Privacy Policy

Last updated: June 6, 2026

1. Who We Are

TenantSync is operated by Joe Green ("we", "us", "our"), based in Edmonton, Alberta, Canada. We provide cross-tenant migration tools for Microsoft Power Platform environments.

2. Information We Collect

We collect the minimum information necessary to provide our services:

• Waitlist signups: Email address, IP address, browser user agent, and timestamp when you join our waitlist.
• Account information: When you create an account, we collect your company name, email address, and payment information (processed by Stripe).
• Usage data: Sync operations initiated, flows migrated, and error logs to maintain service quality.
• Solution packages & metadata: To run a sync we process the exported solution package — which includes your solution, flow, table, and connection definitions — and record metadata such as solution names, component counts, and connection types. Packages are stored only temporarily to complete the sync and provide an audit/retry trail; they are not retained long-term (see Data Retention).
• Microsoft authentication tokens: To perform a sync you initiate, the TenantSync browser extension reads the Microsoft Dataverse / Azure AD access and refresh tokens from your own signed-in session. It does this by reading the Authorization (Bearer) header from your in-progress Dataverse requests — observationally only, without blocking or modifying any request. These tokens authorize the export from your source environment and the import into your target environment, and are transmitted only to TenantSync's own HTTPS backend.

3. How We Use Your Information

• To provide and maintain the TenantSync service
• To communicate with you about your account, updates, and support
• To detect and prevent abuse, fraud, or security incidents
• To improve our service based on aggregate usage patterns

4. Data Storage and Security

Data is stored in Neon PostgreSQL (cloud database, hosted on Vercel infrastructure) and transmitted over HTTPS. Microsoft authentication tokens are encrypted at rest using AES-256-GCM with per-customer keys and are never stored in plaintext. Your browser exports the source environment and hands off — it never stores credentials for the target tenant, and authentication uses Microsoft's standard Azure AD device-code sign-in. Solution packages are transferred through our secure cloud hub and held only temporarily to complete the sync and provide an audit/retry trail. We implement industry-standard security measures including encrypted connections, access controls, and regular security reviews.

5. Data Sharing

We do not sell, rent, or share your personal information with third parties except:

• Service providers: Stripe (payments), Vercel (hosting), Neon (database) — each bound by their own privacy policies.
• Legal requirements: When required by law, court order, or governmental authority.

6. Your Rights (PIPEDA Compliance)

Under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), you have the right to:

• Access your personal information we hold
• Request correction of inaccurate information
• Withdraw consent for data collection (which may limit service availability)
• Request deletion of your personal data
• File a complaint with the Office of the Privacy Commissioner of Canada

7. Data Retention

Waitlist data is retained until you request removal or the waitlist is closed. Account data is retained for the duration of your subscription plus 90 days. Sync logs are retained for 12 months. Microsoft authentication tokens are retained only as long as needed to keep your syncs working and are removed when you disconnect a tenant or delete your account; solution packages are deleted after the sync completes and a short audit/retry window. You may request deletion at any time by contacting us.

8. Cookies

Our website uses minimal cookies for session management only. We do not use tracking cookies, advertising cookies, or third-party analytics.

9. Children

TenantSync is a business tool and is not directed at individuals under 18. We do not knowingly collect personal information from children.

10. Changes to This Policy

We may update this policy from time to time. Material changes will be communicated via email to registered users. The "Last updated" date at the top reflects the most recent revision.

11. Contact

For privacy inquiries, data requests, or complaints:

Email: privacy@tenantsync.io
Joe Green, Edmonton, Alberta, Canada