Privacy Policy

1. Introduction

CarryOn Technologies LLC, a CarryOn Enterprises Inc company (“CarryOn,” “we,” “us,” or “our”), is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our estate planning platform, including our website and related services (collectively, the “Service”).

2. Information We Collect

We collect information you provide directly to us, including:

• Personal identification information (name, email address, phone number)
• Date of birth — used to confirm you are 18 or older and to determine eligibility for age-based plans (New Adult 18–25, Seniors 65+)
• Gender (optional) — used only to word family relationships correctly in your family tree (for example “mother” or “father”); it is never used for marketing or profiling
• Account credentials (encrypted passwords)
• Estate planning data (beneficiary information, documents, checklists)
• Payment information (processed securely through Stripe)
• Communications (support messages, feedback)

3. How We Use Your Information

• Provide, maintain, and improve the Service
• Process transactions and send related information
• Send verification codes via email or SMS for two-factor authentication
• Respond to customer service requests and support needs
• Protect against fraud and unauthorized access
• Comply with legal obligations

4. SMS/Text Messaging

When you opt in to receive SMS messages from CarryOn™, you consent to receive text messages related to account verification and security (e.g., one-time passcodes for two-factor authentication). Message frequency varies based on your account activity. Message and data rates may apply.

You can opt out of SMS messages at any time by replying STOP to any message or by updating your preferences in your account settings. For help, reply HELP or contact us at the information provided below.

We do not sell, rent, or share your phone number or SMS opt-in data with third parties for marketing purposes. Your information is shared only with service providers who assist in delivering messages (e.g., Twilio).

5. Data Security

In plain language: your files are scrambled before they’re stored, with a separate lock for every family. They aren’t casually accessible to CarryOn staff — privileged access is restricted to defined administrative functions and is controlled and audited — and every time a file is opened, we write down who did it and when. Technically, we implement industry-standard security measures, including AES-256 encryption with per-estate keys and two-factor authentication. Your sensitive documents are encrypted at rest and in transit. Conversations with our AI features are retained as chat transcripts until you delete them and may quote documents you flag for AI analysis. AI requests are processed by xAI under a zero-data-retention configuration — xAI does not store your content after the response is returned. Under xAI’s published API policy, content sent through the API is also not used to train their models.

6. Data Sharing and Disclosure

We may share your information only in the following circumstances:

• With your designated beneficiaries, as configured by you
• With service providers who perform services on our behalf (e.g., payment processing, email delivery, SMS messaging)
• With Meta (Facebook) and Google (Analytics) only if you click “Allow” on our analytics notice: their cookies tell us which ads bring families to the site and where people stop during sign-up. Nothing you store in CarryOn™ is ever shared, and declining changes nothing about the service.
• To comply with applicable laws, regulations, or legal processes
• To protect the rights, property, and safety of CarryOn™, our users, or others

Who actually touches your data (our service providers). We run CarryOn™ on a small number of well-known companies. Each one sees only what it needs to do its job, under a contract that forbids using your data for anything else:

• Stripe (United States) — processes payments. Your card number goes straight to Stripe; we never see or store it. Stripe sees your name, e-mail and what you bought.
• Render (United States) — hosts the servers that run CarryOn™. Every request to the app passes through them, encrypted in transit.
• Vercel (United States) — hosts this website and the app screens you see in your browser. It does not store your account data. Its Speed Insights tool collects anonymous page-load timings.
• Amazon Web Services, S3 (United States) — stores the files and photos in your vault. Files are encrypted with AES-256-GCM before they are written; Amazon holds ciphertext, not documents.
• MongoDB Atlas (United States) — the database for your account, estate, checklist and message records. Encrypted at rest.
• Resend — sends our e-mails (verification codes, reminders, notices). Sees your e-mail address and the message itself.
• Twilio — sends SMS verification codes. Sees your phone number and the code.
• xAI (Grok) — powers the Estate Guardian assistant and its checklist suggestions. When you ask it something, it receives your question and the parts of your estate summary needed to answer; it never receives your vault files.
• Google — address auto-complete while you type an address (sees what you type in that field); web fonts (sees your IP address); Google Analytics on our sign-up steps and YouTube videos only after you click Allow or press play.
• Meta (Facebook) — the Meta Pixel, only after you click Allow on our analytics notice.
• Sentry — error monitoring. When something breaks, it receives a technical report (page, browser, error text). We strip personal data from these reports.
• Apple App Store / Google Play — if you subscribe inside our mobile apps, they handle the purchase and send us a receipt, never your card.
• HighLevel (LeadConnector) — the booking calendar on our Speak With Us page. Sees the details you enter when you book a call.

We will update this list before adding a new provider that handles personal data. Questions: privacy@carryon.us.

7. Data Retention

We retain your personal information for as long as your account is active or as needed to provide you with our services. You may request deletion of your account and associated data by contacting us.

8. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access, correct, or delete your personal data
• Object to or restrict processing of your data
• Data portability
• Withdraw consent at any time

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new policy on this page and updating the “Last updated” date.

10. Contact Us

For data access, correction, deletion, or portability requests, contact: privacy@carryon.us

For general questions about this Privacy Policy or our data practices, contact: support@carryon.us