Privacy statement
Robbie is an AI teammate for a Microsoft 365 organisation. This statement says, in plain words, what Robbie reads, what it stores, for how long, who else touches it, and how it all leaves when you do. It is written to be at least as protective as the Microsoft Privacy Statement.
Condensed from the versioned statement in the product repository, which is the source of truth.
1. What Robbie does
A person in your organisation @mentions Robbie in a Teams channel, replies in a thread it is already in, or messages it 1:1. Robbie reads the conversation it was invited into, searches your tenant on that person's behalf, hands candidates to a language model, and answers in the same place with links back into Teams. Teams is the only place you talk to Robbie; the personal tab is for setup, settings, connections and receipts.
Search runs as the person asking, with their own permissions. A person can never be shown something through Robbie that they could not already open in Teams.
2. What we store, and why
Most of what we hold is scoped to your organisation and isolated from every other tenant at the database level. The one exception is the invite list: a work email typed on the public landing, before any organisation exists.
- Invite request: the work email you typed on the public landing, and which form you used. Deleted when you ask privacy@hirerobbie.ai.
- Installation record: your Entra tenant id and name, who installed, and when. This is how your tenant maps to your organisation.
- Consent record and audit trail: the exact permissions consented to, when, and an append-only, hash-chained row per consent and revocation. No message content.
- Run journal: the question as typed, who asked, the conversation it happened in, what it cost and how long it took. This is what your receipts and your admin's dashboard show.
- Message references: ids, a rank, a model-written reason and a deep link. A reference points at a message in your tenant; it is not a copy of it, and it stops resolving the day the person's access does.
- Conversation memory: the thread Robbie was mentioned in, kept so it can answer a follow-up, deleted after 30 days without a message.
- Workspace index: the text of channel messages a nightly sweep walks, from channels your admin has not excluded, with an embedding, kept for 30 days and reconciled against Teams every night. Private chats are never read.
- Missed mentions: a nightly read of the same channels for questions aimed at someone that went unanswered, shown only to that person, deleted after 14 days.
- Connections: which services your admin connected and when. The credential for each service is held by the broker, not by us.
3. What we do not store
We do not store private chats between your people. We do not store your Microsoft credentials or refresh tokens. We do not store the contents of files Robbie reads to answer a question. We do not hold tenant-wide read permissions for search: search stays delegated to the person asking.
4. Whose data this is
Your organisation is the controller of everything Robbie reads and writes about it; we process it on your instructions, which are the permissions your admin consented to and the questions your people ask. A person's own receipts are theirs to see; an admin sees the organisation's ledger.
5. Where data is stored
Our own database and application run with one cloud hosting provider. The region each category of processor holds data in is listed against it below where we have confirmed it, and marked open where we have not.
6. How long we keep things, and how deletion works
Every store above carries its own expiry, and a daily reaper enforces it. Uninstalling Robbie revokes every connection first, then deletes everything held for your organisation. The one thing that survives uninstall is the audit row proving that we deleted it. A receipt past its retention window is scrubbed of content rather than deleted, because it is a billing record. An invite-request email is not tenant data: there is no organisation yet, so uninstall has nothing there to purge — write privacy@hirerobbie.ai to delete it.
7. Sub-processors
Six categories of processor, each described by what it does and what reaches it. We do not publish the vendors by name; a customer under a data-processing agreement receives the named list on request. Nothing crosses to a connected service on a default installation, because nothing is connected.
- Hosting: the provider that runs the application and the database.
- Model gateway: the route to the language model that answers a question and the embedding model behind the index. The default model is set per workspace and named on every receipt; an admin may choose another or bring their own key.
- Integration broker: holds your organisation's credential for each service an admin connects; receives the arguments the model wrote for a tool call.
- Web reader: structured web reads Robbie makes when a question needs the open web.
- A coding agent: only if an admin connects one; receives the instruction the model wrote and the repository address.
- Operational telemetry: traces and error counts. The text of your messages does not travel there.
8. Security
Row-level security is forced on every organisation-scoped table against an application role that cannot bypass it. Secrets for custom connections are sealed at rest with a rotating key. Application-identity reads are confined to unattended jobs and enforced by types and by tests, so a person's question can never silently widen to the tenant.
9. Changes to this statement
A change in processing is a consent event: we record it, we ask your admin again, and this statement is diffed in the same change. The versioned statement carries a dated revision note for every change since the first install.
10. Contact
Questions, access requests and deletion requests go to privacy@hirerobbie.ai. We answer within five working days.