Privacy notice

Last updated 18 September 2026.

Never Lapse is a trading name of Isaac Harrison. is the data controller for the information described here. Contact: hello@neverlapse.co.uk. Address:
4 Boot Lane
Blaenavon
NP4 9HA

What we collect

Data	Why	Lawful basis
Your name and business name	To address you correctly and know whose renewals these are	Contract
Email address, and phone if you give one	To send the reminders you are paying for	Contract
Renewal types and dates	The substance of the service	Contract
Legal structure of your business	To work out whether you are an individual or corporate subscriber under the Privacy and Electronic Communications Regulations, which determines what we may lawfully send you	Legitimate interests
A record of every message we send you	So we never send the same reminder twice, and can prove what was sent if you ask	Legitimate interests
Replies you send us	To act on them	Contract

Where the basis above is legitimate interests, the interest is running the service accurately and being able to show that we did. Keeping a record of every message means we never send you the same reminder twice and can prove what was sent if you ask. Knowing your legal structure means we apply the right marketing rule to you: the Privacy and Electronic Communications Regulations treat a sole trader or partnership as an individual subscriber, with more protection than a limited company gets. Those regulations do not require us to hold that classification — they restrict what we may send you — so calling it a legal obligation would be wrong. We are satisfied it does not override your interests: the information is your own business's legal structure, you gave it to us yourself at signup, and the effect of holding it is that you receive fewer messages, not more.

We do not use cookies, analytics, advertising trackers, or social media pixels on this website. There is nothing here to consent to, which is why you were not asked.

Who else sees it

• Stripe — processes your card payment and holds your billing details. We never see your card number. See Stripe’s privacy policy.
• IONOS — hosts our email, so reminders and your replies pass through their servers.
• Netlify — serves this website. They see the usual things a web server sees when you visit a page: your IP address, roughly when you visited, and which page. They never see your renewal dates or anything else we hold about you, because this site has no login, no forms and no scripts — there is nothing here for it to send them.
• Microsoft — our off-machine backup copy is kept in OneDrive, so a daily archive of our records, which includes yours, sits on their servers. The archive itself is a plain compressed file, not separately encrypted by us; it relies on OneDrive’s own encryption and on the account being ours alone. A backup nobody can reach in a fire is not a backup, and this is the honest cost of having one.

That is the complete list for the NeverLapse reminder service: an earlier version of this notice named only Stripe and IONOS while the site was already served by Netlify and backed up to OneDrive. The separate HUMHAR recipients are described below. We do not sell your data, share it with data brokers, or pass it to anyone for marketing.

HUMHAR and eBay

HUMHAR is an internal resale and dropshipping tool operated by the same data controller named at the top of this notice. It is currently being configured: it does not yet make production eBay API calls or place live trades. If it is activated, it will connect to the controller’s eBay seller account using OAuth. HUMHAR does not receive the eBay account password. Access and refresh credentials are kept in the owner-controlled operating-system environment, not in this website, public source code, or HUMHAR’s operational database.

The information comes from eBay’s APIs and the buyer’s and seller’s eBay records. HUMHAR does not use it for advertising, unrelated marketing, or profiling.

Who receives HUMHAR data

• eBay — the marketplace and source of the account, listing and order records.
• An approved wholesale supplier — only the minimum buyer and delivery details needed to fulfil an order, and only after the controller has a written supply agreement covering that processing.
• The supplier’s delivery carrier — the minimum delivery and contact information needed to deliver and track the parcel.
• Accountants, HMRC, courts, regulators or professional advisers — only where the controller is legally required to disclose the record or needs it to establish, exercise or defend a legal claim.

HUMHAR’s operational database is held locally and is excluded from public source control. Transaction records are kept only for as long as they are needed to complete the order, handle returns, refunds and disputes, and meet accounting, tax and legal duties. Buyer contact and delivery details are deleted or irreversibly anonymised when they are no longer needed for those purposes.

