Who We Are
Holdfast is a digital estate management service operated by Nexus SecTech Ltd ("we", "us", "our"), registered in England and Wales. Company No. 17126982. We are registered with the Information Commissioner's Office (ICO) as a data controller.
Contact: hello@nexus-sec.tech
What We Collect
We collect and process the following personal data:
- Account data — your name and email address, provided when you create a vault
- Recipient data — names and email addresses of people you designate to receive your vault
- Encrypted vault data — the contents of your vault, encrypted client-side before transmission. We never have access to the plaintext contents.
- Check-in activity — timestamps of your periodic check-ins and missed check-in events
- Payment data — billing information processed by Stripe. We do not store card details.
- Usage data — basic server logs, IP addresses, and request metadata for security and operational purposes
- Analytics data — anonymised page view data collected via Plausible Analytics. No personal identifiers. Never linked to your account.
Zero-Knowledge Architecture
Your vault contents are encrypted in your browser using AES-256-GCM before being sent to our servers. Your passphrase is never transmitted to or stored by us. This means we are technically unable to read, access, or recover the contents of your vault. This is by design.
How We Use Your Data
- To operate the Holdfast service and deliver your vault to recipients when triggered
- To send check-in reminder, escalation, and delivery notification emails
- To process subscription payments via Stripe
- To respond to support enquiries
- To comply with legal obligations
Legal Basis (UK GDPR)
- Contract — processing necessary to deliver the service you have signed up for
- Legitimate interests — security logging, fraud prevention, and service improvement
- Legal obligation — where required by applicable law
Firm Accounts — Additional Processing
This section applies to solicitors, estate planners, and other professionals using Holdfast Firm.
Client connection data. When you invite a client to connect their vault to your Firm account, we store the client's email address, connection status, and associated metadata (check-in status, delivery status, connected date, nudge history) in your firm dashboard. This data is used solely to provide you with the monitoring service you have contracted for.
Nudge emails. Holdfast sends reminder emails to your clients on your behalf when you use the nudge feature. These emails identify you (or your firm) as the requesting party. Nudges are rate-limited to one per client every 48 hours. You are responsible for ensuring nudge communications are appropriate within the context of your client relationship.
Solicitor alert emails. When a connected client misses a check-in, has their vault delivered, or disconnects from your firm, we send automated alert notifications to your registered email address. These alerts contain client names and email addresses you already hold as part of the professional relationship.
Data export. Your firm dashboard allows you to export your client table as CSV or PDF. Exported data includes client names, email addresses, check-in status, and vault metadata. Once exported, this data is under your control and subject to your own data protection obligations. We do not retain copies of exported files.
Data controller responsibilities. As a solicitor or professional using Holdfast Firm, you remain the data controller for your client relationship. Holdfast acts as a data processor in respect of client metadata stored on your dashboard. You are responsible for ensuring your clients are aware that you have connected their Holdfast vault to your account and that you will receive their vault upon delivery. We recommend disclosing this as part of your standard client engagement or estate planning documentation.
Firm account data. We collect your representative name, firm name, and billing email in addition to standard account data. This is used to personalise client invitation emails and nudge reminders sent on your behalf, and to administer your subscription.
Data Processing Agreement. A formal Data Processing Agreement (DPA) under Article 28 UK GDPR is available at holdfast-co.uk/firm/legal/dpa. For questions or to request a countersigned copy, email hello@nexus-sec.tech.
Third-Party Services
- Supabase — database hosting (EU region). Stores encrypted vault data, recipient details, and account metadata.
- Resend — transactional email delivery for check-in reminders and vault delivery notifications
- Stripe — payment processing. Stripe's own privacy policy applies to payment data.
- Vercel — application hosting and serverless infrastructure
- Plausible Analytics — privacy-friendly, cookieless analytics. No personal data. No cookies. GDPR compliant.
- Google LLC (Google Workspace) — waitlist lead capture. Email addresses submitted via the Holdfast waitlist form are stored in Google Sheets with EU data residency. Google's Data Processing Amendment is in force. See workspace.google.com/terms/dpa.
We do not sell your data to third parties. We do not use your data for advertising.
Data Retention
- Account and vault data are retained for as long as your account is active
- Vault data is never deleted due to payment lapse — only editing is restricted
- Client connection records are retained until the firm account is closed or the connection is revoked
- You may request deletion of your account and all associated data at any time by contacting us
- Delivery tokens expire after 30 days of issue
Your Rights
Under UK GDPR you have the right to access, correct, erase, restrict, port, or object to the processing of your personal data, and to lodge a complaint with the ICO at ico.org.uk. Contact us at hello@nexus-sec.tech to exercise any of these rights.
Cookies & Analytics
Holdfast does not use tracking or advertising cookies. We use localStorage solely to store session preferences and theme settings. Plausible Analytics is cookieless and collects no personal data.
Changes to This Policy
We may update this policy from time to time. Material changes will be communicated via email to registered users. The effective date above will be updated accordingly.