Legal
Privacy notice
Last updated 5 November 2026
Who we are
ConfigCheckup is provided by ConfigCheckup Ltd, a company registered in England and Wales (company number 17509228), registered office 20 Wenlock Road, London, England, N1 7GU. We are the controller for the personal data described in this notice, and are registered with the Information Commissioner's Office under number ZC281968.
This notice covers visitors to this website and the people who sign in to ConfigCheckup. Data read from the Microsoft 365 tenants you assess is processed on your behalf, as your processor, and is described on the data protection page.
What we collect
| Data | When |
|---|---|
| Name, work email address, workspace name, role | When you sign up, are invited, or update your account |
| Password (stored only as a salted scrypt hash), and your two-step verification secret (encrypted) and recovery codes (stored only as hashes) | When you set or change them |
| Your Microsoft account's object and tenant identifiers | When you sign in with Microsoft |
| IP address, browser user agent, sign-in times | When you sign in, and against actions recorded in the audit log |
| What you do in the service: tenants added, assessments run, reports generated, notes, approvals | As you use ConfigCheckup |
| Billing contact and subscription status; card details are handled by Stripe and never reach us | When you subscribe |
| Your email notification preference | When you change it in Settings |
| The campaign tags on the link you signed up from (such as one of our emails), never anything about you | When you sign up |
| Support requests: what you send us, your name and email address, files attached to your email, and, when you write from ConfigCheckup, your workspace, the tenant you chose and the page you were on | When you email our support address or use Support in ConfigCheckup |
How and why we use it
| Purpose | Lawful basis |
|---|---|
| Providing the service: your account, workspace, reports and notifications | Performance of our contract with you or your organisation |
| Keeping the service and your data secure: sign-in, sessions, the audit log, preventing misuse | Legitimate interests in operating a secure service |
| Billing and keeping financial records | Contract, and our legal obligations |
| Service messages such as invitations and security notices | Contract, and legitimate interests |
| Answering your support requests | Performance of our contract with you or your organisation; for people who are not customers, our legitimate interests in answering them |
We do not sell personal data, use it for advertising, or make automated decisions about you that have legal effects.
Cookies, local storage and analytics
We use one cookie, which keeps you signed in. It is strictly necessary, so it does not need consent. Your light or dark theme choice is kept in your browser's local storage. We do not use advertising or third-party tracking cookies.
The free email security check looks up the domain you enter in public DNS. The domain is held in memory for ten minutes so a repeat check is quick, and is not stored or linked to you.
We do not use analytics on this website.
Business contacts we email
We email people at UK companies, limited liability partnerships and public bodies about ConfigCheckup, at their work address. We never email a personal address (such as Gmail or Outlook.com), a sole trader or a partnership, or anyone at a business that already uses ConfigCheckup.
- What we hold: your name, work email address and job title; your organisation's name, website domain, and company number and type; the result of our free email security check of the domain, read from public DNS; and any reply you send us.
- Where it comes from: Apollo.io, a business contact data provider, which finds the person and their work address; Companies House's public register, which we use to confirm the organisation is a company, its type and that it is active; and organisations' own published information.
- Why: our legitimate interests in telling organisations about a service relevant to how they run Microsoft 365. Every email says who it is from and how to stop them: reply “stop” to any of them, or use the unsubscribe link in the later ones.
- Your choice: reply “stop” to any email, use its unsubscribe link, or email support@configcheckup.com, and we will not email you again. To make sure of that, we keep a one-way, keyed fingerprint of your address, never the address itself, for as long as we send these emails.
Who we share it with
- Render, which hosts the service and its database in the EU (Frankfurt).
- Resend, which delivers our emails and receives email sent to our support address.
- Stripe, which processes subscription payments.
- Instantly, which sends our emails to business contacts.
- Other members of your ConfigCheckup workspace, who can see your name, role and the actions you take in it.
- Owners and Admins of your workspace, for a support ticket you choose to share with them.
- Authorities, where the law requires us to.
Where a provider processes data outside the UK, we rely on UK adequacy regulations or the International Data Transfer Agreement or Addendum to protect it.
How long we keep it
- Account data: while your account is active, and deleted when your workspace is closed. When someone is removed from a workspace, their name and email address stay with the changes and approvals they made, so the record of who did what holds, until the workspace is closed or we must erase them.
- Audit log entries: while the workspace exists, because they are the record of who did what.
- Billing records: six years, as UK tax law requires.
- Expired sessions are no longer usable after they expire.
- Support tickets: two years after the ticket was last updated, then deleted with their files. Messages we class as spam: 30 days.
- Business contacts we email: deleted within 180 days of being added if we never email you. If we do, your name, address, job title and any reply are deleted a year after we first email you, and the record that we contacted your organisation (its domain and the date) two years after. If your organisation signs up, we keep a record that the workspace came from that email, with no name or address in it, until three years after the email. A note that we have dealt with your reply or unsubscribe, which holds a keyed fingerprint of your address and never the address itself, is kept for 90 days. The fingerprint of an address that has unsubscribed is kept, so it is never emailed again.
- Free trials: when the owner of a workspace on a free trial confirms their email address, we keep a one-way, keyed fingerprint of that address, never the address itself, for 60 days, even if the workspace is closed. It only lets us tell that the same address has had a trial recently, so a trial cannot be restarted straight away, and it is deleted after 60 days. The first tenant a trial connects is kept the same way, as a keyed fingerprint of its Microsoft tenant ID, so a trial cannot be restarted on the same tenant with another address.
Your rights
Under UK data protection law you have the right to:
- access the personal data we hold about you;
- have inaccurate data corrected;
- have your data erased, or its use restricted, in certain circumstances;
- object to processing based on our legitimate interests;
- receive your data in a portable format.
To exercise any of these, email support@configcheckup.com. We will respond within one month, and may ask you to confirm who you are first. Where we hold your data only as a processor for a ConfigCheckup customer (for example, because you work at a tenant one of our customers assesses), we will pass your request to that customer, who decides on it.
If you are unhappy with how we handle your data, please tell us first at the same address: we will acknowledge your complaint within 30 days, look into it and tell you the outcome. You can also complain to the Information Commissioner's Office at ico.org.uk.
ConfigCheckup is for organisations and is not meant for children; we do not knowingly collect data about anyone under 16. How we protect the data is described in the trust centre.
Changes to this notice
We will update this page when how we use personal data changes, and tell account holders by email about significant changes. The date at the top shows when it was last updated.