Privacy notice

Last updated: 3 November 2026, for DirectoryPoint 1.0. Draft for legal review.

Who we are

DirectoryPoint is made by Apps 365 Ltd, a company registered in England and Wales (number 13955007), 20-22 Wenlock Road, London N1 7GU, United Kingdom. Contact: info@apps365ltd.com. Apps 365 Ltd is a UK company and is not affiliated with apps365.com.

For this website, emails you send us and the licence check-in, we are the controller.

This website

directorypoint.app sets no cookies and uses no analytics, advertising or tracking, and loads nothing from other websites. It has no forms, so it collects nothing you type.

Our web server keeps short access logs (the page asked for, the time, the result and how long it took) for 30 days, to run the site and find faults. Our own logs do not record your internet address. Our hosting provider's standard server logs may hold it for a short time for security; our lawful basis is our legitimate interest in running a working, protected website.

Emails you send us

When you email us (for example to buy a licence, ask for a demo or get help), we use your name, email address, organisation and what you write to answer you and to provide the licence you buy. Our lawful basis is our legitimate interest in answering enquiries, or the contract when you buy. We keep correspondence for as long as we need it to help you and for no more than two years after our last exchange, unless the law requires longer (for example, invoices are kept for six years under UK tax rules). Payments for licences are handled by Apps 365 Ltd's online shop under its own privacy notice.

The DirectoryPoint app and your directory

DirectoryPoint runs inside your organisation's Microsoft 365 tenant. It reads people from Microsoft Graph or SharePoint as the person using it, and keeps what people add and its settings in SharePoint lists on your DirectoryPoint site: skills, favourites and collections (including collections people share with colleagues), profile options and other names, how to say their name and, if they choose, a short recording of their voice saying it, pronouns, how they like to work, languages, kudos, Who's Who scores for people who join the scoreboard, change requests and their audit, external contacts a site owner adds, and daily usage totals with no names. In larger organisations each person's browser keeps its own copy of the directory on their device, and a site owner may publish a snapshot of the directory to the site. Apps 365 Ltd does not receive your directory data: no names, profiles, photos, recordings, skills, kudos, favourites or usage counts come to us.

Your organisation decides how DirectoryPoint is used and is the controller for the directory and everything DirectoryPoint keeps in its tenant, including external contacts (people who are not its staff), name recordings, kudos and usage counts. DirectoryPoint includes text your organisation can adapt to tell staff and external contacts how it is used (Settings, Trust and privacy), with a permissions table, a data-flow description and a legitimate interests assessment template.

To see, correct or object to what your organisation's directory shows about you, contact your organisation; we will help it answer. You can also suggest a correction to your own profile in DirectoryPoint (More, Change requests): your organisation's site owners decide it, and IT makes any change to the directory itself. Recording your name uses your microphone only when you choose to record, and you can delete the recording at any time.

The app's licence check-in

At most once a day from each browser, DirectoryPoint sends the Apps 365 Licence Manager (licences.apps365.pro) your organisation's Microsoft 365 tenant ID, the addresses of the DirectoryPoint site and its site collection, the app version, the licence state (licensed, trial, evaluation or expired) and plan, and the licence ID it uses. It never sends names, profiles, directory data, usage counts or keys. We use it to support your licence and to understand where DirectoryPoint is used; our lawful basis is our legitimate interest in supporting the licences we issue.

The Licence Manager keeps one record for each site (first and last seen, version, state, plan, licence IDs and how many check-ins) until you ask us to remove it, and the days it was used for 400 days. The sending browser's internet address is used only to limit how often check-ins can be sent and is not kept with the record. A site owner can switch the check-in off at any time in DirectoryPoint, under Settings, Licence; licence keys keep working without it.

Licences you buy

When you buy a licence we record your organisation's name, your Microsoft 365 tenant ID, the plan, the dates and the order, and the contact who bought it, to issue the key, support it and meet our accounting duties. Licence records are kept for the life of the licence and six years after, as UK tax rules require.

How we protect data

Everything travels over HTTPS. Access to our servers and the Licence Manager is limited to the Apps 365 Ltd staff who run them, and our logs avoid personal data. See security and data handling for how the app handles data in your tenant.

Who else handles data

Our hosting provider in the United Kingdom runs the servers for this website and the Licence Manager. Microsoft holds your organisation's directory under your organisation's own agreement with Microsoft. We do not sell personal data or share it for marketing.

Your rights

You can ask us for a copy of the personal data we hold about you, and ask us to correct or delete it, or to restrict or object to its use. Contact info@apps365ltd.com. If you are unhappy with our answer you can complain to the Information Commissioner's Office at ico.org.uk.

Changes

We will update this notice when what we do changes, and change the date at the top.