Privacy Policy

This Privacy Policy applies to personal information processed in connection with NeverExpiry, including information relating to: • website visitors; • registered users; • subscribers; • trial users; • family and household profiles; • children, minors or dependants whose information is lawfully managed by another person; • professional users; • business and organisational users; • individuals whose information appears within documents lawfully stored by a user; and • individuals who communicate with NeverExpiry. The precise privacy rights and legal requirements applying to an individual may depend upon the circumstances and applicable law.

NeverExpiry determines certain purposes and methods of processing personal information necessary to operate and provide the NeverExpiry service, subject to applicable data-protection law. Where a business or organisation uses NeverExpiry to manage information relating to its employees, customers, patients, clients, contractors or other individuals, that organisation may be responsible for determining how and why that information is used, and NeverExpiry may process relevant information on its behalf. NeverExpiry uses appropriate technical and organisational arrangements designed to support the operation and protection of the service. No wording in this Privacy Policy should be interpreted as an absolute guarantee that any website, online service, network or storage system can never experience unauthorised access, cyberattack, technical failure or another security incident. Detailed security arrangements are covered separately in the NeverExpiry Security Policy.

NeverExpiry aims to process personal information in accordance with applicable data-protection principles, including: • lawfulness, fairness and transparency; • purpose limitation; • data minimisation; • accuracy; • appropriate retention; • confidentiality; • security; and • accountability. Personal information should be processed only where reasonably necessary for the relevant NeverExpiry function or another lawful purpose.

A user's NeverExpiry document vault is intended to remain private to the authorised account. NeverExpiry personnel do not routinely browse, inspect or access users' private document libraries. Access to private documents is controlled through authenticated account access and applicable database, storage and access controls. Limited authorised technical access may occur where genuinely necessary to: • operate or support the service; • investigate a technical problem; • investigate suspected fraud or misuse; • investigate a security incident; • comply with a binding legal requirement; • address an appropriate safeguarding matter; or • protect users, NeverExpiry or the public from a serious security or safety risk. Where access is genuinely necessary, it should be limited to information reasonably required for that purpose.

Uploading or storing a document within NeverExpiry does not transfer ownership of that document to NeverExpiry. Users retain the rights they already possess in their documents and information. The user decides which documents to add to, retain within or delete from their private vault, subject to applicable account, legal, security and technical requirements. NeverExpiry processes information only as reasonably necessary to provide, operate, secure and support the service and for other lawful purposes described in this Privacy Policy.

Depending upon how NeverExpiry is used, account or profile information may include: • name; • email address; • account identifier; • country or region; • language preference; • profile information; • account settings; • subscription status; • reminder preferences; and • other information voluntarily entered by the user. Users should provide only information reasonably necessary for their use of NeverExpiry.

Users may choose to upload documents to their private NeverExpiry vault. Depending upon the documents selected by the user, these may contain information such as: • names; • photographs; • dates of birth; • addresses; • signatures; • identity numbers; • passport details; • visa details; • driving information; • insurance information; • employment information; • qualifications; • professional registration information; • financial information; • medical or dental information; • property information; • family information; • licences; • certificates; • business records; and • other personal or sensitive information. NeverExpiry does not require every user to upload every category of information. The information processed depends primarily upon what the user chooses to store.

NeverExpiry may process information associated with stored documents, including: • document title; • document type; • category; • issue date; • expiry date; • renewal date; • review date; • issuing organisation; • country or region; • document status; • reminder settings; • notes; and • relevant technical file information. This information may be used to provide document organisation, search, reminder and record-management functionality.

NeverExpiry may process dates and reminder preferences necessary to provide functionality such as: • expiry reminders; • renewal reminders; • document-review reminders; • compliance reminders; • upcoming-expiry information; and • document status information. NeverExpiry is a supporting and reminder tool. Users remain responsible for independently checking important dates, requirements and document information against the original document or relevant authoritative source.

Certain technical information may be processed automatically when NeverExpiry is used. Depending on the systems currently implemented, this may include: • IP address; • browser information; • device information; • operating system information; • language settings; • access date and time; • authentication events; • system errors; • security events; • diagnostic information; • performance information; and • cookies or similar technical information. Such information may be used where reasonably necessary to operate, secure, diagnose and maintain the service.

