Effective date: [EFFECTIVE DATE] · Issued by [LEGAL ENTITY NAME]
[LEGAL ENTITY NAME] (company number [COMPANY NUMBER], registered office [REGISTERED OFFICE ADDRESS]) operates AI Command. Contact our privacy team at [PRIVACY CONTACT EMAIL].
For our own account administration, billing, security and service operations we generally act as controller. When processing customer Microsoft 365 tenant data on behalf of a business customer, we generally act as its processor; that customer remains responsible for its own privacy notice and lawful basis. Roles depend on the actual processing activity.
Account information: name, work email, organisation, login identifiers, role and contact details.
Connected Microsoft tenant information: tenant identifiers, user and licence assignments, subscribed product identifiers, subscription and commitment metadata, device/security configuration information where enabled, Copilot adoption or usage metrics where permissions and features permit.
Service information: support correspondence, subscription preferences, reports, audit events, security logs and technical diagnostics.
We do not intend to collect message or document contents for licence optimisation. If additional Graph permissions or AI features introduce content processing, this notice and the data-processing terms must be updated before deployment.
We process account and customer-contact data to provide and administer the service (contract or legitimate interests, as applicable); billing and tax records to meet legal obligations; and limited security/diagnostic data to protect the service (legitimate interests or legal obligation).
Where we act as processor for customer tenant data, the customer determines the applicable lawful basis; we process it under documented customer instructions and our data processing agreement.
Optional marketing is sent only where lawful under applicable electronic marketing rules. You may opt out at any time.
Data may come from you, your employer or administrator, authorised Microsoft Graph integrations and our service infrastructure.
We may disclose relevant data to contracted hosting, authentication, support, email and infrastructure providers, professional advisers and authorities where legally required. A verified list of subprocessors should be published on our subprocessor page.
Hosting and access regions: [INSERT ACTUAL HOSTING REGIONS]. Confirm all processing and support locations.
Where personal data is transferred outside the UK, we will ensure a lawful transfer mechanism and appropriate safeguards are in place, such as adequacy regulations or approved contractual protections where required.
Retention periods: [INSERT VERIFIED RETENTION PERIODS]. Publish separate, accurate periods for accounts, tenant snapshots, user assignments, logs, support records, backups and invoices.
When a customer disconnects or ends its agreement, tenant data is returned or deleted in accordance with the data processing agreement, subject to lawful retention and backup expiry.
Depending on the circumstances, individuals may request access, correction, erasure, restriction, portability or object to processing, and may withdraw consent where consent is the lawful basis. Rights are subject to legal exceptions.
For customer-controlled Microsoft tenant information, we may refer requests to the relevant customer organisation and assist it as processor.
Contact [PRIVACY CONTACT EMAIL]. You can also complain to the UK Information Commissioner’s Office (ICO).
We use appropriate technical and organisational measures proportionate to the risks. Do not publish claims about certifications, encryption or hosting that have not been verified.
We will update this notice when our data practices materially change and indicate the effective date above.