Privacy notice

Last updated: 27 October 2026

1. Who we are

2. What this notice covers

This notice covers personal data we handle when you use expirypoint.com, contact us, ask for a free trial, buy or renew a licence, or when an installation of ExpiryPoint sends its daily check-in.

It does not cover the data ExpiryPoint reads and keeps inside your organisation's Microsoft 365 tenant, such as file names and details, the names of owners, reviewers and approvers, review dates, decisions, comments and the decision log. ExpiryPoint runs in your browser with your own SharePoint permissions and keeps its records in lists on your SharePoint site. Reminder emails are sent through Microsoft Graph from the signed-in person's own mailbox, where your administrator has approved that permission. Your organisation is the controller of that data, and Apps 365 has no access to it.

3. Contact form

When you use the contact form we collect the details you give us: your name, work email address, organisation, role (if you give it), the kind of request and your message. We use them to reply to you and to follow up on your request, for example to arrange a demo or a quote.

To protect our forms from abuse, we count requests from each connection for one hour using a keyed fingerprint of your IP address that changes every day. We never store the IP address itself, and the counts are deleted within two days. Like every website, our web server records technical details of each request, such as the IP address, the page requested, the time and the browser type, which our hosting provider keeps for a short period for security and troubleshooting.

4. Free trial requests

When you ask for a free trial we collect your name, work email address, organisation and the SharePoint site address you give us. To issue a key for your site, our website asks Microsoft's SharePoint service which Microsoft 365 tenant the address belongs to. That request carries no credentials and reads nothing from your site; the answer is your organisation's tenant ID.

We then issue a trial licence key in our licence service, recorded with your organisation's name, tenant ID and site address, or, if it cannot be issued automatically, we keep your request and a member of our team issues the key by hand. We show or email you the key with the install steps, and tell our team so we can help you get started. To stop misuse we also keep a keyed fingerprint of the tenant ID, so one organisation can start at most three trials in any 90 days.

5. Cookies

This website sets no cookies and uses no analytics, advertising or tracking tools. It loads no scripts, fonts or images from other websites, so nothing about your visit is shared with anyone else.

6. The daily check-in

At most once a day per site, each installation of ExpiryPoint sends us a small check-in: the Microsoft 365 tenant ID, the addresses of the site and site collection where it runs, the app version, the licence state and plan, and the IDs of the licence keys in use. It contains no names, email addresses, file details, review dates, decisions or licence keys, and we do not keep the IP address it comes from.

We use it to see which versions are installed and where licences are used, and to support our customers. Site addresses can contain a site's name. A site owner can switch the check-in off under Licence at the top of ExpiryPoint, and ExpiryPoint works the same without it.

7. Customers and licences

When your organisation buys, trials or renews ExpiryPoint, we keep the contact and billing details of the people who order and administer it, the organisation's name and tenant ID, the SharePoint address a licence covers, and the licences issued. We use them to issue and manage licences, send renewal reminders, provide support and keep our accounts.

8. Why we use your data

• Legitimate interests: replying to enquiries, issuing and supporting trials, understanding how ExpiryPoint is used through the check-in, and protecting our website from abuse. We have balanced these against your interests; you can object at any time.
• Contract: issuing licences, providing support and managing your organisation's account.
• Legal obligation: keeping accounting and tax records.

We do not use your data for automated decisions that affect you, and we do not sell it.

9. Who we share it with

We use a small number of service providers who act on our instructions: our web hosting provider, which runs this website and our licence service, and our email provider, which delivers messages sent through our forms. If you pay online, the payment provider processes your payment details and we never see your full card number. We may share data where the law requires it, or with professional advisers under a duty of confidentiality.

10. Transfers outside the UK

Where a provider processes personal data outside the United Kingdom, we make sure it is protected, for example by relying on UK adequacy regulations or the International Data Transfer Agreement.

11. How long we keep it

• Enquiries and trials that do not lead to a purchase: up to 24 months after our last contact.
• Check-in records: while the licence is in use and up to 24 months after it ends.
• Customer, licence and billing records: for as long as your organisation is a customer, then for six years for accounting purposes.

12. Security

This website is served over HTTPS only. Contact and trial requests are stored outside the website's public folder with restricted access, and only the people who handle enquiries and licences can see them.

13. Your rights

Under UK data protection law you can ask for a copy of your personal data, ask us to correct or delete it, to restrict or stop using it, or to give it to you in a portable form, and you can object to our use of it based on legitimate interests. Email info@apps365ltd.com and we will respond within one month.

If you are unhappy with how we handle your data, please tell us first. You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

14. Changes to this notice

We will update this notice when how we handle personal data changes, and show the date of the latest version at the top.