Privacy notice
Who is responsible
LegacySteps is run by Alderidge Fusion Limited, registered in Ireland, company number 816930. You can contact us about your data at derek@legacysteps.ie or 087 759 9848.
Who is responsible depends on the step. When your funeral director enters the first details at the arrangement and invites you, the funeral director is the data controller and LegacySteps processes those details for them under a written agreement. From the moment you open your case and accept the terms, Alderidge Fusion Limited is the data controller for your case: the organisations you choose, the letters, the replies and everything else in it. Your funeral director remains the controller for its own records and sees only how far your case has got, never its contents.
What we collect and why
We only ask for information that at least one organisation you have chosen to notify will need. We do not collect the cause of death, card numbers, online banking details or a copy of the will.
| Information | About whom | Why we need it |
|---|---|---|
| Full name, date of birth, date of death, last address | The deceased | Every organisation needs these to find their records |
| Marital status, whether the home was owned or rented | The deceased | Decides which organisations and actions apply |
| Account or policy references you already know | The deceased | Optional. Helps the organisation find the account faster |
| Death certificate or coroner's interim certificate (a scan you upload) | The deceased; the informant named on it | Most organisations require it with the notification |
| Your name, email, mobile number and relationship to the deceased | You, the family representative | To run your account, send your letters, receive replies, and remind you by email or text when something needs you |
| Name and email of anyone you invite to help | Co-administrator | To share access with a sibling, spouse or solicitor |
| Letters sent, to whom, when, reminders sent, and replies received | The deceased and you | Your tracker, and proof of what was sent if it is ever disputed |
| Balances at the date of death and refunds due, as reported by organisations and entered by you | The deceased's estate | Optional. Your estate summary, for probate |
| The date of the appointment to register the death | You | Optional, entered by your funeral director. To remind you the day before |
| Your private notes on each task | You | Your own record. Nobody else reads them |
| Funeral director staff name, email and firm; the firm's bank details | Funeral director staff and firm | To run their dashboard, set up families, and tell banks where to pay the funeral account |
| Sign-in, security and activity logs | All users | To detect misuse and investigate problems |
A PPS number is only ever used in the letters to Revenue and the Department of Social Protection. LegacySteps does not use it for anything else. It is deleted automatically as soon as those letters have been sent, or when the case is closed, whichever comes first.
If you use "Paying for the funeral"
This part of the service is optional and only switched on by your funeral director with your agreement. If you use it, we also hold: your funeral director's invoice; which banks, credit unions, insurers or other organisations have been asked to pay it; what has been paid; and, for an application to the Department of Social Protection for help with funeral costs, the applicant's name, date of birth and address and the date the forms were sent in. With your written authority, given on screen, LegacySteps writes to those organisations and to the Community Welfare Service on your behalf, and their replies about payment go to your funeral director.
Our legal basis
Each thing LegacySteps does has its own basis in data protection law:
| What we do | Our basis |
|---|---|
| Your funeral director entering your details and the details of the deceased to set the case up | The funeral director's contract with you; LegacySteps acts for the funeral director for this step |
| Running your case: the organisations you choose, the letters sent in your name, replies, documents, the estate figures | Our contract with you, made when you accept the terms on first sign-in |
| Sending the PPS number to Revenue and the Department of Social Protection | Our contract with you: you choose to send those two letters, and those bodies require the PPS number to find their records. The duty to tell them of the death is yours or the estate's, not ours; LegacySteps carries it out on your instruction |
| Using the AI service to fill in forms, draft the notice, read documents and answer questions | Our contract with you, where the task is part of the service; the funeral director's contract with you for the arrangement form. You can type instead of dictating and can leave any AI feature unused |
| Reminder emails | Our contract with you; you can stop them at any time |
| Optional text messages (a nudge when a reply is waiting, a registration reminder) | Your consent, given by ticking the unticked box beside your mobile number in About you, or the switch in Settings; we record the date and time. Until you tick it no reminder texts are sent. Withdraw it with the stop link in any text or in Settings and the service continues by email. The one text your funeral director may send to pass you your link is part of the service, not a reminder |
| Asking organisations to pay the funeral account from the deceased's accounts | Your consent, given by ticking the authority in Who can pay; withdraw it by telling us or your funeral director before the requests go |
| Security and activity logs, and the six-year record of who was told and when | Our legitimate interest in running the platform safely and in being able to show what was sent if a notification is ever questioned. We have weighed this against your interests: the logs hold no contents, are seen by nobody outside LegacySteps, and are deleted on the schedule below |
| Showing your funeral director how far your case has got (counts only, never contents) | Our legitimate interest, and the funeral director's, in knowing the service they provided is working for you |
The minimum the service runs on is the deceased's name and date of death, your name, and an email address or mobile. Without those a case cannot be set up. Everything else is optional and only improves what the letters can say. The person who has died is outside data protection law, but we treat their information to the same standard because you expect it and the organisations receiving it require it.
