Privacy Policy

Last updated: 31 October 2026

1. Introduction

Flow Estate ("we", "our", or "us") is committed to protecting your privacy and personal information in accordance with the Privacy Act 2020 and other applicable New Zealand laws. This Privacy Policy explains how we collect, use, disclose, and protect your personal information.

2. Information We Collect

We collect the following types of personal information:

  • Identity information (name, date of birth)
  • Contact information (email address, phone number, physical address)
  • Estate-related information (will details, asset information, beneficiary details)
  • Professional information (role, organization)
  • Technical information (IP address, browser type, device information)
  • Usage information (how you use our services)

3. How We Use Your Information

We use your personal information for the following purposes:

  • To provide and maintain our services
  • To facilitate estate administration processes
  • To communicate with you about our services
  • To improve our services and develop new features
  • To comply with legal obligations
  • To protect our rights, property, or safety, or that of our users or others

4. Why We Collect It

We collect personal information only for lawful purposes connected with providing Flow Estate, and only where it is necessary for those purposes (Privacy Act 2020, information privacy principles 1–4). Most estate information is entered by the law firm or executor administering the estate. We collect it on their behalf and use it only to provide the service to them.

5. Information Security

We implement appropriate technical and organizational measures to protect your personal information, including:

  • Encryption of data in transit (TLS) and at rest by our database and storage provider
  • Estate documents kept in private storage and shared only through short-lived signed links
  • Access controls that limit each user to the estates and law firm they belong to
  • Passwords stored only as salted hashes, and invite links stored only as one-way hashes

Our database and document storage are hosted in Singapore. Our application servers are in the United States. See section 8 for the full list of overseas service providers.

6. Data Retention

We retain your personal information for as long as necessary to fulfill the purposes for which we collected it, including for the purposes of satisfying any legal, accounting, or reporting requirements.

For estate administration data, we typically retain information for 7 years after the completion of the estate administration process, in accordance with New Zealand legal requirements.

7. Disclosure of Your Information

We may share your personal information with:

  • Service providers who perform services on our behalf
  • Professional advisers (lawyers, accountants, etc.) as necessary
  • Government bodies or regulatory authorities as required by law
  • Other parties involved in the estate administration process, with your consent

We require all third parties to respect the security of your personal information and to treat it in accordance with the law.

8. Overseas Transfers

Flow Estate uses the following service providers, which store or process personal information outside New Zealand:

  • Supabase (database and document storage, hosted in Singapore)
  • Render (application servers, United States)
  • Netlify and Cloudflare (website hosting and network delivery, global)
  • Resend (email delivery, United States)
  • APLYiD (identity verification, when you are asked to verify your identity)

Before we disclose personal information overseas we take reasonable steps to make sure it is protected in a way that is comparable to the Privacy Act 2020 (information privacy principle 12), including through our contracts with these providers.

9. Your Rights

Under the Privacy Act 2020, you have the right to:

  • Ask whether we hold personal information about you, and get access to it
  • Ask us to correct personal information about you

You can also ask us to delete your information. Where the information belongs to an estate administered by a law firm, we will refer the request to that firm, which decides what must be kept.

To make a request, contact us using the details below. We will respond within 20 working days.

10. Cookies and Tracking Technologies

We do not use advertising or analytics cookies. When you sign in, we use one cookie to keep you signed in and store your session in your browser's local storage.

11. Privacy of Children

Our service is not intended for use by children under the age of 18. We do not knowingly collect personal information from children under 18. If we become aware that we have collected personal information from a child under 18 without verification of parental consent, we will take steps to remove that information from our servers.

12. Changes to This Privacy Policy

We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date.

You are advised to review this Privacy Policy periodically for any changes. Changes to this Privacy Policy are effective when they are posted on this page.

13. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us:

  • By email: privacy@flowestate.co.nz

You also have the right to lodge a complaint with the New Zealand Privacy Commissioner if you believe that we have violated your privacy rights. You can contact the Office of the Privacy Commissioner at: