← Back to Levamio Bereavement Guide
Privacy Policy “Levamio Bereavement Guide” / “Levamio Nachlass-Lotse” (app for iOS and Android)
This English version is provided for convenience. In case of doubt the German version prevails, without prejudice to mandatory consumer and data protection law.
1. Controller
NEXTLEVEL CORPORATE SERVICE PROVIDER - FZCO, Building A1, IFZA Business Park, Dubai Digital Park, Dubai Silicon Oasis, Dubai, United Arab Emirates (DIEZ License No. 67837), represented by Tassilo Peter Seitz. Levamio is a service of NEXTLEVEL CORPORATE SERVICE PROVIDER - FZCO (“we”, “us”).
Email for data protection questions and exercising your rights: [email protected] (general support: [email protected])
Data protection officer: No data protection officer has currently been appointed. Please contact the controller at the address above.
2. Summary
- You do not need an account. We do not know your name or email address.
- Task list, deadlines, reminders, contracts and letter details stay on your device – encrypted. They are not transferred to us.
- Only if you use the wording help (AI) and have expressly consented beforehand, we send the letter text with placeholders instead of your details via our server to our AI provider Anthropic (USA). We do not store it.
- Sharing with family happens through your device's share menu – not via our server.
- No tracking, no advertising, no analytics tools.
3. Overview: what we process, why, and on what legal basis
| Purpose | Data | Legal basis |
|---|---|---|
| Tasks, deadlines, contracts and letters on your device | Country, date of death and date you learned of it (optional), name of the person who died (optional), task progress, who is responsible, notes, contract details, details for letter templates | No transfer to us. Storage on your device at your request (Sec. 25(2) no. 2 TDDDG); Art. 6(1)(b) GDPR |
| Wording help (AI) | Letter text in which the details you entered have been replaced with placeholders and phone numbers, email addresses, account numbers and long digit sequences removed; chosen tone and language; consent version and age confirmation | Art. 6(1)(a) GDPR (your express consent) |
| Abuse and cost protection for the wording help | Random device ID (generated in the app, not a hardware ID), on the server only as a salted hash with counters; IP address (IPv6 shortened to /64), on the server only as a daily re-salted hash with a counter | Art. 6(1)(f) GDPR (protection against abuse and costs); storing the device ID on your device: Sec. 25(2) no. 2 TDDDG |
| Purchase of the full version and checking whether it is unlocked | Random device ID as customer ID at RevenueCat, purchase status, store receipts, product, store country, device and app information | Art. 6(1)(b) GDPR |
| Deadline reminders | Deadline date; local notification on your device with neutral text without names or content | Sec. 25(2) no. 2 TDDDG; Art. 6(1)(b) GDPR |
| Sharing with relatives | Overview or file with task progress that you send yourself via the share menu to recipients of your choice | Your own decision; we receive nothing |
| Server operation and troubleshooting | Technical metrics without content, without IDs and without IP address (result type, duration, character count, token count, tone, language), only for a sample of about 10 % of requests; when the server is called, Cloudflare technically processes the IP address | Art. 6(1)(f) GDPR (secure, economical operation) |
| Support | Your message, email address, purchase details where relevant | Art. 6(1)(b) GDPR, otherwise (f) (answering enquiries) |
You are not obliged to provide data. Without consent you can use the whole app except the wording help. We do not make automated individual decisions with legal effect (Art. 22 GDPR). We do not sell your data or use it for advertising.
Information about deceased persons: The GDPR protects data of living persons (Recital 27). Information about the person who died can, however, also relate to you or other living people (e.g. your relationship, your address). We therefore treat all information in the app as if it were your personal data.
4. Wording help (AI)
Consent: Before first use, the app shows a separate notice: what is sent, to whom and how long it is stored there. Nothing is sent until you tick the consent box and the separate box “I am at least 16 years old.” and tap “Agree and continue”. Without consent and age confirmation our server also rejects every request.
Data minimisation: Before the text leaves your device, the app replaces all details you entered in the fields (e.g. your name, your address, the name of the person who died, contract numbers, dates) with placeholders (e.g. “[name of the person who died]”). In addition, the app – and our server again – removes phone numbers, email addresses, account numbers (IBAN) and long digit sequences. If you have freely edited the letter, it may still contain details that are not recognised; please do not write particularly sensitive information (e.g. about health or cause of death) into the letter text when using the wording help.
Process: The text is sent encrypted (HTTPS) to our server at Cloudflare, checked there and passed to the Anthropic API (Anthropic PBC, USA); the result returns to your device, where the app re-inserts your details. If the model is overloaded, another Claude model from the same provider takes over.
Storage: We do not store the text or the result; they are only processed in memory during the request. According to Anthropic, requests are stored for up to 30 days to detect misuse (longer only if a breach of the usage policy is found or a legal obligation applies) and are not used for training.
Withdrawal: You can withdraw consent at any time in the app under “More → Withdraw consent” with effect for the future. The app then no longer sends texts.
AI labelling: Suggestions are labelled in the app as “Worded by AI – please check”. You decide whether to use a suggestion.
