Privacy

This service connects your Microsoft To Do and Planner tasks, your Outlook mail, and your SharePoint and OneDrive files so that an assistant you control can read them on your behalf and, where you have switched Write on for an account, change them when you ask it to.

What we store

• Your email address and the identifier your sign-in provider gives us, so we know who you are.
• The access we were granted to a task provider you connected, encrypted at rest under a key held by this deployment's key store. It is used only to read the tasks you asked for and, where you have switched Write on, to make the changes you asked for.
• The name your provider gives each account you connect (for Microsoft, its user principal name), and any name you give it yourself on the connections page — used only to tell your accounts apart.
• If an organisation's admin invites you, the email address they invited, the organisation and teams it is for, and when it expires — so the invitation can be shown to them and accepted by you. Only a fingerprint of the invitation link is kept, never the link itself. An invitation that expires or is withdrawn is deleted after a retention period, and every invitation to your address is deleted if your account is erased.
• An audit record of sign-ins, consent grants, disconnections and each change your assistant made to your tasks — which task and which fields changed, never what they say — and of each email draft it saved in your mailbox or sent after approval: how many recipients, never who or what it says. Where you have switched on reading email content, also each time your assistant read the text of one of your emails: which part (the whole message or only the latest reply), roughly how long it was and whether it was shortened — never who wrote it or what it says; which message it was is kept only in the read log, listed below.
• For each email draft your assistant saves, for a limited time: the draft's id in your mailbox, the domains of its recipients and a fingerprint of its content, so a later change to the draft can be detected, and whether it was sent after approval. Never the addresses, the subject or the text — the draft itself stays in your mailbox, and a person approving its sending reads it from there.
• Where you have switched on reading email content, a read log — separate from the audit record above — of each email whose text your assistant read: which message (an identifier), when it arrived, when it was read, and which client and account read it — never its subject, who wrote it or what it says. You can see the latest 50 on your account page; older entries are kept, and deleted, on the same schedule as the record of your calls below. It is deleted with your account, and an organisation's entries with the organisation.
• When an action your assistant asks for is held for approval by a person on your team, what it would do — for a new file, its content, at most 64 KB — is stored, encrypted, until the action is approved and run, denied or withdrawn, and for at most 1 day if nobody decides. Once it has run, its result is kept, encrypted, for 1 hour. Held content is also deleted if your account is erased.
• Technical monitoring data: which tool was called, when, how long it took and whether it failed. It never includes the content of what was read or written.

How long call records are kept

• A call made for an organisation follows that organisation's own setting: 180 days unless its owner sets another, and never more than 365 days. When an organisation is deleted, the record of its calls is deleted with it. After that it is deleted on the next cleanup pass.
• A call not tied to an organisation is kept for 180 days. After that it is deleted on the next cleanup pass.
• If your account is erased, the record of each of your calls is unlinked from you rather than deleted, and is removed when its retention runs out.

What we do not store

• Passwords. Authentication happens at your provider, never here.
• Any other profile detail.
• The identity token issued when you connect an account. It is checked once and discarded.
• We do not store the content of your Microsoft To Do and Planner tasks, your Outlook mail, or your SharePoint and OneDrive files. It is read when your assistant asks for it, handed over, and dropped. Only lists of tasks may be held in a short in-memory cache, for minutes, while your assistant is reading; mail and file content is never cached.
• The text of your emails. Where you switch on reading email content for an account, your assistant can read the full text of one email you point it at; that text is passed to your assistant when it asks and is never stored or cached here.
• Your calendar. Where you switch on reading your calendar for an account, your assistant can read its events — times, titles, locations, the organiser and the attendees' names and addresses — each time it asks; they are passed to your assistant and never stored or cached here. An event's description is read only where you also switch descriptions on, and a meeting's join link is passed on only where you also switch join links on.

Your control

Disconnecting an account on the connections page deletes our copy of that access immediately. You can also withdraw access at your provider at any time.