Where your information comes from
Most of it comes from you. Some comes from other people, and you can see all of it in your case:
- From your funeral director: the details taken at the arrangement (the deceased's details, your name, email and mobile, and the organisations mentioned), the death notice draft, the registration appointment if they book it for you, and their invoice if they add it. Your funeral director may enter these on their own dashboard, or send them to us, sometimes as a photograph of their arrangement sheet, for us to enter on their behalf. When we do that we act on their instruction and enter only what they sent; the photograph or message is deleted within seven days of your account being set up.
- From anyone you add as a helper: what they enter in the case.
- From the organisations you write to: their replies, including balances, references and what they ask for, which land in your case against the right letter.
- From a photographed document: what the AI service reads from a certificate, statement or letter you photograph, shown to you to check.
If your funeral director is not on LegacySteps and you ask us on the families page to contact them, we keep the funeral director's name and town, your name, email address and mobile if you give it, and use them only to contact the funeral director and to tell you when the service is ready. Our basis is your request. We do not tell the funeral director anything about the death beyond the fact that a family has asked. These details are deleted after ninety days.
Letters, reminders and replies sent in your name
Letters go out in your name, either by email from LegacySteps or printed for you to post. Where a letter was sent by email and the organisation has not replied, LegacySteps sends a reminder in your name after ten working days and weekly after that, up to six times. Replies come back into your case and are also emailed to you. If a reply has not been dealt with, we remind you by email and, where you have given a mobile number, by text. None of these reminders includes the content of a reply.
If you buy the optional pension search, LegacySteps writes in your name to every pension provider, life company and scheme administrator on its list (the Irish list, and the UK list if you tell us the deceased worked in the UK). Each letter carries the deceased's name, date of birth, last address, date of death, any maiden name, the employers you list, and the PPS number (or National Insurance number) if it is still held on the case, because providers need it to find a record; the death certificate you uploaded is attached. Replies come into your case the same way as other replies, and the reminders described above apply. The search is a paid service, so the payment and your agreement to the terms are recorded against your case.
If the deceased owned property, you can ask a valuer for a probate valuation from your case. That request goes in your name to the valuer you choose, with the name of the deceased, the date of death and the address of the property, and their reply comes straight to your own email, not into LegacySteps. The value you then enter is kept with your estate figures. Valuers shown as recommended by your funeral director are chosen by your funeral director, not by LegacySteps. Firms on the shared valuer panel pay LegacySteps a referral fee when a valuation they carry out is completed; we never see the value they give you, and the fee does not depend on it. Panel valuation requests are deleted two years after the valuation is completed or closed.
Who is responsible for what
Your funeral director is responsible in its own right (a separate data controller) for what it holds about the deceased and your family in its own records, including the arrangement sheet or invoice it sends us to set you up, and for what its staff type or dictate when setting you up. LegacySteps (Alderidge Fusion Limited) is responsible for your case and everything in it. Each of us answers to you for our own part. A funeral director never sees the contents of your case, only the progress described below.
