Privacy notice

Last updated: 27 October 2026

1. Who we are

2. What this notice covers

This notice covers personal data we handle when you use exposurepoint.app, contact us, ask for a free trial, buy or renew a licence, or when an installation of ExposurePoint sends its daily check-in.

It does not cover the data ExposurePoint reads inside your organisation's Microsoft 365 tenant, such as permissions, sharing links, the names of files and people, scores and score history. ExposurePoint runs in your browser with your own SharePoint permissions and keeps its history in a list on your SharePoint site. Your organisation is the controller of that data, and Apps 365 has no access to it.

3. Contact form

When you use the contact form we collect the details you give us: your name, work email address, organisation, role (if you give it), the kind of request and your message. We use them to reply to you and to follow up on your request, for example to arrange a demo or a quote.

To protect our forms from abuse, we count requests from each connection for one hour using a keyed fingerprint of your IP address that changes every day. We never store the IP address itself, and the counts are deleted within two days. Like every website, our web server records technical details of each request, such as the IP address, the page requested, the time and the browser type, which our hosting provider keeps for a short period for security and troubleshooting.

4. Free trial requests

When you ask for a free trial we collect your name, work email address, organisation and the SharePoint site address you give us. To issue a key for your site, our website asks Microsoft's SharePoint service which Microsoft 365 tenant the address belongs to. That request carries no credentials and reads nothing from your site; the answer is your organisation's tenant ID.

We then issue a trial licence key in our licence service, recorded with your organisation's name, tenant ID and site address. We show the key to you, email you a copy with the install steps, and tell our team so we can help you get started. To stop misuse we also keep a keyed fingerprint of the tenant ID to limit how many trials one organisation can start in a month.

5. Cookies

This website sets no cookies and uses no analytics, advertising or tracking tools. It loads no scripts, fonts or images from other websites, so nothing about your visit is shared with anyone else.

6. The daily check-in

At most once a day per site, each installation of ExposurePoint sends us a small check-in: the Microsoft 365 tenant ID, the addresses of the site and site collection where it runs, the app version, the licence state and plan, and the IDs of the licence keys in use. It contains no names, email addresses, file details, findings or scores, and we do not keep the IP address it comes from.

We use it to see which versions are installed and where licences are used, and to support our customers. Site addresses can contain a site's name. A site administrator can switch the check-in off in the web part settings, and ExposurePoint works the same without it.

7. Customers and licences

When your organisation buys, trials or renews ExposurePoint, we keep the contact and billing details of the people who order and administer it, the organisation's name and tenant ID, the SharePoint address a licence covers, and the licences issued. When you buy in our shop, it sends the organisation's name, tenant ID and that address to our licence service so the key can be issued. We use them to issue and manage licences, send renewal reminders, provide support and keep our accounts.

8. Why we use your data

• Legitimate interests: replying to enquiries, issuing and supporting trials, understanding how ExposurePoint is used through the check-in, and keeping our website secure. We have balanced these against your interests; you can object at any time.
• Contract: issuing licences, providing support and managing your organisation's account.
• Legal obligation: keeping accounting and tax records.

We do not use your data for automated decisions that affect you, and we do not sell it.

9. Who we share it with

We use a small number of service providers who act on our instructions: our web hosting provider, which runs this website and our licence service, and our email provider, which delivers messages sent through our forms. Licences are bought in our shop at apps365ltd.com, which has its own privacy notice; when you pay there, the payment provider processes your payment details and we never see your full card number. We may share data where the law requires it, or with professional advisers under a duty of confidentiality.

10. Transfers outside the UK

Where a provider processes personal data outside the United Kingdom, we make sure it is protected, for example by relying on UK adequacy regulations or the International Data Transfer Agreement.

11. How long we keep it

• Enquiries and trials that do not lead to a purchase: up to 24 months after our last contact.
• Check-in records: while the licence is in use and up to 24 months after it ends.
• Customer, licence and billing records: for as long as your organisation is a customer, then for six years for accounting purposes.

12. Security

This website is served over HTTPS only. Contact and trial requests are stored outside the website's public folder with restricted access, and only the people who handle enquiries and licences can see them.

13. Your rights

Under UK data protection law you can ask for a copy of your personal data, ask us to correct or delete it, to restrict or stop using it, or to give it to you in a portable form, and you can object to our use of it based on legitimate interests. Email info@apps365ltd.com and we will respond within one month.

If you are unhappy with how we handle your data, please tell us first. You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

14. Changes to this notice

We will update this notice when how we handle personal data changes, and show the date of the latest version at the top.