Home Privacy
Legal
Privacy notice
How Apps 365 Ltd handles personal data for HRPoint: this website, the app's licence check-in and the emails you send us. Your HR data stays in your own Microsoft 365 tenant.
Last updated: 6 November 2026
Who we are
HRPoint is made by Apps 365 Ltd, a company registered in England and Wales (number 13955007), 20-22 Wenlock Road, London N1 7GU, United Kingdom. Contact: info@apps365ltd.com. Apps 365 Ltd is a UK company and is not affiliated with apps365.com.
For this website, the licence check-in and emails you send us, we are the controller.
The HR data in HRPoint
HRPoint keeps an organisation's HR records (people's records, leave, absence, right to work checks, policy acknowledgements, reviews, recruitment records, equality answers, AI agent records and the rest) in SharePoint lists and libraries on the organisation's own sites in its Microsoft 365 tenant. HRPoint runs in each person's browser and reads and writes those records with that person's own access. Apps 365 Ltd does not receive, keep or have access to them. The organisation is the controller of that data, and Microsoft holds it under the organisation's own agreement with Microsoft.
If you work for an organisation that uses HRPoint and want to see, correct or delete your HR records, ask your employer: they hold them. HRPoint helps them answer.
To show bank holidays, HRPoint reads the public GOV.UK bank holidays feed (www.gov.uk/bank-holidays.json) from the browser, with no sign-in and nothing sent about you or your organisation.
Optional tools are outside the HRPoint package and send us nothing: the HRPoint Policies AI agent runs in your organisation's Microsoft 365 Copilot, the HRPoint Automations service on hosting you choose, and the People connector, Shifts mirror and Entra sync admin tool from your administrator's computer. The security page says what each one reads and writes.
The HRPoint app's licence check-in
At most once a day from each browser, HRPoint sends the Apps 365 Licence Manager (licences.apps365.pro) your Microsoft 365 tenant ID, the addresses of the HRPoint site and its site collection, the app version, the licence state (licensed, trial, evaluation or expired) and plan, and the licence ID it uses. It never sends names, HR records, profiles or keys. We use it to support the licences we issue and to know where HRPoint is in use; our lawful basis is our legitimate interest in supporting the licences we issue.
The Licence Manager keeps one record for each site (first and last seen, version, state, plan, licence IDs and how many check-ins) until you ask us to remove it, and the days it was used for 400 days. It keeps no IP address. A site owner can switch the check-in off at any time in HRPoint's settings, under Licence; licence keys keep working without it.
Licences you buy
When you buy a licence we keep your organisation's name, tenant ID, the plan, the licence dates and the contact details you give us, to issue and support the licence and for our accounts, for as long as the law requires us to keep accounting records. Payments made through the Apps 365 Ltd online shop are handled under the shop's own privacy notice.
Emails you send us
When you email info@apps365ltd.com we use what you send only to answer you and to keep a record of the help we gave, and delete it 12 months after the conversation ends. Please do not send us your people's HR records; we never need them.
When you ask for the HRPoint Policies AI agent you send us your HRPoint Hub address and the HR contact the agent should give, and for its optional actions your service address, tenant ID and registration details. We use them to build your organisation's package and keep them with that conversation.
This website
hrpoint.app has no forms, uses no analytics, advertising or tracking, runs no scripts, loads nothing from other websites and sets no cookies. Our web server keeps standard access logs (internet address, time, the address requested and the browser's description) for a short time for security and troubleshooting, and our own error log holds no personal data.
How we protect data
Everything travels over HTTPS. The Licence Manager and this website run on our hosting provider's servers in the United Kingdom. Only Apps 365 Ltd staff who need it can reach the Licence Manager. The security page lists every permission HRPoint asks for and what leaves your tenant.
Who else handles data
Our hosting provider in the United Kingdom runs our servers, and our email provider holds the emails you send us. We do not sell personal data or share it for marketing.
Your rights
You can ask us for a copy of the personal data we hold about you, and ask us to correct or delete it, or to restrict or object to its use. Contact info@apps365ltd.com. You can also complain to the Information Commissioner's Office at ico.org.uk.
Changes
We will update this notice when what we do changes, and change the date at the top.