NeverExpiry processes information necessary to create, authenticate and protect user accounts. Depending upon the authentication system currently implemented, this may include: • email address; • account verification information; • authentication status; • password-reset information; • session information; • authentication tokens; • security events; and • related account-security information. NeverExpiry does not retrieve or disclose a user's existing password through ordinary support communications. Users remain responsible for protecting their own account credentials and linked email account.

NeverExpiry may use optical character recognition and other automated technologies to assist with: • extracting text; • detecting possible dates; • identifying document types; • organising documents; • classifying information; and • reducing manual data entry. OCR and automated extraction can make mistakes. Users must verify important extracted information against the original document or authoritative source.

NeverExpiry may use AI-assisted functionality for appropriate service features such as: • document classification; • information extraction; • identifying possible expiry or renewal information; • translation; • organisation; • search assistance; and • user assistance. Private customer documents are not used by NeverExpiry to train NeverExpiry proprietary AI models. Where specialist technology services are required to provide a selected function, information should be limited to what is reasonably necessary for that functionality and handled subject to appropriate privacy and security arrangements.

OCR, AI and other automated systems may: • misread text; • extract an incorrect date; • fail to recognise information; • incorrectly categorise a document; • omit information; • misunderstand poor-quality documents; or • produce another inaccurate or incomplete result. Automated functionality is provided as assistance only. It does not replace inspection of the original document or verification with an authoritative source.

Users may choose to store documents containing information treated as particularly sensitive under applicable law. Depending upon the document, this may include information relating to: • health; • medical or dental matters; • biometric information appearing within identity documents; • racial or ethnic origin; • religion; • sexual life or sexual orientation; • trade union information; or • other specially protected information. NeverExpiry does not require users to upload such information unless they choose to store documents containing it. Where applicable law requires an additional legal condition for processing such information, an appropriate condition must apply.

Some documents may contain information relating to: • criminal convictions; • offences; • background checks; • safeguarding checks; or • similar information. Users should store such information only where they have appropriate authority and a lawful reason to do so. Applicable legal and security requirements will apply where such information is processed.

Documents uploaded by a user may contain personal information relating to another individual. This may include: • a child; • dependant; • spouse; • family member; • employee; • contractor; • customer; • patient; • client; • tenant; or • another individual. The user is responsible for ensuring that they have an appropriate lawful basis, authority or permission to store and manage another person's information where required.

NeverExpiry may be used by a parent, guardian, carer, responsible adult or lawful representative to manage documents relating to a child, minor or dependant. That person is responsible for ensuring they have appropriate authority to manage the individual's information. The responsible person must take reasonable steps to protect: • NeverExpiry account credentials; • the linked email account; • access to stored documents; • authentication and recovery information; • downloaded copies; and • the privacy of the child, minor or dependant. Storing documents within NeverExpiry does not transfer parental, guardian, carer or legal responsibility to NeverExpiry.

Where NeverExpiry permits information to be organised for family members, household members or dependants, the account holder remains responsible for controlling access to that information. Users should not create, upload or manage another person's information unless they have appropriate authority to do so.

Businesses, employers, healthcare professionals, dental professionals, property organisations and other professional or commercial users may use NeverExpiry. Where an organisation stores information relating to another individual, that organisation remains responsible for matters such as: • determining its lawful basis; • ensuring it has authority to process the information; • providing required privacy information; • controlling staff access; • responding to applicable rights requests; and • complying with its own regulatory or legal duties. Where NeverExpiry processes information on behalf of an organisation, applicable data-processing terms may apply.

Personal information may be processed where reasonably necessary to: • create and manage accounts; • provide the private document vault; • store and organise user-selected documents; • provide reminders; • provide search and catalogue functionality; • provide OCR or automated extraction; • provide AI-assisted functionality; • manage subscriptions; • provide requested support; • communicate essential service information; • maintain system and account security; • prevent fraud or misuse; • diagnose technical problems; • maintain and improve service functionality; • comply with applicable law; • establish, exercise or defend legal rights; and • protect users and the service.

