Privacy policy

"Customer Data" means data your end users enter or generate within the Software (decisions, meetings, actions, risks, committee memberships, and similar records). Customer Data is stored exclusively in your Microsoft Dataverse environment within your Microsoft 365 tenant.

SteadyState does not have access to Customer Data. We do not maintain a copy or replica, and we have no administrative login to your tenant. If you contact us for support and the issue requires inspecting your data, we will request a screen-share session or ask you to run diagnostic queries on your own behalf. We will not directly access your tenant.

Because Customer Data never leaves your tenant, your existing Microsoft 365 controls – encryption, access control, audit logging, backup, retention, and regional data residency – continue to govern it.

When you purchase the Software through AppSource, Microsoft (not SteadyState) collects and processes your business and billing information. Microsoft shares limited subscription information with us for fulfillment purposes: your business name, tenant ID, purchased plan, and designated billing contact. We use this information solely to provide and support the Software.

Version 1 of the Software collects no usage telemetry from customer environments. If we add anonymized telemetry in a future version, we will update this policy, provide an opt-out, and notify subscribers at least 30 days before activation. We will never collect the content of your governance records or personally identifiable information about your end users.

On this website, we collect limited information you voluntarily provide when requesting early access or contacting us: name, work email address, organization, role, product interest, and submission metadata (date, source page). We use it only to respond to your request, communicate about the products you expressed interest in, and coordinate follow-up. We do not collect sensitive personal data through this website, and we do not sell personal information or use it for unrelated marketing.

We share information only as necessary to operate the business:

• Microsoft receives transaction data through the AppSource marketplace for billing and subscription management
• Service providers supporting website operations may incidentally process contact information, under confidentiality obligations
• Professional advisors (legal, accounting) as required for SteadyState's own operations
• Law enforcement, if required by valid legal process

We do not share Customer Data with anyone, because we do not have it.

Customer Data is protected by the security measures of your Microsoft 365 tenant, including Microsoft's platform compliance programs. The limited information we do hold is stored in industry-standard cloud infrastructure with encryption at rest and in transit. We will notify affected customers of any security incident affecting our systems within 72 hours of confirmation.

• Customer Data: retained in your tenant under your policies – we impose no retention period because we store nothing
• Subscription information: for the duration of your subscription plus 7 years, for accounting and legal purposes
• Support correspondence: 3 years from resolution
• Website and early-access submissions: only as long as needed for the purposes above, or until you request deletion

Depending on your jurisdiction, you may have rights to access, correct, delete, export, or restrict the processing of information we hold about you, and to withdraw consent where processing is based on consent. To exercise them, contact us at the address below; we respond within 30 days. For Customer Data in your tenant, exercise your rights through your own Microsoft 365 admin tools – SteadyState cannot access, delete, or modify Customer Data on your behalf.

For EU/EEA, UK, and Swiss data subjects: for the limited information described above, SteadyState Technologies LLC is the controller, processing on the lawful basis of contract performance; you have the right to lodge a complaint with your supervisory authority. Customer Data does not leave your tenant region; Microsoft Power Platform regional residency rules govern its location. A Data Processing Addendum is available on request. For California consumers: we collect business contact information only, for the purposes above; we do not sell or share personal information for cross-context behavioral advertising.

SteadyState is based in the United States, and the limited information we collect is processed in the United States. Where required, we rely on Standard Contractual Clauses for transfers of personal data.

We may update this policy from time to time. Material changes will be posted at this URL and communicated to subscribers at least 30 days before taking effect.

Privacy inquiries and DPA requests: info@steadystatetechnologies.com