5. Data on your device
Your case (country, dates, task progress, notes, contracts, letter details) is stored in the app's storage encrypted with AES-256-GCM. The key is kept in the iOS keychain (this device only, no iCloud sync) or the Android Keystore. On Android, cloud backup and device transfer are disabled for the app. Settings without personal reference (language, text size, country, consent status) are stored unencrypted in the app settings.
Under “More → Delete all data on this device” you delete all data, scheduled reminders and the key. Uninstalling the app also deletes the data. Links to sources (authorities, laws) open in your browser; the privacy notices of those sites apply.
Sharing: If you choose “Share overview” or “Share task progress as a file”, the app creates a text or file and opens your device's share menu. You choose the recipient (e.g. messenger, email). The transfer is made by the app you choose, not by us. The file contains task progress, responsibilities, notes and provider and status of contracts, but no letter details, no contract numbers and not the name of the person who died.
6. Abuse protection
To prevent misuse of the wording help and limit costs, our server counts requests per device (at most 10 per 10 minutes and 40 per day), per internet connection and in total per day. For this it stores only salted hashes of the device ID and IP address with counters, never the ID or IP address itself.
7. Purchase of the full version
The full version is a one-off purchase (no subscription) via the Apple App Store or Google Play. We do not receive payment data; the store handles payment. We use RevenueCat (RevenueCat, Inc., USA) to manage purchases. The app only contacts RevenueCat when you open the purchase page or restore a purchase. Our server asks RevenueCat whether the full version is unlocked when you use the wording help.
8. Retention
- Letter texts on our server: not stored (only during the request).
- At Anthropic: according to Anthropic's current information up to 30 days (section 4).
- Hashes and counters: rate limits 15 minutes to 2 days; IP hash 2 days; cache “full version confirmed” 30 days. Expired entries are deleted automatically.
- Technical metrics and server logs: at most 7 days.
- Purchase data at RevenueCat: while the app is used and thereafter according to RevenueCat's retention rules or our legal obligations.
- Data on your device: until you delete it or uninstall the app.
- Support requests: up to 3 years after completion.
9. Recipients and third countries
| Service | Purpose | Location / processing | Safeguard for third country |
|---|---|---|---|
| Cloudflare | Server (Worker), counters (Durable Objects), logs, network | Cloudflare, Inc., USA; worldwide at the nearest location | Data processing agreement; SCC or DPF where applicable |
| Anthropic | Wording help (AI) | Anthropic PBC, USA | Data processing terms; SCC or DPF where applicable |
| RevenueCat | Purchase management | RevenueCat, Inc., USA | Data processing agreement; SCC or DPF where applicable |
| Apple / Google | App distribution, purchase, system functions (notifications, sharing) | Apple Distribution International Ltd., Ireland / Apple Inc., USA; Google Ireland Ltd., Ireland / Google LLC, USA | Independent controllers under their own terms |
USA: Transfers to the USA are based on the adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR) where the recipient is certified; otherwise on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) with supplementary measures (encryption, no storage by us, placeholders instead of details). For Switzerland and the United Kingdom the corresponding mechanisms apply (Swiss-US DPF, UK Extension or IDTA/Addendum).
United Arab Emirates: We as controller are based in the UAE; there is no adequacy decision for the UAE. Your letter texts and case data do not reach our systems in the UAE because we do not store or receive them. We apply the GDPR insofar as it applies to our service.
10. Your rights
Under the GDPR (and the UK GDPR) you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You can withdraw your consent in the app at any time (Art. 7(3)); this does not affect the lawfulness of processing before withdrawal.
Right to object (Art. 21 GDPR): Where we process data based on legitimate interests (abuse protection, operation), you can object at any time on grounds relating to your particular situation. An informal note to [email protected] is enough.
As we do not run accounts and do not receive your case data, we hold at most hashes with counters and – if you purchased – the data at RevenueCat. For access or erasure, please give us the device ID shown in the app under “More → Your device ID”; without it we cannot match data to you (Art. 11 GDPR). We usually reply within one month.
You can lodge a complaint with a supervisory authority, in particular in the EU/EEA state of your habitual residence, place of work or the alleged infringement; in Austria the Datenschutzbehörde, in Switzerland the Federal Data Protection and Information Commissioner (FDPIC), in the United Kingdom the Information Commissioner's Office (ICO).
11. Children
The app is intended for adults. The wording help may only be used from age 16; before first use you confirm this with a separate box.
12. Security
Encrypted transfer (HTTPS); encryption of data on the device with the key in the keychain or Keystore; no cloud backup on Android; placeholders instead of details and cleaning before the AI request; no storage of texts on the server; checking the AI response (placeholders unchanged, no new links or email addresses); salted hashes instead of IDs and IP addresses; emergency shutdown of the wording help in case of security incidents; notifications without names or content on the lock screen; secret keys only on the server.
13. Changes
We update this policy when features, service providers or the law change. If changes affect your consent, the app asks again. The current version is available in the app and at https://levamio.com/apps/nachlass-lotse/datenschutz-en/.
As of: 21 October 2026