Where applicable data-protection law requires a lawful basis, NeverExpiry may rely upon an appropriate basis depending upon the circumstances. These may include: Contract Where processing is necessary to provide a NeverExpiry service requested by the user or to take steps connected with providing that service. Legitimate Interests Where reasonably necessary for legitimate operational interests such as: • operating the service; • maintaining security; • preventing fraud; • maintaining reliability; • providing support; and • protecting NeverExpiry and its users, provided applicable individual rights do not override those interests. Consent Where consent is appropriate or legally required for a particular activity. Where processing is based upon consent, the user may withdraw that consent subject to applicable law. Legal Obligation Where processing is necessary to meet an applicable legal obligation. Vital Interests In exceptional circumstances where processing is necessary to protect an individual's vital interests. Other lawful grounds may apply where permitted by applicable law.

NeverExpiry aims to process only information reasonably necessary for the relevant purpose. Where appropriate, this may involve: • collecting fewer data fields; • avoiding unnecessary copies; • limiting unnecessary access; • minimising sensitive information within operational logs; • restricting information provided to authorised processing services; • removing temporary information when no longer required; and • reducing unnecessary exposure of private information.

NeverExpiry may rely upon specialist infrastructure or technology services necessary to operate particular functions of the service. Depending upon the actual production architecture, these may support areas such as: • hosting; • databases; • storage; • authentication; • communications; • payment processing; • OCR; • AI-assisted functionality; • security; • monitoring; or • backups. Where an authorised processing provider is used, access to information should be limited to what is reasonably necessary for the service being provided and subject to appropriate contractual, privacy and security safeguards where required.

Subscription and payment transactions may be processed through specialist payment infrastructure. NeverExpiry does not intend to store complete payment-card numbers or card security codes within its ordinary application database. Payment information processed directly by a payment provider may be subject to that provider's own legal and regulatory obligations. NeverExpiry may retain appropriate subscription, billing and transaction records where reasonably necessary for: • account administration; • accounting; • payment reconciliation; • fraud prevention; • legal obligations; or • dispute management.

NeverExpiry does not make users' private document libraries publicly available. NeverExpiry does not disclose users' private document contents to unrelated third parties for commercial exploitation. Private document information should remain limited to the user and the processing necessary to operate the selected NeverExpiry functionality, except where lawful disclosure is necessary under Sections 27 or 28.

Private information may be disclosed where permitted or required by applicable law, including in response to: • a binding court order; • a legally enforceable regulatory requirement; • a lawful request from a competent law-enforcement authority; or • another legally binding obligation. Where reasonably possible and lawful, the scope and validity of such a request should be assessed. Any disclosure should be limited to information reasonably necessary for the applicable legal requirement.

Information may be preserved, examined or disclosed where lawful, necessary and proportionate to: • investigate suspected serious fraud; • investigate serious criminal activity; • respond to suspected unauthorised access; • investigate a serious security incident; • protect the NeverExpiry service or its users; • address an appropriate safeguarding concern; or • respond to a serious threat to individuals or public safety. Any such action should be limited to what is reasonably necessary for the relevant purpose and subject to applicable law.

Users may access their private NeverExpiry account while travelling, working or living in another country. A user accessing their own documents from another country does not by itself mean that NeverExpiry has transferred those documents to another organisation in that country. A user's documents remain within the NeverExpiry service subject to the storage, security and service arrangements applicable to the account.

Private documents remain in the user's NeverExpiry vault while the user chooses to keep them there, subject to applicable account, legal, security and technical requirements. Users can delete documents from their vault when they no longer wish to retain them. Users considering cancellation or closure should review their vault and remove documents they no longer want retained. Retention of other information may depend upon factors such as: • whether the account remains active; • applicable legal obligations; • subscription or payment records; • security requirements; • fraud prevention; • dispute management; and • legitimate operational requirements. Information deleted from active systems may remain temporarily within protected backup systems until removed or overwritten through normal backup processes.

