Privacy policy
Effective 3 October 2026
1. Who is responsible for your data
iSAP Solutions Ltd 14 Castle Walk, Lower Street London-Stansted, Essex, CM24 8LY United Kingdom
Registered in England and Wales, company number 10660611. Director: Tino Herold.
Email: support@isap.host
We are the controller for the personal data described here. Write to the address above for anything in this policy, including the rights in section 6.
2. What we collect, why, and on what basis
| What | Why | Our basis |
|---|---|---|
| Your name, email address, password (stored only as a hash) and, if you give one, your company | To create and run your account | Performance of our contract with you |
| Your billing address and the services you order, with amounts and dates | To provide the service and to issue and keep invoices | Performance of the contract, and our legal duty to keep accounting records |
| Your messages to us | To answer you | Performance of the contract, and our legitimate interest in keeping a record of what was agreed |
| That an invoice was paid, and by which route | To match payments to invoices and to issue receipts | Performance of the contract, and our legal duty to keep accounting records |
| Items you put in a basket without ordering | So your basket is still there when you come back | Performance of the contract, at your request |
| A session record while you are signed in, holding your IP address and your browser identification, and other technical records of sign-ins and security checks | To keep you signed in, to keep accounts secure and to tell ordinary use apart from abuse | Performance of the contract, and our legitimate interest in the security of the service |
We do not use your data for advertising, we do not profile you, and we do not sell your data.
3. Who else handles your data
Our infrastructure is operated by a provider based in Germany. Your account, your orders and the content you store with us are processed on its systems under a written contract that allows it to act only on our instructions.
Email between us — including order confirmations and password resets — is sent and received by our own mail server, at the same German provider. No third party sends mail on our behalf.
If you pay with iSAP Wallet, we send the wallet service the amount, the currency, the invoice number and what the payment is for. We send it nothing about you — not your name, not your email address. You sign in to the wallet yourself, and that service handles your data under its own privacy policy.
If you pay with PayPal, you enter your payment details with PayPal UK Ltd, 5 Fleet Place, London EC4M 7RD, a United Kingdom company authorised and regulated by the Financial Conduct Authority as an electronic money institution (firm reference number 994790). You give those details to PayPal, not to us — we never see your card or bank details. PayPal decides for itself what it does with them, under its own privacy policy. What we send PayPal is the invoice number, the amount and the currency, and the address to return you to afterwards — not your name, not your email address, not your postal address. What comes back to us is confirmation that the invoice was paid.
One thing happens before you click. On the page where you pay, your browser loads PayPal's own script directly from PayPal, so that the payment button can appear. From that moment PayPal can see your IP address and the usual information your browser sends. This happens only on that page, and only when you have chosen PayPal — nowhere else on this site, and not if you pay another way.
We use no captcha service, so no third party sees your IP address when you sign in or register.
We do not pass your data to anyone else unless the law requires it of us.
4. Data that leaves the United Kingdom
Our infrastructure provider is in Germany, so hosting your account and your data does not involve a transfer outside Europe. We do not transfer your data outside Europe. Where you pay through another service, that service handles your payment under its own privacy policy, and you can read there what it does.
5. How long we keep things
| What | How long |
|---|---|
| Invoices and payment records | Six years after the end of the financial year the invoice falls in. Our financial year ends 31 March |
| A basket you never ordered from | 30 days |
| Session and security records holding your IP address and browser identification | 90 days |
| Your account data | Until you delete your account |
| Your support tickets | Until you delete your account — they go with it |
Email you send to support@isap.host also sits in our mailbox. We delete it once we no longer need it for the matter you wrote about. It is not removed automatically when you close your account, so if you want a particular message gone, ask us and we will delete it.
These periods are enforced by a job that runs every day at 03:30 and has been doing so since 3 October 2026. Records that the law requires us to keep are retained for as long as the law requires, without your email address or telephone number where we no longer need them.
6. Your rights
You can ask us to:
- give you a copy of the personal data we hold about you,
- correct anything that is wrong,
- delete your data,
- restrict what we do with it,
- send your data to you or to someone else in a portable form,
- stop processing based on our legitimate interests.
Write to support@isap.host. We answer within one month. We do not charge for this, and we do not ask you to give a reason.
Where we must keep a record for accounting reasons, we will tell you so and say what we have kept.
If you are not satisfied, you can complain to the Information Commissioner's Office, the United
Kingdom's supervisory authority for data protection (ico.org.uk). If you are in the European Union,
you may also complain to the supervisory authority where you live.
7. Deleting your account
Write to support@isap.host and we will delete it. You do not need to give a reason, and there is no form to fill in. We act without undue delay and in any event within one month of your request.
What happens to your invoices. Where the law still requires us to keep an invoice, we do not delete it. We remove you from your account — your name, your email address, your telephone number, your settings, your tickets, your sessions and your access tokens all go — and what remains is the invoice itself, together with the order it belongs to, because an accounting record has to stay identifiable as a record of that transaction. Once the retention period in section 5 has run out, that too is deleted.
If there is no invoice we still have to keep, nothing is anonymised: your account and its data are deleted outright.
Open servers and services are ended with the account. Anything you have stored on a server you rent from us is deleted with that server, so take a copy first if you want to keep it.
8. Children
This service is for businesses and adults. We do not direct it at children and we do not knowingly collect data from them.
9. Changes to this policy
If we change this policy we will publish the new version here and change the date at the top. If a change affects how we use data you have already given us, we will tell you before it takes effect.