Privacy Policy

ExpiryBoard is operated by Lamb Building Consultancy Ltd, International House, 64 Nile Street, London, N1 7SR, United Kingdom (registered in England and Wales, company number 14819400). In this policy, "we" and "us" mean Lamb Building Consultancy Ltd. We are the data controller for account, billing and website data.

When your organisation uses ExpiryBoard to hold information about its people, suppliers and documents, your organisation is the controller of that information and we process it as a processor on its instructions. That content remains yours.

Contact us about this policy at support@expiryboard.com.

When you sign up, we collect:

• your email address and sign-in credentials;
• the organisation name you enter during onboarding;
• your role, membership and invitation records;
• the settings you configure, including reminder email addresses.

ExpiryBoard holds the expiry records and documents your organisation chooses to track. This may include names of people, companies and suppliers, record details, dates, notes and uploaded documents.

Documents are stored securely and are only available to signed-in members of the organisation that owns them. Please only add information your organisation is entitled to hold and share.

Subscription payments are handled by our payment provider on secure hosted pages. We never see or store your card details. We hold the customer and subscription references linked to your organisation, its subscription status, trial and renewal dates, and billing events so access can be granted or suspended correctly.

We send service emails such as account, invitation and password reset emails, and reminder emails about upcoming or passed expiry dates. We keep a limited record of sent reminders so they are not duplicated or lost.

We do not send marketing emails from within the application.

Our service providers keep operational logs, which may include IP addresses and browser information, so we can run the service securely and investigate faults and abuse. We use cookies and similar storage only where necessary to keep you signed in and the service working. We do not use advertising trackers or third-party profiling.

With your permission, we collect limited usage information to help us improve ExpiryBoard. It is off by default and only starts after you choose to allow it.

This information does not include sensitive customer content. We do not intentionally collect uploaded documents, document contents, filenames, record names, people or company names, notes, email addresses or form entries.

You can change your choice at any time.

Change analytics preference

We protect customer information using appropriate technical and organisational measures, including:

• encrypted connections;
• secure cloud infrastructure;
• organisation data isolation;
• restricted administrative access;
• ongoing security improvements as the product develops.

No online service can be completely secure, so we cannot guarantee absolute security. If you believe you have found a security issue, please tell us at support@expiryboard.com.

• Contract — to create and operate your account, hold your records, send reminders and provide support.
• Legal obligation — to keep billing, accounting and tax records.
• Legitimate interests — to keep the service secure and reliable, prevent abuse and improve the product, balanced against your rights.

We use trusted third-party providers for hosting, database and file storage, authentication, payment processing, transactional email and — where you consent — product analytics. They act as our processors, are bound by appropriate contractual terms and may only process data on our instructions.

We may change providers where doing so maintains an equivalent standard of protection. If you would like the current list, please contact us at support@expiryboard.com. We do not sell your personal data or share it for advertising.

Some providers process data outside the UK. Where personal data is transferred outside the UK, we rely on an appropriate safeguard, such as UK adequacy regulations or the International Data Transfer Agreement, together with any additional measures needed to protect the data.

We keep your account, organisation and record data for as long as your organisation has an ExpiryBoard account, and for a reasonable period afterwards so an account can be restored or data exported. If you ask us to delete your account, we will delete or anonymise your data within a reasonable period, except where we must keep certain records, such as billing records, to meet legal obligations. Backups are held for a limited period before being overwritten.

Under UK data protection law you have the right to be informed, to access your data, to have inaccurate data corrected, to request erasure or restriction, to object to processing based on legitimate interests, and to receive your data in a portable form. We do not make decisions about you by automated means that produce legal or similarly significant effects.

To exercise any of these rights, email support@expiryboard.com. We may need to verify your identity and will normally respond within one month. If your request concerns records held by an organisation you belong to, we may need to refer you to that organisation.

If you are unhappy with how we have handled your personal data, please contact us first so we can put it right. You also have the right to complain to the UK Information Commissioner's Office at ico.org.uk/make-a-complaint.

We may update this policy as the service changes. The date at the top of this page shows when it was last updated, and we will tell you about material changes that affect you.