Cancelling a NeverExpiry subscription does not necessarily mean that every document or account record is immediately deleted. Before closing an account, users are responsible for: • reviewing their vault; • downloading documents they wish to retain outside NeverExpiry; and • deleting documents from their vault where they want them removed. Once an account has been closed, access to documents and account information may no longer be available in accordance with the applicable account-closure process. NeverExpiry may retain limited information where reasonably necessary or legally required for purposes including: • legal obligations; • accounting; • transaction records; • security; • fraud prevention; • dispute resolution; or • establishing, exercising or defending legal claims.

Information removed from active systems may remain temporarily within protected backups until those backups are removed, replaced or overwritten through normal technical processes. Backup information is intended for purposes such as: • system resilience; • restoration; • disaster recovery; and • service continuity. Backup copies are not intended to operate as an independently browsable user-document library after active deletion.

NeverExpiry takes appropriate measures to protect personal information and private documents held within the service. Detailed information concerning private vault security, authentication, authorised access, account protection, security incidents and user-security responsibilities is provided in the NeverExpiry Security Policy.

Where NeverExpiry becomes aware of a security incident involving personal information, the circumstances will be assessed and appropriate action taken in accordance with applicable law. Depending upon the incident, this may involve: • containment; • investigation; • remediation; • risk assessment; • appropriate internal documentation; • regulatory notification where legally required; and • notification of affected individuals where required by applicable law. Detailed security-incident procedures and security responsibilities are addressed in the NeverExpiry Security Policy.

Depending upon applicable law and the circumstances, individuals may have rights relating to their personal information. These may include rights concerning: • information about processing; • access; • correction; • deletion; • restriction; • portability; • objection; • withdrawal of consent; and • certain forms of automated processing. Not every right applies in every circumstance. Applicable legal conditions, limitations and exemptions may apply.

Where applicable law provides a right of access, an individual may request information regarding personal data NeverExpiry holds about them. NeverExpiry may take reasonable steps to verify the identity and authority of the person making a request before providing protected information. Identity verification is intended to reduce the risk of information being disclosed to an unauthorised person.

Where applicable, users may correct account information directly through available NeverExpiry functionality or request correction of inaccurate personal information. NeverExpiry's ability to correct information does not replace the user's responsibility to verify important document details against the original document or authoritative source.

Users can delete documents from their private vault using available service functionality. Where applicable law provides an additional right to erasure, an individual may also request deletion of qualifying personal information. The right to erasure is not absolute. Certain limited information may be retained where there is a lawful reason, including: • legal obligations; • security requirements; • accounting requirements; • transaction records; • fraud prevention; • disputes; or • legal claims.

Where applicable law provides a right to restrict processing, an individual may request restriction in the circumstances provided by law. This does not mean NeverExpiry routinely accesses or reviews documents stored within the user's private vault. A restriction concerns how particular personal information may be processed while a valid restriction applies. Where processing is required to provide a particular function, restricting that processing may affect that function.

Where applicable legal conditions are satisfied, an individual may have the right to receive certain personal information in a structured, commonly used and machine-readable format. The precise scope of any portability right depends upon applicable law and the nature of the processing.

Where applicable law provides a right to object to particular processing, an individual may exercise that right in the circumstances provided by law. NeverExpiry will assess a valid objection in accordance with applicable legal requirements.

Where a particular processing activity relies upon consent, that consent may generally be withdrawn in accordance with applicable law. Withdrawal does not affect processing that was lawfully carried out before consent was withdrawn. If a requested NeverExpiry feature depends upon the relevant processing, withdrawal may prevent that feature from continuing to operate.

Where NeverExpiry provides optional marketing communications, users may be able to opt out using the unsubscribe mechanism or relevant communication settings. Operational communications may still be required for matters such as: • account security; • authentication; • subscription administration; • requested reminders; • important service changes; or • legally required notices. Such operational communications are not necessarily marketing.

NeverExpiry may use cookies and similar technologies where required to operate functionality such as: • essential website functions; • authentication; • account security; • language preference; • user preferences; and • other currently implemented functions. Optional cookie categories should be handled in accordance with applicable consent requirements. Complete details are provided in the NeverExpiry Cookies Policy.

NeverExpiry does not use the contents of users' private documents for behavioural advertising or advertising profiling. Private document contents are processed only as reasonably necessary to provide, operate, secure and support NeverExpiry functionality, subject to applicable law.

