Legal
Privacy policy
Last updated: November 2026. This is a translation, the German version prevails.
1. Controller
Eneros GmbH, Engeldamm 60, 10179 Berlin, Germany, represented by its managing director Malte Berresheim. Email: support@erbnis.com
2. What we process
- Account data: name, email address, hashed password or sign-in method
- Vault contents: entries, documents, letters and instructions you add
- Health data, only if you enter it on your emergency card (section 8)
- Trusted people: name, email and relationship (section 9)
- Payment data: processed by Stripe, we only hold the subscription status
- Usage data: technical logs and an audit log to protect your account
- Communication: what you send us by email or form, cancellations and withdrawals
- Newsletter: your email address, if you sign up
- Visitor statistics: only with your consent (section 7)
3. Legal bases and purposes
- Art. 6(1)(b) GDPR: providing your account and vault, carrying out your release rules, payments, cancellations and withdrawals
- Art. 6(1)(a) GDPR and § 25(1) TDDDG: visitor statistics and newsletter, based on your consent
- Art. 9(2)(a) GDPR: health data on your emergency card, based on your explicit consent
- Art. 6(1)(c) GDPR: statutory retention of invoices
- Art. 6(1)(f) GDPR: securing our systems, preventing abuse, internal team notifications and aggregated search statistics
Providing data is voluntary, but without an email address we cannot create an account. We do not use automated decision-making within the meaning of Art. 22 GDPR. Releases follow only the rules you set yourself.
4. Recipients
| Provider | Purpose | Location |
|---|---|---|
| Lovable | Hosting of website and application, database (Supabase), sending email, visitor statistics after consent | EU, email EU/US |
| Cloudflare | Delivering the website, protection against attacks and bots | worldwide, EU/US |
| Stripe | Payment processing for subscriptions | EU/US |
| Slack (Salesforce) | Internal notifications to our team: interview started or finished, registration, newsletter, purchase, cancellation and withdrawal. This can include name, email address and rough location (country or city), never vault contents. | US |
| Mailbox for support requests, sign-in with Google if you use it. Search Console only gives us aggregated search statistics. | EU/US |
These providers act on our behalf under data processing agreements (Art. 28 GDPR) where required. For transfers to the USA we rely on the EU-US Data Privacy Framework where the provider is certified, otherwise on EU standard contractual clauses.
5. Retention
We keep your data for as long as your account exists. After you delete your account, your data is removed within 30 days, including from backups as they rotate. Invoices are kept for the statutory period of up to 10 years. Cancellations and withdrawals are kept for 3 years as evidence.
6. Your rights
You have the right of access, rectification, erasure, restriction, data portability and objection (Art. 15 to 21 GDPR). You can withdraw consent at any time with effect for the future (Art. 7(3) GDPR). An email to support@erbnis.com is enough.
You may also complain to a supervisory authority. Ours is the Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59-61, 10555 Berlin, mailbox@datenschutz-berlin.de.
7. Cookies and statistics
Before you decide, only necessary storage is used. With your consent we load the visitor statistics of our host Lovable. They record page views, origin, browser language and load times through our own domain, in session storage instead of a cookie. They never run on release links, the emergency page or inside the app, and they do not record clicks or vault contents. We do not use session recording.
| Name | Purpose | Type | Duration |
|---|---|---|---|
| erbnis.consent.v1 | Stores your cookie decision | Necessary | until you change it |
| sb-…-auth-token | Keeps you signed in | Necessary | until you sign out |
| erbnis.locale | Remembers your language | Necessary | stays in the browser |
| erbnis_interview_v1 | Keeps your interview answers on this device until you save them | Necessary | until saved or deleted |
| __cf_bm | Cloudflare: telling people and bots apart | Necessary | 30 minutes |
| __dpl | Lovable: delivering the website | Necessary | session |
| __stripe_mid, __stripe_sid | Stripe: fraud prevention, only once you open checkout | Necessary | up to 1 year / 30 minutes |
| session-id | Visitor statistics: random session ID in session storage, not a cookie | Statistics, with consent only | until the tab is closed |
8. Emergency card and health data
If you activate the emergency card, anyone with the link or QR code can see the details and documents you selected, without an account and without a waiting period. This can include health data. We process it only with your explicit consent, given when you activate the card. You can withdraw it any time by deactivating the card. Every access is logged and you are notified.
9. Trusted people
If someone names you as a trusted person, we receive your name, email address and relationship from them. We use these details only to reach you and to carry out their release rules (Art. 6(1)(f) GDPR). You can object at any time and ask us to remove them.
10. Deceased users
The GDPR does not apply to deceased persons (Recital 27). Under German law, digital contracts generally pass to the heirs (§ 1922 BGB; BGH, 12 July 2018, III ZR 183/17). Named recipients receive released contents through a signed, time-limited link.
11. Further pages
See also the security page, terms and imprint.