or port your personal data, to object to certain processing, to withdraw consent where processing is based on consent, and to lodge a complaint with your local data protection authority. To exercise any of these rights, email privacy@lastword.to. We respond within one month.
Cookies
You can review our cookies and manage your preferences by clicking on the cookie icon in the bottom left of the page.
Changes
We may update this notice from time to time. Material changes will be communicated by email or in-app notice before they take effect.