Who can see what
- You and anyone you invite see everything on your case.
- Your funeral director sees the name and dates they entered to set you up, a count of how many tasks are done, waiting or still to do, and whether a reply has been waiting more than ten days (not what it says). If you use "Paying for the funeral", they also see where each payment request stands and receive the organisations' replies about payment. They never see your letters, your other replies, your references, your certificate or your notes.
- On an assisted case, where you have asked your funeral director's staff to complete the case with you, the staff member who set it up and the funeral home's office email receive the replies, so that they can act on them with you.
- LegacySteps staff have no standing access to the content of your case. If you ask us for help, we open a time-limited, logged window to look at what is needed.
- Pension providers and scheme administrators, if you buy the pension search, each receive the enquiry letter described above and the death certificate.
- A valuer you ask for a probate valuation receives your request, your name and contact details, the name of the deceased, the date of death and the address of the property.
- Organisations you notify receive only the letter you send them, the certificate you attach, and, for payment requests, the funeral director's invoice and any form you have signed. They then handle it under their own rules.
These limits are enforced in the database itself, not just hidden in the screens.
Who processes data for us
We use a small number of service providers, each under a written data processing agreement. In short: your case is stored in Ireland; the providers below that are outside the EU each handle one job, such as delivering an email, and see only what that job needs.
- Supabase (database and file storage, EU region, Ireland) stores the data.
- Vercel (web hosting) serves the pages and sees only your device's address and the page requested, never your case. Vercel is a US company; the transfer is covered by the standard contractual clauses in its data processing agreement.
- Resend (email delivery) sends invitations, reminders and the letters you choose to send by email, and routes replies back into your case. Resend is a US company; the transfer is covered by the standard contractual clauses in its data processing agreement.
- Twilio (text messages) sends the reminder texts, from the sender name LegacySteps. It receives only your mobile number and the text itself. Twilio is a US company; the transfer is covered by the standard contractual clauses in its data processing agreement.
- Anthropic (artificial intelligence service) reads the text or image sent to it for one task at a time, as described under "Help from an AI service" below, and returns the result. Anthropic is a US company; the transfer is covered by the standard contractual clauses in its data processing terms, and what is sent is not used to train its models.
Stripe handles the funeral director's payments to us, and a family's card payment for the optional pension search. For that payment Stripe receives your email address and the card details you enter on its own page; LegacySteps never sees your card number.
Help from an AI service
Some parts of LegacySteps use an artificial intelligence service provided by Anthropic: filling in the form from what is said at the arrangement, drafting the death notice, reading a photographed certificate, statement or letter, and answering questions through Ask a question. For each of these, only the text or image needed for that task is sent, it is processed to give the result, and it is not used to train the service. Anthropic may keep what is sent for a short period for safety monitoring under its published terms, after which it is deleted; we keep our own copy of the result in your case and never retrieve anything from Anthropic. The information sent can identify you or the deceased (a name on a letter, for example); the safeguards are the contract and standard contractual clauses described above and the removal of the PPS number before anything is sent. Anthropic does not pass it to anyone else. Your PPS number is never sent to it: it is held separately, and if it is said aloud at the arrangement it is removed before the conversation is sent. Everything the service produces is shown to you or to your funeral director to check; it decides nothing.
The microphone button uses the speech recognition built into your browser (Google's in Chrome and Edge, Apple's in Safari) to turn your voice into text. The audio goes to that company's service to be transcribed; LegacySteps never receives or keeps the audio, only the text. How long the browser maker keeps the audio is governed by its own privacy policy, not by us: Google's at policies.google.com/privacy and Apple's at apple.com/legal/privacy. If you would rather no audio left your device, type instead; every microphone field is also a text field.
