Effective [DATE] · Version 1.0
This policy explains what information Gem365 (GEM365 Inc., "Gem365", "we") collects when you use AI Autofiller & Auditor (the "Extension"), how we use it, and what we never see. It applies to the Extension itself. Our website has its own privacy notice.
1. Who is responsible for what
For any personal data contained in the documents you process (supplier names, contact details, amounts, addresses and similar), you are the controller. Gem365 does not access or store that data and is not a processor of it in the ordinary operation of the Extension.
For diagnostic telemetry described in section 3, Gem365 is the controller.
Microsoft processes data as your service provider under your own agreements for Business Central and Azure. Gem365 is not a party to those agreements.
2. Data that stays in your environment
The following data is created and stored only in your Business Central database or your Azure subscription. Gem365 has no access to it.
- Attachments you upload: invoices, bills of lading, quotes, purchase orders and any other document types you define.
- Extraction results returned by Azure AI Document Intelligence or Azure AI Content Understanding, stored on the attachment so the same file is never sent to Azure twice.
- Comparison results, equivalence verdicts and confidence scores returned by your Azure OpenAI deployment.
- Auto Fill proposals and the values you applied to purchase and sales documents.
- Learned preferences: the fill model and aggregation setting stored per vendor or customer. These are listed on the AI Fill Preferences page and can be edited or deleted by your users at any time.
- Configuration: endpoints, models, API versions, prompts and compare templates.
- API keys, held in Business Central Isolated Storage rather than in database tables, and removed automatically when the related configuration line is deleted.
3. Data sent to Azure AI Services
When a user requests extraction or comparison, the Extension sends the attachment, or the relevant extracted fields and record values, from your Business Central environment directly to the Azure resources configured in your setup. This happens only after an administrator has given explicit consent on the Extension's setup page.
Because these are your resources, you control the Azure region, data residency, retention and access. Microsoft's handling of that data is governed by the Microsoft Product Terms and the Microsoft Privacy Statement, including the terms specific to Azure AI Services and Azure OpenAI Service. We recommend reviewing those terms and, where necessary, your own data protection assessment before enabling consent.
4. Diagnostic telemetry we may receive
The Extension may send diagnostic telemetry to Gem365 using Business Central's standard extension telemetry mechanism. This is used to detect errors, understand which features are used, and support you. It may include:
- Extension version and Business Central version
- Environment and tenant identifiers issued by Microsoft (not user names or email addresses)
- The name of the feature or action used, and whether it succeeded
- Error codes and technical error messages produced by the Extension
- Timings, such as how long an extraction took
Telemetry never includes attachment content, extracted values, comparison results, proposal values, vendor or customer records, or API keys. Telemetry is stored in Azure Application Insights in the region shown on our website and is retained for no longer than [RETENTION PERIOD, e.g. 90 days].
If your organization prefers to send no telemetry at all, you can disable it for the Extension using Business Central's standard extension telemetry settings, or contact us and we will document the steps for your version.
5. Data you share with us for support
If you contact support, we collect the information you give us: your name, business email, organization, and the details of your request. If resolving your request requires a sample document, a screenshot or access to a sandbox, you decide what to share. We use it only to resolve your request, keep it only as long as the request is open plus a reasonable period for follow-up, and do not use it to train any model.
Where support involves access to personal data in your environment, we act on your written instructions and, if you require it, under a data processing agreement.
6. What we do not do
- We do not sell or rent any data.
- We do not use your documents, extraction results or learned preferences to train models. The Extension calls your Azure resources, and Azure OpenAI Service does not use your prompts or completions to train Microsoft's foundation models.
- We do not route Customer Data through servers operated by Gem365.
- We do not place advertising or third-party tracking in the Extension.
7. Legal basis
Where data protection law requires a legal basis, we process telemetry and support data on the basis of our legitimate interest in operating, supporting and improving the Extension, and where applicable to perform our contract with your organization.
8. International transfers
Gem365 is based in Canada. Telemetry and support data may be processed in Canada and in the Azure regions used by Application Insights. Where personal data is transferred from a jurisdiction that restricts transfers, we rely on appropriate safeguards such as standard contractual clauses.
9. Security
The Extension follows Microsoft's AppSource validation requirements. Secrets are stored in Isolated Storage, content is sent to Azure only after consent, and every write to a Business Central document passes through Business Central's own validation. Access to our telemetry workspace is limited to Gem365 staff who need it for support and development. You remain responsible for securing your Business Central tenant, your Azure subscription and your users' credentials.
10. Your rights
Depending on where you are, you may have the right to access, correct, delete or restrict the personal data we hold about you, to object to its processing, or to lodge a complaint with a supervisory authority. To exercise these rights for support data or telemetry, contact us at the address below. For personal data inside your Business Central environment, please contact your own organization, which controls that data.
11. Children
The Extension is a business tool and is not directed at children. We do not knowingly collect personal data from anyone under 18.
12. Changes to this policy
We may update this policy from time to time. The effective date at the top shows the current version. Material changes will be announced on the AppSource listing or by email to the administrator contact associated with your subscription.
13. Contact
Gem365 · Experts in Microsoft Solutions
1102, 1011 Beach Ave., Vancouver, British Columbia, Canada
Email: info@gem365.ca
Web: gem365.ca/contact-gem365