Before the first production eBay API call, the controller will subscribe to eBay’s Marketplace Account Deletion/Closure notifications and will delete or irreversibly anonymise data linked to a notified account, except for the minimum record that must be retained for a demonstrable legal obligation. The controller will not claim the exemption available to applications that do not store eBay user data, because HUMHAR stores buyer order and delivery data. The production connection remains disabled until this handling and the retention controls have been configured and tested.

The rights and complaint routes below apply equally to HUMHAR records. If we obtained your information from eBay rather than directly from you, this public page is also the notice explaining that processing. Contact hello@neverlapse.co.uk to exercise a right or ask a question.

Marketing

Buying this service does not opt you into marketing. Your record is created with marketing permission set to false, and the delivery path refuses to send a marketing message to anyone whose record says that — it is enforced in code, not by policy. If we ever want to tell you about something else we offer, we will only do so if you have explicitly asked us to — and any such message will have a one-click way to stop. Reminders about your own renewals are service messages, not marketing, and you receive those for as long as you are a customer.

How long we keep it

• While you are a customer, plus 12 months after you cancel, in case you come back or query something.
• Payment records for six years, because HMRC requires it.
• If you ask us not to contact you, we keep your email address on a suppression list indefinitely. This is deliberate: it is the only way to guarantee we never contact you again by accident, and deleting it would defeat the purpose.

If we approached you and you are not a customer

We find customers by contacting small businesses directly, so we may hold a record about you before you have bought anything from us, or after you have told us no. You did not give us that information yourself, so the law requires us to set out where it came from. This is that notice.

• What we hold — your business name and trade, a contact name where it is published, a phone number or email address, and notes of any conversation: what you already use to keep track of renewals, what you made of the price, and the reason if you said no.
• Where we got it — sources that are already public: your own website or social page, a trade or local listing, the sign on your van, or someone who suggested we speak to you. We do not buy contact lists and we do not use data brokers.
• Why, and on what basis — to offer you the service, and to learn from the answer if you turn it down. The basis is legitimate interests: approaching a business about something relevant to that business, and keeping enough of a record to know whether the idea is any good. We are satisfied that is fair, because these are business contact details published in order to be contacted, and because one approach is not a campaign.
• How long — while we are still in touch, and for up to 12 months after our last contact so that we do not approach you twice about the same thing. After that we delete the contact details and keep only what we learned, with nothing in it that identifies you. If you become a customer, the periods above apply instead.
• What you can do — you can object to us holding it at all, and ask us to delete it. You do not have to give a reason and we will not ask for one. If you would rather be certain we never approach you again, say so and we will add your address or number to the suppression list described above, which we keep for exactly that purpose.

Everything in the rest of this notice — who else sees your data, where it lives, your rights, and how to complain — applies to these records too.

Your rights

You can ask us to show you the data we hold about you, correct it, delete it, restrict what we do with it, object to what we are doing with it, or hand it over in a portable form. Email hello@neverlapse.co.uk. We will respond within one month, and there is no charge.

If you are unhappy with how we have handled your data you can complain to the Information Commissioner’s Office at ico.org.uk, or on 0303 123 1113. We would rather you told us first, but you do not have to.

Where your data lives

Your NeverLapse records and HUMHAR’s operational database are held in the United Kingdom. Stripe, IONOS, Netlify, Microsoft, eBay, an approved supplier and its delivery carrier may process data outside the UK under the safeguards described in their own policies and contracts.

Security

Access to your records is limited to Isaac Harrison. Payment card details are never held by us at all — they go directly to Stripe. We are a small operation and describe our security honestly rather than impressively: it is appropriate to the data described above: NeverLapse contact details and calendar dates, and, if HUMHAR is activated, the minimum eBay order, delivery and accounting records needed for the stated purposes.

Changes

If we change this notice in a way that affects you, we will email you before it takes effect.