Privacy Policy

This Privacy Policy explains how GraphPaaS, operated by DataTouches ("we", "us"), handles personal data. For the data we read from your Microsoft 365 and Azure environment, your organisation is the data controller and we act as a data processor on its instructions.

1. Data we process

• Microsoft 365 & Azure metrics — read-only, via the Graph and Azure APIs. This can include personal data such as user principal names, display names, device names, sign-in activity and usage statistics.
• Licence management — for each licensed user: their name, user principal name, whether the account is enabled, the licences they hold and why one could not be assigned, and the date of their last sign-in (only where the tenant has Microsoft Entra ID P1). In schools that use School Data Sync we read one field of the roster, whether the person is a student or a teacher, to tell which licences fit them. We never read anything else from the roster, such as date of birth, gender, address, phone number, classes or grades.
• Account data — the identity of users who sign in to GraphPaaS (name, email, tenant) and their preferences, and billing details handled by our payment provider.
• Activity records — a security log of actions taken in the Service: who signed in and when, changes to members and tenants, and data exports. When your organisation downloads a full data export, we record the IP address and browser (user agent) of the person who downloaded it, with a fingerprint of the file. When the Service is queried through an AI assistant (see section 5), we record which tool, metric area and tenant were requested, never the question or its filters.
• Account register — a record of the changes that shape your account: tenants added, disconnected, moved or deleted; each admin consent, with the account the consenting administrator signed in with at Microsoft; members invited, removed or changed and ownership transfers; API keys and onboarding links created or revoked; account closure and data exports. Each entry names who made the change (their email, or that it was us or an automatic process), and once a day we note how many tenants and members the account has. Nothing from your Microsoft 365 data goes into it.

We never modify data in your Microsoft environment, and we do not sell personal data.

2. Purpose and legal basis

We process this data solely to provide the analytics and reporting features of the Service to your organisation, on the basis of the agreement between us and, where applicable, a Data Processing Agreement (DPA).

The account register is ours: we keep it as controller, under our legitimate interest (Art. 6(1)(f) GDPR) in being able to show what was agreed and done on an account, for instance in a billing dispute or a security incident. That is why it is kept after the account is deleted (Art. 17(3)(e) GDPR: establishing, exercising or defending legal claims).

3. Retention

Collected metrics are retained for a limited period — 90 days by default, or as agreed with your organisation — after which they are automatically purged. On disconnection or account closure we delete or return your data. Activity records are kept while the account exists so that your organisation can review them, and are deleted with it. When an account is closed, everything is permanently deleted 15 days later; until then the closure can be cancelled and the data exported. Encrypted backups (see section 4) are kept for up to 100 days and then erased, so deleted data can remain in a backup for that long, unreadable to anyone without our offline keys.

The account register is the exception: each entry is kept for 5 years from the change it records, including after the account is closed and everything else is deleted, and then erased. Entries cannot be edited, and its encrypted backup copies follow the same 5 years.

4. Storage and security

• Data is stored on infrastructure located in the European Union (France).
• A nightly backup is encrypted on our servers before it leaves them and stored in the European Union (Netherlands). The decryption keys are kept offline, never with the backup, so the storage provider cannot read it.
• All connections use TLS encryption in transit.
• Access tokens are stored encrypted and expire automatically.
• Application logs are masked so they do not contain identifying personal data.
• Signing in sets one strictly necessary cookie that holds your session. Scripts on the page cannot read it, and it ends when you sign out or after an hour.
• Website analytics are self-hosted and do not use cookies.

5. AI assistants

A user of your organisation can connect GraphPaaS to an AI assistant, such as Claude or ChatGPT, through our MCP connector. It is optional and off until someone connects it. Once connected, the assistant reads only what that user can already see in the dashboard, and the answers it receives, which can contain personal data such as names, email addresses and sign-in activity, are sent to the assistant's provider. That provider processes them under your organisation's own agreement with it, not ours. We do not send your data to any AI provider ourselves, and we do not use it to train models.

6. Sub-processors

• Hostinger — servers, database and file storage, in France (EU).
• Microsoft Azure — storage for encrypted backups, in the Netherlands (EU).
• Cloudflare — network security and TLS for our websites; traffic to the Service passes through its network.
• Resend — email delivery, in Ireland (EU).
• Stripe — payments and invoicing; receives billing details only, never data from your Microsoft environment.

Each is bound by data-processing terms. Where a provider may process data outside the EU, the transfer is covered by its terms, including the EU Standard Contractual Clauses.

7. Your rights

As the personal data belongs to your organisation's environment, requests to access, correct or erase data should be directed to your organisation (the controller), which can instruct us accordingly. Your organisation's owner can download a full export, delete a connected tenant or close the account directly in the Service.

8. Contact

Privacy questions or requests: [email protected].