Privacy Policy

Last updated: 31 October 2026

1. Who we are

Studiobyte (Robert Calin). Contact us via the support form on our Support page.

For the app, we don't receive or process your organisation's data (see section 3). For this website and support requests, we are the controller.

2. Scope

This policy covers the app “Microsoft 365 Mailbox & Calendar Permissions for Freshservice” and this website.

3. Roles

For data processed by the app inside a customer's Freshservice account, the customer is the controller. The app runs on the Freshworks platform within the customer's account and does not send data to us.

We are not a processor of app data, because the app runs within your Freshservice account and doesn't send that data to us. If you send us information in a support request, we handle it as described in section 11.

4. Data the app processes

Names and email addresses of the requester, the user receiving or losing access, and the target mailbox/calendar owner.
Freshservice user IDs picked in lookup fields (resolved to name and email).
Ticket number, subject and approval status.
Microsoft 365 display names and email addresses of the mailboxes and users involved, including who currently has access.
The name and email of an agent who applies a request from the ticket panel.

No IP addresses, device IDs, passwords or message contents are processed.

When you buy or install the app through the Freshworks Marketplace, Freshworks may share basic subscription information with us (such as your Freshservice account name and the admin contact) so we can provide support and billing-related service. Lawful basis: performing our contract with you and our legitimate interest in supporting customers.

5. Purpose

To fulfil the customer's own Microsoft 365 mailbox and calendar permission requests and record the result on the ticket, and to show a short run history and health status to the customer's administrators.

Data is not used for analytics or advertising, and is never sold.

6. Storage and retention

A run history of at most the last 50 runs and a health status are stored in Freshworks app storage within the customer's account, in the Freshworks data centre where the account is hosted (e.g. United States, Germany/EU, India, Australia).

Older runs are deleted automatically; cached access tokens and domain lists are kept for at most one hour.

Results are also written as private notes on the customer's Freshservice tickets. App storage is removed when the app is uninstalled; ticket notes remain part of the customer's tickets.

7. Logs

The app's Freshworks logs (visible to the customer's admins) can contain ticket numbers and, when a change fails, the email addresses involved and the error. No secrets or tokens are logged.

8. Sharing and sub-processors

Microsoft (Microsoft 365 / Exchange Online / Entra ID) – the customer's own tenant, to check addresses and apply permissions.
Optional alert services chosen by the customer (Microsoft Teams/Power Automate, Slack, or an HTTPS webhook they configure).
Freshworks, as the platform the app runs on.

No data is shared with the publisher.

9. International transfers

The app itself does not move data outside the customer's Freshworks region. Processors such as Microsoft and Slack apply their own safeguards (e.g. Standard Contractual Clauses, EU–US Data Privacy Framework).

10. Security

Credentials are stored as encrypted Freshworks secure settings and never shown again. All connections use HTTPS. Approval and protected-mailbox controls limit what can change.

11. This website and support requests

Hosting: our hosting provider processes technical data such as IP addresses in server logs to deliver and secure the site.

Cookies: we don't use analytics or advertising cookies. The demo video is embedded in YouTube's privacy-enhanced mode (youtube-nocookie.com); YouTube may set cookies or store data when you play it, under Google's privacy policy. The support form is provided by our support system at account.studiobyte.co.uk, which may use strictly necessary cookies.

Support requests: when you contact us through the support form we collect your name, email address, optional telephone number, and the details you send, to answer your request. Lawful basis: our legitimate interest in responding to enquiries and, for customers, performing our contract. We keep support records for up to [24 months] after the request is closed, then delete them, unless we need them longer for legal reasons.

We don't sell your information or use it for marketing without your consent.

12. Your rights

Under UK GDPR and EU GDPR you have rights including access, correction and deletion. For data inside a customer's Freshservice account, contact that organisation (the controller); we'll assist them.

To exercise your rights about information you've sent us, use the support form on our Support page. We'll reply within one month.

You can complain to the UK Information Commissioner's Office (ico.org.uk) or your local data protection authority.

13. Children

The app and website are not intended for children.

14. Changes

We'll update this page and the “Last updated” date when this policy changes.