NeverExpiry does not sell users' private document contents or operate users' private documents as a commercial data product. Private information is processed only as reasonably necessary to: • provide requested functionality; • operate the service; • maintain security; • provide support where necessary; • comply with applicable law; and • perform other lawful purposes described in this Privacy Policy.

Private documents stored within authenticated NeverExpiry accounts are not made publicly available or submitted by NeverExpiry for indexing by public search engines. Public NeverExpiry website content may separately be available to search engines.

Users are responsible for protecting their NeverExpiry account and documents when using shared, public or otherwise untrusted devices. Users should: • sign out when finished; • avoid saving passwords on shared or untrusted devices; • protect downloaded documents; • remove unnecessary local copies; • protect authentication and recovery information; and • take reasonable steps to prevent another person from accessing sensitive information. To the extent permitted by applicable law, NeverExpiry is not responsible for unauthorised access, disclosure, loss or misuse resulting from a user's failure to take reasonable steps to protect their account, device, credentials or downloaded documents.

Users are responsible for downloading, storing, reviewing and updating their own documents and information. Once a document is downloaded from NeverExpiry, responsibility for that downloaded copy rests with the user, including its: • storage; • security; • accuracy; • updating; • replacement; • sharing; and • deletion. Users must ensure that any downloaded or saved copy remains current and should independently verify important information against the original document or authoritative source. NeverExpiry cannot control or manage copies that have been: • downloaded; • saved; • copied; • emailed; • shared; • transferred; or • stored outside the NeverExpiry service. To the extent permitted by applicable law, NeverExpiry is not responsible for loss, outdated information, missed updates, missed deadlines or other consequences resulting from a user's failure to download, review, update, replace or securely manage documents outside the service.

NeverExpiry is a supporting, organisation and reminder tool only. NeverExpiry does not replace checking the original document or authoritative source. Information generated, extracted, classified or displayed through NeverExpiry may be inaccurate or incomplete because of factors including: • blurred documents; • damaged documents; • poor-quality images or scans; • partially readable documents; • documents uploaded into an incorrect category or section; • incomplete uploads; • missing document pages; • information omitted from the original upload; • incorrect information entered by the user; • OCR errors; • AI-assisted processing errors; • classification errors; • automated extraction errors; • technical errors; or • processing errors. Users must always verify important: • expiry dates; • renewal dates; • review dates; • document information; • reminders; • legal requirements; • compliance requirements; and • other important information against the original document and, where appropriate, the relevant official or authoritative source. NeverExpiry does not guarantee that every expiry date, renewal date, reminder or other item of information will be identified, extracted or displayed correctly. To the extent permitted by applicable law, NeverExpiry is not responsible for loss, penalties, missed deadlines, expired documents or other consequences arising from reliance upon inaccurate, incomplete, unreadable, incorrectly uploaded or incorrectly extracted information without independent verification.

NeverExpiry will consider privacy or data-protection concerns raised in relation to the service in accordance with applicable law. Individuals may also have the right to lodge a complaint with the relevant data-protection supervisory authority where provided by applicable law. For individuals subject to UK data-protection law, the relevant supervisory authority is the Information Commissioner's Office.

NeverExpiry may update this Privacy Policy where appropriate, including where: • functionality changes; • privacy practices change; • technical arrangements change; • applicable law changes; • new functionality is introduced; or • clarification is required. The latest revision date will be displayed at the top of the Privacy Policy. Where legally required, material changes may be communicated through an appropriate method.

English is the master Privacy Policy. The complete Privacy Policy must be available in every language and regional language currently supported by NeverExpiry. When the user selects another supported language or regional language, the complete Privacy Policy must be displayed in that selected language. This includes: • page title; • last-updated information; • sticky sidebar; • all 54 section headings; • all paragraphs; • bullet points; • privacy notices; • rights information; • account-responsibility wording; • user-verification wording; • deletion wording; • complaint wording; and • contact information. Translations must preserve the meaning and protections of the English master. Where an unintended translation inconsistency occurs, the English master may be used to clarify the intended meaning, subject to applicable law.

For privacy or data-protection enquiries relating to NeverExpiry, contact: contact@neverexpiry.com