Privacy notice

1. Controller and contact

Tim Simon is responsible for processing for operating this website, handling enquiries and administering the service relationship. For employee data, signature assignments and Autoreply configured by your organisation, your organisation generally determines the purposes; promptworkz processes the data on its instructions. Ask your employer or responsible organisation about that processing.

2. Website access and enquiries

When you access the service, hosting systems process technical connection data such as your IP address, request time, requested URL, response status and browser information for delivery and security. The basis for our own processing is our legitimate interest in providing and protecting the service (Article 6(1)(f) GDPR). If you contact us by email or the website form, we process your email address, any name and company you provide, your message and any selected licence and billing details to respond; the basis is Article 6(1)(b) GDPR for your own contractual enquiries, or Article 6(1)(f) for business contacts and general enquiries. There is no advertising analytics or visitor recording integrated into the landing page.

2a. Requested sample emails

If you request sample emails, we use your email address, selected fictional examples and language to send a confirmation link and, after your explicit confirmation, the selected examples. This handles your product enquiry under Article 6(1)(b) GDPR or Article 6(1)(f) for business contacts. The link is valid for 30 minutes. Pending requests are held in protected temporary storage; expired entries are removed on subsequent requests. After successful completion, the email address and selection are removed from this temporary storage; an opaque receipt remains for 24 hours to prevent duplicate sending. Hashed IP and recipient counters expire after 15 minutes or one hour and are removed on subsequent requests. Abuse prevention is based on Article 6(1)(f) GDPR. Only if you separately and voluntarily agree may promptworkz email you once to ask for your impressions (Article 6(1)(a) GDPR). The confirmed permission, its wording and timestamps are forwarded to our service mailbox for that purpose and evidence. You can withdraw this permission at any time via [email protected] without affecting earlier lawful processing. After the follow-up, or withdrawal before it, we retain the record only as necessary to demonstrate the permission or meet applicable obligations. The confirmation and sample emails are delivered via the hosting provider. Mailbox and hosting backups follow their applicable retention policies. No recipient data is sent to Microsoft for this demo; no advertising tracker or remote images are embedded in the examples.

2b. Setup invitations

An authorised platform administrator or service provider can invite a company to setup. We process the recipient email address, optional company name, language, inviter and invitation status to provide the agreed setup and protect customer allocation (Article 6(1)(b) or (f) GDPR). The personal link is valid for seven days and opens setup in one browser; it grants no Admin Center access. Invitation metadata is encrypted in the existing service database. Expired invitations are removed when new invitations are created. A browser session receipt keeps the setup authorised during Microsoft approval. After verified setup, the invitation is bound to that Microsoft tenant. Email delivery uses the hosting provider. Existing account, customer and audit records retain their separate retention rules.

3. Setup, accounts and security

Setup processes the organisation name, Microsoft tenant ID, permitted email domains, language and setup status. Accounts include the local user ID, username, roles, workspace assignments, invitation status and security settings. Microsoft-linked accounts additionally store tenant ID, object ID and a display label. Local passwords are stored as hashes. promptworkz MFA uses an authenticator secret. Recovery is approved by an authorised administrator; protected platform accounts use controlled hosting recovery. Administrative actions are recorded with actor, timestamp, affected object, action details and IP address. Short-lived hashed attempt counters protect sign-in. Our own processing serves account administration and abuse prevention under Article 6(1)(f) GDPR, and contract performance under Article 6(1)(b) where applicable. Customer-controlled processing follows its instructions and legal basis.

4. Microsoft sign-in, directory and Autoreply

For Admin Center sign-in you are redirected to Microsoft. This separate application requests openid and profile only. promptworkz does not request your Microsoft password or Microsoft MFA code in its own forms. Verified identity information is used for the explicitly assigned local account. Microsoft tokens from this Admin Center sign-in are not permanently stored. The separately approved Microsoft 365 application reads the necessary user and group data for profiles and assignments and reads or changes mailbox out-of-office settings for Autoreply. Depending on configuration, business names, email addresses, job titles, departments, phone numbers, group memberships, replacement contacts and out-of-office text are processed. The Outlook add-in also loads the Office JavaScript library from Microsoft. The pure Admin Center sign-in approval grants none of these directory or mailbox permissions.

5. Recipients and processing locations

Hosting provider: Hostup AB, registration number 559290-1325, Mässvägen 4, 125 30 Älvsjö, Sweden. The hosting account is held by Tim Simon. According to HostUp’s current data-processing agreement, websites are stored within the EU. Subprocessors and any transfers outside the EEA depend on the hosting service used and are described in HostUp’s contractual documents. Microsoft handles sign-in and the connected Microsoft 365 services according to the applicable Microsoft and customer agreements; processing is not guaranteed to take place exclusively in Sweden. Maik Wiebel in Germany has restricted technical support access. Customer administrators and their authorised service providers can access their assigned workspaces. Actual access depends on the assigned permissions. Personal data is not sold.

6. Browser storage

The service uses a session cookie for authenticated sessions and setup security. Browser local storage remembers language and appearance preferences and may retain setup inputs and progress so a Microsoft redirect does not lose them. Setup form state is reused for up to four hours; it can remain in browser storage until replaced, cleared or rejected on a later visit. Outlook add-in preferences are stored under user-specific keys. These functions support the service and your selected settings; they are not advertising profiles. Clearing browser storage removes saved preferences and setup progress. Session and MFA challenge validity is limited on the server.

7. Storage duration and deletion

Account, setup, configuration and customer data are retained while needed for the service relationship and the customer’s instructions. Archiving a customer preserves its data and is not a deletion request. Administrative audit records remain with the customer workspace until its data is deleted. Contact us for deletion, export and removal of no longer needed accounts; legal retention duties or specific legal claims can require limited further retention. Contact form enquiries are forwarded through the hosting mail system to our inbox; no additional message archive is created in the application. For spam protection, a hashed IP counter expires after 15 minutes and an overall counter after one hour; expired counters are removed on later submissions. Failed-attempt counters expire after 15 minutes and are removed during subsequent processing. Invitations expire after seven days; MFA reset links after 15 minutes, and MFA challenges after five minutes. Expiry does not mean every database record or backup is immediately erased. HostUp’s backup and log retention follows the applicable hosting service and agreement. For a concrete deletion request we also clarify remaining backup copies and their deletion cycle.

8. Your rights

Subject to the legal conditions, you may request access, rectification, erasure, restriction and data portability. You may object to processing based on legitimate interests for reasons relating to your situation. Where processing relies on consent, you may withdraw it for the future. Contact [email protected]; for data controlled by your employer, contact that organisation as well. You may complain to a data protection authority, including the Swedish Integritetsskyddsmyndigheten (IMY) or the authority for your habitual residence or workplace. No solely automated decisions with legal or similarly significant effects are made by this application. Required identity and tenant information is necessary to provide authorised access; without it, the relevant service cannot be used.

Further information

• HostUp · Agreements and privacy documents
• Microsoft · Privacy
• Integritetsskyddsmyndigheten (IMY)