Qpher Legacy Privacy Notice

This notice is for the people a Qpher Legacy vault owner designates — not for account holders. If you have a Qpher account, our main Privacy Policy at qpher.ai/legal/privacy covers you as well.

Someone who uses Qpher Legacy (a "vault owner") named you as an heir or a confirmer for their encrypted document vault. You do not need an account, and you never pay anything. This notice explains what information about you we hold, why we hold it, and what you can ask us to do about it. Qpher LLC (8401 Mayland Dr Ste A, Richmond, VA 23294, USA — privacy@qpher.ai) is the data controller for that information.

The vault owner typed your name and email address into their legacy policy. That is all we hold at this stage, and it came from the owner — not from you. We use it only to operate the owner's policy: - telling you the designation exists (unless the owner chose a sealed designation, in which case you are not contacted until a claim begins); - contacting you if a claim is opened; - delivering the owner's documents to you if the owner's release policy completes. We do not use your details for marketing, and we never sell them.

If you open a claim, we collect your sworn statement that the owner has died, the legal name you type, and the date. These are kept in an append-only record as evidence of the basis on which the claim was made. If you claim without a claim code, we also collect a copy of a death certificate so a person can review it. If you are a confirmer, we record your decision and when you made it. When you accept documents, we record technical details of that acceptance (such as IP address and browser type) as evidence that the acceptance was yours.

We rely on: - performance of the vault owner's contract with us, and steps you ask us to take (Article 6(1)(b)); - our legitimate interests, and the owner's, in operating a reliable and fraud-resistant release process (Article 6(1)(f)); - the establishment, exercise or defence of legal claims. Because your details came from the vault owner rather than from you, Article 14 applies: the source of your information is the vault owner who designated you.

Service providers working under contract with us — cloud infrastructure, encrypted object storage, and transactional email. The current categories are listed in Section 6 of our Privacy Policy. If you open a claim, the vault owner's designated confirmers are shown your name and a partly hidden form of your email address, so that they can judge whether the claim is legitimate. They are not shown your documents. No one else, except where the law requires it.

Your contact details: while the owner's policy references you, or until you object. Claim records (your attestation, any death certificate, confirmer decisions): kept with the claim record on the schedule in Section 7.1 of our Privacy Policy. Released documents stay claimable for at least 24 months after release, so you have time to collect them.

**You can object at any time** by emailing privacy@qpher.ai. We suppress your contact record ourselves and tell the owner their policy needs review — you never have to raise it with the owner yourself. You may also ask for access to your data, or its deletion. If something has to be kept as evidence for a claim, we will tell you that and why. Washington and Nevada residents: our Consumer Health Data Privacy Policy at qpher.ai/legal/consumer-health-data also applies to claim attestations and death certificates. EEA and UK residents may complain to their supervisory authority. California residents have the rights described in Section 9 of our Privacy Policy.

We do not knowingly collect information online from children under 13. If a vault owner designates a minor as an heir, it is the owner who provides that information, and every claim-time step is carried out by the minor's parent or guardian. We then hold that adult's contact details for that purpose.

privacy@qpher.ai Qpher LLC, 8401 Mayland Dr Ste A, Richmond, VA 23294, USA Effective 2 August 2026. Version 1.0.