Privacy Policy

How Xertone LLC handles information when you use TeamsPIM and related services.

1. Effective Date

This Privacy Policy is effective as of May 20, 2026. We will note the date of any future material changes in Section 12 below.

2. Data Controller

The data controller responsible for personal data processed under this Policy is:

• Xertone LLC, a Texas limited liability company
• Registered office: Plano, Texas, USA
• Contact: see Section 13 below

3. What We Collect

To operate TeamsPIM and meet Microsoft AppSource Marketplace publisher requirements, we collect:

• Subscription and configuration data— your organization's subscription status, tenant identifier, license assignments, and deployment settings managed through the Customer Admin Portal.
• Adaptive card cache state — transient state used to synchronize adaptive card updates across users and tenants. This data auto-expires once the underlying workflow completes.
• Telemetry — usage events and error events required by AppSource Marketplace publisher requirements and used to maintain service quality and diagnose issues.

4. What We Do NOT Collect

We do not collect or store the following categories of data:

• PIM role data — role assignments, eligibility, and activation details are queried live via Microsoft Graph at the moment of request and are not persisted in our systems.
• Passwords or credentials — we never access, collect, or store user passwords or authentication secrets. Authentication is handled by Microsoft Entra ID.
• Teams message content — we do not read, store, or process Teams chat messages or channel conversations.

5. How We Use Data

We use the categories of data described above solely to:

• Operate the service — provisioning subscriptions, routing adaptive card updates, executing user-initiated PIM workflows.
• Support customers — diagnosing issues raised through support channels and proactively investigating service errors.
• Prevent abuse — detecting and responding to misuse, fraud, or activity that threatens the integrity of the service or other customers.

We do not use customer data for advertising, sale to third parties, or training machine-learning models.

6. Cookies & Analytics

The Xertone website and Customer Admin Portal use minimal first-party cookies only, limited to what is necessary to operate the site and remember user-session state. We do not embed third-party analytics, advertising, or tracking pixels on our properties.

7. User Rights

Depending on your jurisdiction, you may have the following rights with respect to personal data we hold about you.

European Economic Area & United Kingdom (GDPR / UK GDPR Articles 15–22):

• Access (Art. 15) — request confirmation of and a copy of your personal data.
• Rectification (Art. 16) — request correction of inaccurate or incomplete data.
• Erasure (Art. 17) — request deletion of your personal data ("right to be forgotten").
• Restriction of processing (Art. 18) — request that we limit how we process your data.
• Data portability (Art. 20) — request your data in a structured, commonly used, machine-readable format.
• Object (Art. 21) — object to processing based on legitimate interests.
• Automated individual decision-making (Art. 22) — not be subject to decisions based solely on automated processing that produce legal or similarly significant effects.

California residents (CCPA / CPRA, Cal. Civ. Code §§ 1798.100–1798.145):

• Right to know what personal information we collect, use, disclose, and (if applicable) sell or share.
• Right to delete personal information we have collected about you, subject to statutory exceptions.
• Right to opt out of the sale or sharing of personal information. We do not sell or share personal information for cross-context behavioral advertising.
• Right to non-discrimination for exercising any CCPA right.

To exercise any of these rights, contact us using Section 13 below. Your Microsoft Entra ID administrator separately controls access to organization-level data through Microsoft's tooling.

8. Third-Party Services

TeamsPIM depends on the following Microsoft sub-processors to deliver core functionality:

• Microsoft Graph — used for live queries of PIM role assignments, activation requests, and related directory data. Graph requests are made in-session and not persisted by Xertone.
• Microsoft Azure— hosting infrastructure for TeamsPIM compute, storage, and networking. Processing is governed by Microsoft's standard online services terms.
• Microsoft Entra ID — identity provider used to authenticate users and authorize delegated permissions.

9. Data Retention

• Subscription and configuration data — retained for the duration of your service term, plus thirty (30) days after termination for data retrieval and reactivation purposes.
• Adaptive card cache state — ephemeral; expires automatically once the related workflow completes.
• Telemetry — retained for the period necessary to maintain service quality and meet AppSource publisher diagnostic requirements.
• You may request earlier deletion of your data by contacting us per Section 13.

10. International Transfers

Customer data is hosted in Microsoft Azure United States regions. If you access the service from outside the United States, your data will be transferred to and processed in the United States. For European Economic Area and United Kingdom customers, cross-border transfers from Microsoft sub-processors are covered by Microsoft's Standard Contractual Clauses (SCCs) as set forth in the Microsoft Products and Services Data Protection Addendum.

11. Children's Privacy

TeamsPIM is a business-to-business SaaS service for IT and security teams. It is not directed to, and we do not knowingly collect personal information from, children under the age of 16. If we become aware that we have collected such information, we will delete it promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time. For material changes, we will provide notice through the in-app Customer Admin Portal at least thirty (30) days before the changes take effect. Continued use of the service after the effective date constitutes acceptance of the updated Policy.

13. Contact

To exercise data rights, ask questions about this Policy, or report a privacy concern, contact:

• Xertone LLC
• Email: contact@xertone.com

This Privacy Policy is governed by the laws of the State of Texas, United States.