Privacy Policy

19 March 2026

1. Purpose and scope

This Privacy Policy explains how Axiome Solution (“we”) processes certain data when you use TAXI (the “Application”), integrated with Microsoft Teams and Microsoft 365 (including SharePoint).

This Policy applies to:

  • use of TAXI within Microsoft Teams; and
  • communications with our support team (email).

2. Key principles

  • TAXI does not read or store the Customer’s business content (documents, files, messages, conversations, attachments) hosted in Microsoft 365.
  • TAXI stores only technical identifiers and configuration data required to provide the service, as well as technical logs for security and maintenance.
  • Display-related information (e.g., display name, links) may be retrieved by the client via Microsoft Graph and stored locally in the browser (IndexedDB) for performance, without being sent to or stored in TAXI hosted services.

3. Data processed

3.1 Data within Microsoft 365 (Customer-controlled)

TAXI enables navigation and access to Microsoft 365 resources while respecting existing permissions. Business content remains in the Customer’s Microsoft 365 tenant.

3.2 Data stored by Axiome Solution (TAXI hosting)

To provide the service, TAXI stores in an Azure SQL database (France Central) in particular:

  • Technical identifiers: tenantId, userId (Entra ID Object ID), team identifiers (TeamsId);
  • Configuration / preferences: user-created hierarchy (folders), pinned resource references;
  • SharePoint resource references: SharePoint site ID and SharePoint site URL (references required for navigation);
  • Technical service data (e.g., subscription/license status and routing data required for proper operation).

TAXI does not store the content of SharePoint files/documents or Teams messages.

3.3 Technical logs

For security, incident diagnosis, and reliability improvements, TAXI collects technical logs (via Azure Application Insights) that may include:

  • timestamps, application events, errors, performance indicators;
  • technical request metadata (e.g., correlation identifiers).

Logs are limited to what is necessary and are not intended to capture business content.

3.4 Support data (emails)

If you contact support, we process the information you provide (e.g., name, email, request context, technical details).

4. Purposes

  1. Provide and operate TAXI (link preferences to a user, enable navigation, manage licensing).
  2. Secure and maintain the Application (prevention, diagnosis, bug fixes).
  3. Support (handle requests).

5. Storage, location, retention, and deletion

5.1 Data location

  • Backend: Azure Functions hosted by Axiome Solution.
  • Database: Azure SQL Database – France Central.
  • Observability: Azure Application Insights – France Central.
  • Secrets management: Azure Key Vault (accessible only within a VNet).

No transfers outside the European Union are performed for TAXI as described.

5.2 Retention periods

  • Preferences / configuration (SQL database): 7 days.
  • Technical logs (Application Insights): 90 days.
  • Database backups: 7 days.
  • Support emails/tickets: no fixed retention (kept as needed for follow-up/history and/or legal obligations; deletion may be requested where applicable).

5.3 Deletion and requests

  • User deletion request: a user may request deletion of hosted data by emailing support@axiome-solution.fr.
  • Admin-driven deletion: removing a user’s license triggers deletion of that user’s data.
  • Tenant deletion: when an administrator stops the TAXI subscription, tenant-related data (and associated user data) is deleted.

After deletion, some data may remain for up to 7 days in database backups (backup retention), then is automatically removed.

No deletion is triggered solely by inactivity.

6. Security controls

We implement appropriate security measures, including:

  • TLS encryption in transit;
  • Azure Key Vault for secrets (VNet-restricted access);
  • Least privilege access, RBAC, and MFA for all accounts with access to the provider tenant;
  • Logical tenant isolation: the Customer authenticates in its own tenant and provides a token to the TAXI API; TAXI validates the token issuer/tenantId against subscribed users; TAXI then uses the token to call Microsoft Graph in delegated “On Behalf Of the User” mode.
  • Monitoring and alerting (Application Insights and alert rules) to detect anomalies and incidents.

Note: the SQL database does not apply additional “application-level encryption” because it does not store sensitive business content; however it includes technical identifiers, so access is strictly controlled.

7. Sharing, subprocessors, and transfers

Data is hosted and processed on Microsoft Azure (services within your architecture). We do not sell data and do not share it with third parties for commercial purposes.

No additional third-party subprocessors (beyond Microsoft Azure) are used for TAXI under the described setup.

8. Your rights

Subject to applicable laws (including GDPR), you may request access, correction, deletion, and/or restriction regarding your data. In a Microsoft 365 enterprise context, such requests are typically managed through your organization (the Customer). Axiome Solution can assist as described above.

Contact: support@axiome-solution.fr

9. Updates

We may update this Policy to reflect service, legal, or security changes. The version published on this page prevails.

10. Contact

Axiome Solution

Email: support@axiome-solution.fr