Privacy Policy

Effective Date: July 4, 2026

This Privacy Policy explains how Margin for Outlook (the "Add-in," "Service," or "we"/"us"/"our") collects, uses, shares, and protects information when you use the Add-in. Margin for Outlook is an Outlook task-pane add-in that lets members of an organization add internal collaborative comments and private notes alongside their email conversations.

Margin for Outlook is operated by Younes Azamiyan, a software developer based in New South Wales, Australia. For the purposes of this policy and of the Privacy Act 1988 (Cth), the operator is the entity responsible for the personal information described below. Because the Add-in runs inside your organization's Microsoft 365 tenant, your organization also acts as a controller of that information.

We have designed the Add-in to access as little of your email as possible and to encrypt the content you create. This policy describes exactly what that means.

1. Introduction

We are committed to protecting your privacy. This policy applies to the Margin for Outlook add-in and its backend service. It does not apply to Microsoft Outlook, Microsoft 365, or any third-party services that you access independently of the Add-in.

By using the Add-in, you agree to the collection and use of information as described in this policy.

2. Information We Collect

We collect only the information needed to provide the Service.

2.1 Identity information (from Microsoft Entra ID)

When you sign in, we receive the following from your Microsoft 365 identity token:

• Your Microsoft Entra user ID (oid object identifier).
• Your tenant ID (tid) — the identifier of your organization's Microsoft 365 tenant.
• Your email address (user principal name).
• Your display name.

2.2 Email association data (identifiers only)

To attach your comments and notes to the correct email, the Add-in reads a limited set of properties from the currently selected message via Office.js:

• The conversation identifier (conversationId) and item identifier (itemId) of the email.
• The email subject line — used only at runtime to display context and, optionally, within a support request you choose to send. We do not store standalone subject lines as part of normal comment/note storage.
• For shared mailboxes, the shared mailbox owner's email address, to determine which mailbox a comment belongs to.

Important: We do not store the body of your emails, the recipients of your emails, attachments, or sender/recipient address books. We store only the conversation and item identifiers needed to link your comments and notes to a message.

2.3 Content you create

• Comments and private notes that you write. Comments are limited to 10,000 characters and private notes to 5,000 characters, and both are encrypted at rest (see Section 7).
• Feedback and support requests that you choose to send, including the message text, whether the feedback is positive or negative, and — where you opt in — your contact email. Each feedback record is also associated with your user and tenant identifiers.
• Membership data: the email addresses and roles of members you invite to a mailbox, and verification codes (stored only in hashed form).

2.4 Usage and preference data

• Preference flags and timestamps that drive the user experience (for example, onboarding completion, banner dismissals, and usage reminders).
• Operational logs (request method, path, status, and a request identifier) used for reliability and troubleshooting. These logs do not include your email content. Detailed authentication logging that could contain personal data is disabled by default and is never enabled in production.

3. How We Use Your Information

We do not use your information for advertising, and we do not sell your personal data.

4. Microsoft Integration

The Add-in operates within the Microsoft 365 ecosystem and relies on Microsoft Entra ID for sign-in.

• Authentication uses single sign-on (SSO) through Office.js (getAccessToken()). Sign-in is required on every session; there are no bypasses.
• The Add-in requests the following scopes: access_as_user, openid, profile, email, and User.ReadBasic.All.
• The Add-in itself does not call Microsoft Graph directly. Our backend performs an on-behalf-of (OBO) token exchange with Microsoft and uses User.ReadBasic.All to look up the Microsoft Entra object identifier for an email address. It does this in two cases: to link comments and notes on a shared mailbox to a stable identifier for that mailbox (an object ID does not change when an email address or username does), and to confirm that an invited member belongs to a user in your tenant. Only the directory object identifier is read; no other profile information is retrieved or stored through this lookup. If this permission is not granted, your private notes still work: they fall back to using the mailbox email address as their identifier; only shared comments require the object identifier.
• Mailbox access is read-only (the ReadItem permission). The Add-in cannot modify, move, or send your email.

Your use of Microsoft Outlook and Microsoft 365 is governed by Microsoft's own privacy terms.

5. Data Sharing and Sub-processors

We do not sell your data and we do not share it with advertising networks. We share information only with the service providers necessary to operate the Add-in:

• Microsoft — for authentication (Entra ID) and directory lookups (Microsoft Graph) when verifying member invitations.
• Neon (neon.com) — our managed PostgreSQL database provider, hosted in the Sydney, Australia region. This is where the information we store is held, including your identity details, your comments and notes (encrypted at rest — see Section 7), membership data, preferences, and feedback records.
• Postmark — our transactional email provider. We use it to deliver invitation/verification emails, and to relay feedback and support requests. Depending on the action, Postmark may process recipient email addresses, verification codes, and the text of feedback or support messages.

In addition, we may use the following infrastructure and operational sub-processors:

• Sentry — error monitoring. It receives error context that can include your user and tenant identifiers. It does not receive your comment or note content.
• Microsoft Azure Key Vault — secure storage of encryption keys in production. No user content is sent to it; we only retrieve keys.
• Redis — distributed rate-limiting counters keyed by IP address or user ID. No email content is stored. (May be used, depending on deployment configuration.)

We do not use general-purpose analytics or marketing telemetry (for example, Google Analytics, Mixpanel, or Application Insights).

Data location and overseas disclosure. The information we store is held in Australia: our database is hosted in the Sydney region, and our application backend and encryption-key storage run in the Microsoft Azure Australia East region. The Add-in's static web files — which contain no personal information — are served from a Microsoft Azure region in the United States. Two of our sub-processors, Postmark and Sentry, are operated by providers based in the United States, so the limited information sent to them (email-related data for Postmark; error and diagnostic identifiers for Sentry) is processed overseas. Where information is processed overseas, we take reasonable steps to ensure it is handled consistently with this policy and applicable law, including the Australian Privacy Principles.

We may also disclose information if required to do so by law or valid legal process, or to protect the rights, safety, and security of our users and the Service.

6. Data Retention

• Comments and notes are retained for as long as they are needed to provide the Service to your organization.
• When a comment is deleted, it is soft-deleted: it is removed from normal views, but the record is retained server-side for audit and integrity purposes. Comment edits and self-deletion by the author are available only within a 15-minute window after creation; moderators may delete comments at any time.
• Deleted comments are permanently erased after 30 days. On a scheduled basis, the content of any comment that has been deleted for more than 30 days is irreversibly removed from our database (and the record of who deleted it is cleared). A minimal, content-free placeholder may be retained so that reply threads remain coherent, but the comment text itself is gone and cannot be recovered.
• Feedback and support records are retained as needed to handle your requests and improve the Service.

To request deletion of your data, contact us at [email protected] (see Section 8).

7. Data Security

We apply technical and organizational measures to protect your information, including:

• Encryption at rest of all comment and note content using AES-256-GCM, with keys managed in Microsoft Azure Key Vault in production.
• Encryption in transit over HTTPS/TLS, with HTTP Strict Transport Security (HSTS) enforced.
• Tenant isolation as a hard requirement: every data access is scoped to your organization's tenant, so data is never shared across tenants.
• Authentication with RS256-signed Microsoft Entra ID tokens, validated against Microsoft's published signing keys (JWKS), including issuer, audience, and expiration checks.
• Rate limiting to protect against abuse, applied globally and more strictly on sensitive actions.
• Input sanitization: comment and note content is stored and rendered as plain text, mitigating cross-site scripting (XSS) risks.
• Secrets management through environment configuration and Azure Key Vault, with security HTTP headers applied to all responses.

No method of transmission or storage is completely secure, but we work to protect your information using industry-standard practices.

8. Your Rights

Under the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), you may:

• Access the personal information we hold about you (APP 12).
• Request correction of personal information that is inaccurate, out of date, incomplete, irrelevant, or misleading (APP 13).
• Complain about how we handle your personal information. You can raise a complaint with us first; if you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

If you are in the European Union or another jurisdiction with equivalent laws (for example, under the GDPR), you may additionally have rights to:

• Delete your personal data ("right to erasure").
• Port your data to another service.
• Object to or restrict certain processing.

Because the Add-in operates within your organization's Microsoft 365 tenant, your organization (as a controller of that data) may also administer or fulfill some of these rights. To exercise any of these rights, contact us at [email protected], or contact your organization's administrator. We will respond within a reasonable period and in accordance with applicable law.

9. Cookies and Local Storage

The Add-in does not use cookies for authentication. Sign-in tokens are obtained through Office.js and sent in the request authorization header; they are not persisted in cookies.

The Add-in may use the browser's local storage within the task pane to remember user-interface state (such as onboarding progress or dismissed banners). This data stays on your device and is not used for tracking.

10. Children's Privacy

The Add-in is intended for use by organizations and their staff through Microsoft 365 work or school accounts that the organization provisions. It is not directed to children.

We are not involved in the creation of these accounts and do not receive any date-of-birth or age information about users, so we have no means of independently verifying a user's age. Because access to the Add-in is provisioned and approved by your organization's administrators, your organization is responsible for ensuring that the individuals it authorizes to use the Add-in meet the applicable age requirements (see the Eligibility section of our Terms of Service). Consistent with this, we do not knowingly collect personal data from anyone under the age of 16.

If you or your organization believe that a child has provided us with personal data, contact us at [email protected] and we will delete it.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Effective Date" above and communicate material changes through the Add-in or by other reasonable means. Your continued use of the Add-in after changes take effect constitutes acceptance of the revised policy.

12. Contact Information

For privacy questions or to exercise your rights, contact us at:

• Support / privacy requests: [email protected]
• Website: https://marginforoutlook.com