Last Updated: July 8, 2026
This Privacy Policy ("Policy") explains how Heirly Inc. ("Heirly," "we," "us," or "our") collects, uses, discloses, and safeguards personal information of users ("you" or "User") of the Heirly platform, website, applications, and related services (collectively, the "Platform"). By accessing or using the Platform, you consent to the collection, use, and disclosure of your personal information as described in this Policy. If you do not agree with this Policy, you must not use the Platform.
Heirly operates in Canada and the United States. This Policy is intended to comply with Canadian privacy law, including the Personal Information Protection and Electronic Documents Act ("PIPEDA") and Quebec's Act respecting the protection of personal information in the private sector ("Law 25"), and with applicable United States privacy laws, including the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA/CPRA") and comparable U.S. state privacy laws. If you access the Platform from outside Canada or the United States, additional rights may apply under your local law; you may contact us to exercise them. This Policy should be read together with our Terms of Use and Cookies Policy.
"Personal information" (also called "personal data" or "personal information" under U.S. state laws) means information about an identifiable individual, or information that identifies, relates to, or could reasonably be linked with a particular individual or household. It does not include de-identified, aggregated, or publicly available information.
We may use personal information only as necessary to:
Personal information may be shared with other Users only to the extent necessary for marketplace interactions, including business names, listing information, and professional contact details. Sensitive personal information will not be disclosed.
Personal information may be disclosed to third-party service providers and partners who process data on our behalf. These third parties are bound by contractual obligations to protect personal information and to use it only for the purposes for which it was disclosed.
We may disclose personal information to comply with applicable laws, regulations, or legal processes, or to respond to lawful requests from authorities.
In the event of a corporate transaction, including but not limited to a merger, acquisition, or sale of assets, personal information may be transferred to the successor entity. Users will be notified of such transfers where feasible.
We may disclose information in aggregated or anonymized form that does not identify any individual personally.
Heirly does not sell your personal information, and does not "share" it for cross-context behavioral advertising, as those terms are defined under the CCPA/CPRA and comparable U.S. state laws. If this practice changes, we will update this Policy and provide any opt-out mechanism required by law.
You may request access to and correction of your personal information. We will respond within a reasonable timeframe, and in any event within thirty (30) days (or within the timeframe required by applicable law).
You may request deletion of your account and personal information. Certain information may be retained where necessary to comply with legal obligations, resolve disputes, enforce agreements, or protect legitimate business interests (see Section 5). Retained information will be minimized and stored securely.
You may request a copy of the personal information you have provided to us in a structured, commonly used, and machine-readable format, and, where technically feasible, ask that it be transmitted to another organization.
You may withdraw consent for specific uses of your personal information, including AI processing, at any time, without affecting the lawfulness of prior processing. Withdrawing consent may limit your ability to use certain features.
You may opt out of non-essential marketing communications by following the unsubscribe instructions in those communications.
We will not discriminate or retaliate against you for exercising any of your privacy rights.
Requests may be submitted to info@heirly.co. We will verify your identity before responding, using measures proportionate to the sensitivity of the information. You may use an authorized agent to submit a request where permitted by law. If we decline a request, we will explain why to the extent permitted by law.
If you have a privacy concern, please contact us first. You also have the right to complain to a supervisory authority: in Canada, the Office of the Privacy Commissioner of Canada (and, for Quebec residents, the Commission d'accès à l'information du Québec); in the United States, the California Privacy Protection Agency or your state Attorney General, where applicable.
Personal information is retained only for as long as necessary to fulfill the purposes for which it was collected, comply with legal obligations, resolve disputes, and protect legitimate interests.
Transaction record retention periods survive account deletion. Upon account closure, personal profile information will be deleted within thirty (30) days, but transaction records required for compliance purposes will be retained for the applicable retention period.
Information that is no longer required will be securely deleted or anonymized in accordance with industry standards.
6.1 Heirly implements technical, administrative, and organizational safeguards appropriate to the sensitivity of personal information, including encryption, multi-factor authentication for administrative access, access controls, and regular security audits.
6.2 Breach Notification. In the event of a breach of security safeguards involving personal information that poses a real risk of significant harm (or that otherwise triggers a legal notification obligation), Heirly will notify affected Users and the applicable regulators without undue delay. This includes, as applicable, the Office of the Privacy Commissioner of Canada under PIPEDA, the Commission d'accès à l'information under Quebec Law 25, and the notifications required under applicable U.S. state breach-notification laws. Heirly maintains a record of breaches as required by law.
7.1 Heirly operates in Canada and the United States. Your personal information may be stored and processed in Canada, the United States, or other countries where Heirly or its service providers operate. As a result, your information may be subject to the laws of those jurisdictions, including lawful access requests by courts or government authorities.
7.2 Where personal information is transferred across borders, Heirly uses contractual and organizational measures intended to provide a comparable level of protection, including data processing agreements with service providers. You may contact us for more information about our transfer safeguards.
8.1 Heirly uses Cookies and similar technologies as described in the Cookies Policy for authentication, Platform performance, personalization, analytics, and verification purposes.
8.2 Consent is obtained for non-essential Cookies where required by law. Users may manage Cookie preferences via browser settings or platform-provided tools, without affecting essential functionality.
9.1 The Platform is intended for users eighteen (18) years of age or older.
9.2 If we discover that we have inadvertently collected personal information from a person under eighteen (18), such information will be deleted promptly.
10.1 The Platform may include links or integrations with third-party services. Heirly is not responsible for the privacy practices or content of such services. Users' interactions with third-party services are governed by the privacy policies of those services.
11.1 Canada (PIPEDA and Quebec Law 25). If you are located in Canada, you have the rights described in Section 4, including the rights to access and correct your personal information, to withdraw consent, to data portability, and to the automated-decision protections in Section 2.3. You may direct any privacy question or complaint to our Privacy Officer (Section 13) and, if unsatisfied, to the Office of the Privacy Commissioner of Canada or, for Quebec residents, the Commission d'accès à l'information du Québec.
11.2 United States (California and other states). If you are a resident of California or another U.S. state with a comprehensive privacy law, you may have the right to:
We will acknowledge requests and respond within the timeframe required by applicable law (for example, within forty-five (45) calendar days under the CCPA/CPRA, extendable as permitted). You may use an authorized agent to submit a request. To exercise these rights, contact info@heirly.co.
12.1 Heirly may update this Policy from time to time. Material changes will be communicated via email where appropriate and posted on the Platform. Continued use of the Platform after such updates constitutes acceptance of the revised Policy.
13.1 Heirly has designated a Privacy Officer who is accountable for our compliance with this Policy and applicable privacy laws. For questions, concerns, requests, or complaints regarding this Policy or your personal information, please contact: