Tealdroid LLP (“we,” “our,” or “us”) operates Tealdroid AI, an AI-powered Microsoft 365 integration, and Danny Policy Management, a policy acknowledgement app for Microsoft 365. Sections 2–11 describe Tealdroid AI; Section 13 describes Danny Policy Management. Our registered address is SF NO.462/30B, SITE 35E, METRO GRAND 4, ANNUR, COIMBATORE NORTH, MASAGOUNDENCHETTIPALAYAM, COIMBATORE, TAMIL NADU, 641107. Our contact email is privacy@tealdroid.com. Data Protection Officer (DPO): Not appointed – privacy matters are handled by our Privacy Team.

We collect:
(a) License Data: We receive your Microsoft 365 Tenant ID, which uniquely identifies your organization but does not contain personal information.
(b) Service Data: This is the plain text content you explicitly select from SharePoint for AI processing (e.g., text generation, translation, text-to-speech).
(c) Telemetry Data: Anonymous usage data to monitor service health.

We use your data to:
(a) Validate Your License using your Tenant ID.
(b) Provide AI Features: We transmit your Service Data (plain text) to our AI Sub-processor to execute your command and return the result to you in SharePoint.
(c) Monitor Service Health using anonymous Telemetry Data.

Our processing is based on:
(a) Contract performance: to provide the licensed service to your organization.
(b) Legitimate interest: to ensure the security of our service and to validate licensing.

We do not sell or rent your data. We share data only with these sub-processors:
(a) Microsoft: We use the Microsoft Commercial Marketplace for billing and to provide your Tenant ID.
(b) Microsoft Azure: We use Azure for application hosting.
(c) AI Sub-processor: We transmit your Service Data to Microsoft Foundry, which is hosted in your region. This single service provides all our AI capabilities. We have configured this service to be 'stateless,' meaning it does not store your data or use it for model training.

(a) Service Data (Plain Text): Our service is stateless. Your Service Data is processed in-memory and is never stored on our servers, not even in a temporary cache. It is transmitted, processed, and the response is returned, after which the data is immediately discarded.
(b) License Data (Tenant ID): This is retained for as long as your organization's subscription is active and for 30 days after termination for license management.

As we do not collect or store personal data related to your account, rights such as access or rectification are best directed to your organization's Microsoft 365 administrator. However, under applicable data protection laws (including GDPR and UK DPA), you have the following rights:

- Right of access: You have the right to request a copy of the information we hold about you.
- Right to rectification: You have the right to correct data that is inaccurate or incomplete.
- Right to erasure: You have the right to ask for your data to be removed from our systems.
- Right to restriction of processing: You have the right to request that we limit the way we use your data.
- Right to data portability: You have the right to request that we move, copy, or transfer your data.
- Right to object: You have the right to object to our use of your data.
- Rights related to automated decision-making including profiling: You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. (Note: Tealdroid AI does not perform any such automated decision-making or profiling processes).

To exercise any of these rights, please email privacy@tealdroid.com.

If you wish to access, correct, or delete the information we hold about you, you can submit a Subject Access Request (SAR) using our secure Microsoft 365 form: https://forms.office.com/r/h47mjc4YZj. We will acknowledge your request within 48 hours and respond within 30 days in accordance with applicable data protection laws. Before releasing any data, we may ask you to verify your identity to ensure security.

All your data is processed within the Microsoft Azure region selected by the customer. Our AI sub-processor (Microsoft Foundry) is also configured to operate within that same geographic region. If any cross-region transfer were ever required, we would rely on Microsoft’s Standard Contractual Clauses and equivalent safeguards.

We apply industry-standard security controls including encryption in transit (HTTPS/TLS 1.2+) and least-privilege access controls.

Our Website: Our public website (tealdroid.com) may use limited, anonymous analytics from tools like Microsoft Clarity. These analytics tools use first-party cookies to collect aggregated, anonymous statistics about website traffic. You can disable cookies via your browser settings.

Our Application: The Tealdroid AI for SharePoint application does not use any cookies or analytics tools. It collects only the anonymous Telemetry Data mentioned in Section 2 to monitor service health.

If you believe your data has been handled improperly, you may contact our Privacy Team at privacy@tealdroid.com or lodge a complaint with the UK Information Commissioner’s Office (ICO):
Website: www.ico.org.uk
Phone: +44 303 123 1113

We may update this Privacy Notice from time to time. The latest version is always available at https://tealdroid.com/privacy.

This section applies to Danny Policy Management (“Danny”), which runs in Microsoft Teams and as a task pane in Outlook, Word, Excel and PowerPoint. Unlike Tealdroid AI, Danny stores records on our servers so it can track policy acknowledgement for your organisation.

(a) Directory data: display names, email addresses and Microsoft Entra object IDs of people in your organisation, and the names and memberships of groups that policies are assigned to.
(b) Policy records: references to the SharePoint documents your administrators register as policies, their names and versions.
(c) Assignment and acknowledgement records: who a policy is assigned to, due dates, reminders, acknowledgements (who acknowledged which version and when), and quiz questions, attempts and answers.
(d) Audit and settings data: an audit log of administrative actions, your organisation's settings, and its AI connection settings (the API key is stored encrypted).
(e) Policy document content is read from your SharePoint on demand to display it, generate quizzes or answer questions. It is not stored by Danny. Questions asked to Ask Danny are processed and not stored.

We use this data only to provide Danny to your organisation: to show people the policies assigned to them, record their acknowledgements, send reminders to their Microsoft Teams activity feed, give administrators compliance views, and keep an audit trail. Danny does not perform automated decision-making or profiling, and does not use your data for marketing, analytics or model training.

Each organisation's records are kept in a dedicated database in Microsoft Azure (Azure SQL Database), in the Sweden Central region (European Union), separate from every other customer. Data is encrypted at rest and in transit (TLS 1.2+). Policy documents stay in your own SharePoint.

We do not sell or rent your data. Danny uses Microsoft Azure for hosting and Microsoft 365 (Microsoft Graph and Microsoft Teams) to read directory and SharePoint data and deliver reminders. Danny's optional AI features (quiz generation and Ask Danny) run on your organisation's own Azure AI Foundry resource, which your administrator connects. Content sent for AI processing goes to that resource in your Azure subscription, not to a Tealdroid AI service.

Danny keeps your organisation's records while its subscription is active, and deletes them within 30 days after the subscription ends. Names and email addresses come from Microsoft Entra ID, so corrections made there are reflected in Danny. To access or delete your personal data, or exercise any of the rights in Section 7, use the request form in Section 7.1 or email privacy@tealdroid.com. Danny does not use advertising or analytics cookies.