The funeral director register
Every funeral director listed on LegacySteps has a number so that your case links to them. The register of funeral directors in Ireland was built from the publicly available member list of the Irish Association of Funeral Directors and holds only business details: the name, address and phone number of the funeral home. A funeral director who would like their listing changed or removed can write to derek@legacysteps.ie and it is done the same day.
We do not sell your personal information or use it for advertising. We disclose information only as described in this notice: to the service providers that help us operate LegacySteps, and to the organisations you choose to contact. The safeguard for each provider outside the EU is stated beside its name above; if you would like to know more about the safeguards for a particular transfer, or to see the relevant clauses, write to derek@legacysteps.ie.
How long we keep it
- While your case is open, everything above is kept.
- Your case closes when you mark it complete, or after twelve months with no activity. We email you thirty days before an inactivity closure with a one-click option to keep it open.
- Six months after closure the case content is deleted: the deceased person's details, the certificate, references, letters, replies, the estate summary, the invoice and payment records, and notes. We email you thirty days beforehand so you can ask for a copy of your own records first.
- Your acceptance of the terms (your name, the date and the version you accepted) is kept for six years from the date you accepted, the period within which a contract can be disputed in Ireland and the UK, and is then deleted by the same nightly process.
- A short record of each notification is kept for six years, holding only the deceased person's name, the organisation told, the date and which family member sent it, because it is the evidence if a notification is ever disputed. It holds no addresses, numbers, contents or replies.
- Photographs and messages a funeral director sends us so that we can set you up on their behalf are deleted within seven days of your account being set up; only what was entered on the platform is kept.
- Copies of the emails and texts we send you, and the questions you ask through Ask a question, are deleted after ninety days. Activity logs are kept for twelve months and the record of any access by our administrator for twenty-four months. Backups roll off after thirty days.
- You can ask us to delete your case at any time. Deletion follows seven days later, during which it can be undone, and we confirm by email when it is done. Deletion covers the database, uploaded files and the copies of emails and texts we hold; copies already delivered to organisations or held in their systems are theirs, and backups roll off within thirty days.
Your rights
You can see your information inside your account at any time, and correct almost all of it yourself. To get a copy of everything we hold, correct something you cannot change on screen, or have your case deleted, write to derek@legacysteps.ie. You can also exercise any of your other rights under data protection law, including restriction, portability and objection, the same way. We answer within one month; if a request is unusually complex we may take up to two months more and will tell you why within the first month. If you cannot get into your account, write from the email address on the case or ring 087 759 9848 and we will confirm who you are by sending a code to the email or mobile on the case.
Deletion is not absolute: when you ask us to delete your case we delete its contents within seven days, but we keep the short record of who was told and when, and your acceptance of the terms, for the periods below, because we may need them if a notification or the agreement is ever questioned. If a legal claim or dispute is under way when deletion falls due, the records it concerns are kept until it is resolved and then deleted. If you are unhappy with how we handle your information, you can complain to the Data Protection Commission at dataprotection.ie. If you are in the United Kingdom, you can instead complain to the Information Commissioner's Office at ico.org.uk; UK families' data is held in Ireland, in the EU, which the UK recognises as providing adequate protection, and the rights described here are the same under UK data protection law.
A request about the deceased person's information from someone who is not on the case is not answered without the family representative's agreement, because we cannot verify who they are.
Security
All data is encrypted in transit and at rest. You sign in with a one-time code sent to your email; codes work once and expire. Sessions end after thirty minutes of inactivity. The death certificate and any invoice or signed form are stored in a private area and only ever shown through a short-lived link to someone signed in with access to that case. Every sign-in, every view of a certificate and every letter sent is written to a log that cannot be edited.
Cookies and local storage
LegacySteps uses only what is needed to keep you signed in and to remember where you were on the page. There are no advertising or tracking cookies and no third-party analytics.
Changes
If this notice changes in a way that affects you, we will tell you by email before the change takes effect. This notice was last updated on 17 October 2026.