Privacy Policy

1. Introduction & Overview

This Privacy Policy describes how PPM Compass 360 ("the Application", "we", "us", or "our") processes data when deployed as a SharePoint Framework (SPFx) solution web part within your organization’s Microsoft 365 SharePoint Online environment.

We believe privacy is an architectural decision. By engineering PPM Compass 360 entirely on client-side SPFx technology using standard SharePoint REST APIs and Microsoft Graph, we ensure that your organization retains absolute data ownership, residency, and privacy control at all times.

2. Data We Do NOT Collect (Zero Egress Statement)

Unlike traditional SaaS or multi-tenant cloud PPM products, we do NOT collect, transmit, store, or process any of the following on external infrastructure:

• No Project Content: Project names, descriptions, charters, status summaries, milestone dates, financials, change requests, risks, or issue registers remain strictly inside your SharePoint lists.
• No User Identification (PII): We do not collect user email addresses, Microsoft Entra ID (Azure AD) tokens, phone numbers, or employee directory profiles.
• No Telemetry or Usage Tracking: The Application contains no third-party analytics SDKs (e.g., Google Analytics, Mixpanel, Segment), no tracking beacons, and no heartbeat pings.
• No External Alerting Infrastructure: The Application does not route notification emails or alerts through external mail relays. All workflows leverage your native Microsoft 365 Power Automate licenses.

3. Data Storage & Residency

All data generated or managed by PPM Compass 360 is stored exclusively in standard SharePoint Online lists provisioned directly in your SharePoint site collection:

• PPM_Projects
• PPM_Milestones
• PPM_Risks
• PPM_ChangeRequests
• PPM_ProjectFinancials & PPM_FIN_ProjectFinancials
• PPM_ProjectStatusReport
• PPM_Team

These lists reside within your tenant's chosen Microsoft 365 geographic data boundary (e.g., European Union, United States, United Kingdom, Australia) under your organization's existing Microsoft enterprise agreement, compliance center, and retention policies.

4. Zero "Member" Access & Granular Role-Based Security

PPM Compass 360 enforces the principle of least privilege across your SharePoint environment:

• All Users in Visitors Group: No regular user (Project Leader, team contributor, or stakeholder) is required to have SharePoint "Members" or "Contribute" permissions to the site collection. All users remain in the read-only Visitors group.
• Broken Inheritance for Role-Based Writes: The built-in Admin Settings page allows the Site Owner to break list permission inheritance on the PPM SharePoint lists, granting write/edit permissions to Visitors dynamically based on their assigned role in each project or portfolio.
• Hidden Underlying Lists: The Admin Settings page also allows administrators to hide the underlying SharePoint lists from Site Contents and Quick Launch navigation, ensuring users cannot bypass the app UI or accidentally alter list items directly.

5. Client-Side Browser Execution & Local Storage

When users view the PPM Compass 360 web part, JavaScript executes locally inside their authenticated browser session:

• Session Execution: Data queries are made directly from the user's browser to your SharePoint site using the user's existing Microsoft 365 session credentials.
• Local Preferences: The application may store non-sensitive UI preferences (such as light/dark mode preference or active tab filters) in the browser's localStorage. This data never leaves the user's device.
• No Third-Party Cookies: The application does not deploy advertising, marketing, or cross-site tracking cookies.

6. Artificial Intelligence & Microsoft Copilot

PPM Compass 360 does not send data to public AI models or external LLM endpoints.

If your Project Leaders choose to export project snapshots as Excel (.xlsx) files to analyze them with Microsoft 365 Copilot, ChatGPT Enterprise, or custom Copilot Studio agents, those interactions are governed exclusively by your organization's commercial agreement with Microsoft or your designated AI provider. Production SharePoint data remains protected and untouched by AI write operations.

7. GDPR & Regulatory Compliance

Under the General Data Protection Regulation (GDPR) and similar privacy frameworks:

• Customer as Data Controller: Your organization is the sole Data Controller of all information stored in your SharePoint lists.
• No Sub-processors: Because PPM Compass 360 operates without external servers or data transfer, we engage zero third-party sub-processors for your project data.
• Right of Access, Rectification, and Erasure: Your Microsoft 365 tenant administrators can query, export, edit, or delete any project list item directly through the native SharePoint interface at any time.

8. Data Retention & Deletion

Because we host no external database, we retain none of your data. If your organization removes the PPM Compass 360 web part from a page or uninstalls the ppm-compass-360.sppkg solution from the SharePoint App Catalog, your project data remains safely in your SharePoint lists under your control until your administrators choose to delete the site or lists.

9. Marketing Website Inquiries

If you contact us via email, submit an inquiry for a commercial quote, or request a license key through our website, we collect only the contact details you voluntarily provide (name, business email, organization name) solely to respond to your inquiry and manage your licensing agreement. We never sell, rent, or trade your contact information.

10. Contact Information & Inquiries

For any privacy questions, security reviews, or compliance verifications regarding PPM Compass 360, please contact our privacy and security team: