Introduction
Last updated: 9 October 2026
Bangor University (“we”, “us” or “our”) respects the privacy of our users (“the user” or “you”). This Privacy Policy explains how we collect, use, disclose and safeguard your information when you use the Cysill add-in for Outlook (“the add-in”), as distributed to organisations licensed to use it. Please read this Privacy Policy carefully. If you do not agree with the terms of this Privacy Policy, please do not use the add-in.
Bangor University is the data controller for the information described in this policy.
We reserve the right to make changes to this Privacy Policy at any time and for any reason. We will notify you of any changes by updating the “Last updated” date of the policy. You are encouraged to review the policy periodically to stay informed of updates. You will be deemed to have accepted the changes in any revised policy by continuing to use the add-in after the date the revised policy is published.
Collecting your information
The content of your messages
The add-in checks the spelling and grammar of your text entirely offline, on your own device: the checker and the dictionaries are built into the add-in itself. No text is sent to a cloud server or to our servers. We therefore never see the content of your email messages: everything stays on your machine.
Checking the licence
There is no sign-in. To check that your organisation holds a valid licence for Cysill Outlook, the add-in sends two things to our validation server, and nothing else:
- your organisation’s identifier in Microsoft 365 (the tenant ID), an identifier for the organisation, not for a person;
- the email domain of your account (e.g.
example.wales), not your full email address.
We do not receive your name, your email address, any user identifier, or the content of any message. These two things are data about your organisation, not about you, and they do not enable us to identify you.
The add-in does not contact the validation server every time it opens: it remembers the result of the last check on your device for up to seven days (see Local storage below). The validation server does not keep a record of your request. The only thing kept is aggregate daily counts per organisation, that is, how many checks were made and their result, with nothing in them that refers to a person.
IP addresses and server logs
When the add-in connects to our servers, to download the add-in itself from our content server when it opens, and to perform the licence check, our servers see your IP address as a normal part of every web request. The validation service does not keep the IP address. It appears only in the web server’s ordinary access logs, which are used for security and troubleshooting and are deleted after 30 days.
Microsoft libraries and services
The add-in runs within Outlook, a Microsoft product. When it opens, it loads Microsoft libraries (Office.js and Fluent UI) from Microsoft servers, as every Office add-in does, and Microsoft sees the usual details of those requests, including your IP address. Your organisation’s identifier, described above, reaches the add-in through Office.js; it is issued by Microsoft. This Privacy Policy does not apply to Microsoft services, which collect and use data according to their own policies, and we are not responsible for them. See the Microsoft Privacy Statement for more information.
Local storage on your device
The add-in does not use cookies or any analytics tracking. It keeps three things in the local storage of your Outlook or your browser (localStorage), on your device only; none of them is ever sent to us:
- the result of the last licence check, that is, your organisation’s licence status, its end date, and how long the result can be relied on, with no email address in it;
- your personal dictionary, the words you ask Cysill to “Learn”;
- a note that the welcome screen has been shown for this version of the add-in.
You can delete all of these by clearing your browser data; the add-in will re-check the licence and start a new personal dictionary.
Updates and error reports
The add-in is loaded from our content server every time it opens, which is how Outlook add-ins work, so updates arrive automatically, with nothing downloaded separately. The add-in does not send us error reports.
Using your information and the lawful basis
The data described above is used for the following purposes only:
- checking that your organisation holds a valid licence for Cysill Outlook;
- administering and maintaining organisational licences;
- aggregate usage statistics per organisation;
- protecting our servers and services from misuse.
The organisation identifier and the email domain relate to your organisation, not to you. The only personal data we process as a result of your use of the add-in is the IP address in the web server’s access logs, temporarily. Our lawful basis for that under the UK General Data Protection Regulation (UK GDPR) is our legitimate interests (Article 6(1)(f)), namely protecting our infrastructure and administering the service.
The data is not used for any other purpose, such as marketing or analysing the behaviour of individual users.
Retaining your information
We keep nothing per person as a result of your use of the add-in. The aggregate daily counts per organisation, which are not personal data, are kept for up to 13 months for statistical purposes. Your organisation’s licence details (the order, its domains and tenant, and the licence periods) are kept as part of our commercial records for as long as the organisation is a customer, and in line with our customer records retention schedule thereafter. For the web server’s access logs, see IP addresses and server logs above.
Sharing data and server location
We do not sell, rent or share your information with any third party for commercial or marketing purposes. The content server and the validation server are both on Bangor University servers, on the University’s network in the United Kingdom. The data is not transferred outside the United Kingdom, and no third-party processor handles it.
Your rights
Under UK data protection law you have rights in relation to your personal data, including the right to:
- ask for a copy of the data we hold about you (right of access);
- ask us to correct inaccurate data;
- ask us to delete your data;
- ask us to restrict processing or to object to processing;
- data portability, where applicable.
Since the add-in sends us nothing that identifies you as an individual, we do not, as a rule, hold data about you to provide, correct or delete as a result of your use of it. If you make a request, we will consider it against what we hold, including the web server’s access logs while they exist.
To exercise any of these rights, contact us using the details below. You also have the right to complain to the Information Commissioner’s Office (ICO): ico.org.uk.
Automated decision-making and profiling
We do not use your data for any automated decision-making or profiling.
Security of your information
We use administrative, technical and physical security measures to help protect your information. While we have taken reasonable steps to secure the information we receive, please be aware that, despite our efforts, no security measures are perfect or impenetrable, and no method of data transmission can be guaranteed against interception or misuse. As a result, we cannot guarantee complete security.
Contact us
If you have questions or comments about this Privacy Policy, please contact us:
Language Technologies Unit
Canolfan Bedwyr
Bangor University
College Road
Bangor
Gwynedd
LL57 2DG
Wales, UK
You can also contact Bangor University’s Data Protection Officer about any matter relating to data protection.