Your data, handled responsibly.

This Privacy Policy explains how Xpress Manage365 (operated by Xpress Computers Limited, registered in Mumbai, India) collects, uses, processes, stores, and protects data in connection with our Microsoft 365 reporting platform.

This policy applies globally to Microsoft Partners, Managed Service Providers (MSPs), resellers, consultants, and the customer tenants they onboard through our platform.

By using Xpress Manage365, you acknowledge that you have read and understood this Privacy Policy.

This principle is fundamental to our service architecture. The access permissions we request are limited to read-level scopes only, ensuring complete operational isolation from your customer's tenant data and configurations.

We collect the following categories of information:

Tenant Metadata

• Microsoft 365 Tenant ID, primary domain, region
• Tenant display name and registered organisation details

Service Usage Data

• Mailbox usage statistics (storage, send/receive counts)
• Cloud storage and activity metrics
• Collaboration platform activity and engagement data
• Licence inventory and subscription information

Security and Compliance Indicators

• Microsoft 365 security posture scores and improvement history
• Security alerts, incident counts, and threat indicators
• Configuration and policy posture information

Partner Account Information

• Business name, contact person, registered address
• Email addresses, phone numbers, GST/Tax identifiers
• Authentication credentials (stored as salted hashes)
• Logo, branding assets, and white-label preferences

Operational Data

• Report generation logs and delivery audit trails
• Payment and billing transaction records
• System diagnostics and platform telemetry

We use the collected data exclusively for these purposes:

• Generate automated monthly Microsoft 365 health and security reports
• Apply your brand (logo, colours, tagline) to white-labelled or co-branded reports
• Deliver reports to designated customer recipients via email
• Provide analytics, trend tracking, and historical comparisons
• Support partner billing, subscription management, and invoicing
• Investigate and respond to support requests
• Detect, prevent, and respond to fraud, abuse, or security incidents
• Improve service performance, reliability, and feature offerings
• Comply with legal, regulatory, and contractual obligations

When a customer's Global Administrator grants admin consent, our verified Microsoft Entra ID application (registered as Xpress Manage365 by verified publisher Xpress Computers Limited) requests read-only permissions necessary to generate Microsoft 365 health, security, and usage reports.

The permissions cover these data categories:

• Service usage reports and activity statistics
• Security alerts and incident information
• Directory metadata (users, groups, licences)
• Organisation configuration information
• Audit logs for compliance reporting

A customer's Global Administrator can revoke this consent at any time through their Microsoft 365 administration console.

We process data based on one or more of the following legal grounds:

• Customer Consent — Microsoft 365 admin consent granted by the customer's Global Administrator
• Contractual Necessity — to deliver the reporting service contracted by the partner
• Legitimate Business Interests — for service operation, fraud prevention, security, and improvement
• Legal Compliance — to meet GST, taxation, audit, and other regulatory obligations

For partners and customers in the European Union, United Kingdom, California, India, and other regions with specific privacy frameworks, additional safeguards apply per applicable law (GDPR, UK GDPR, CCPA, India DPDP Act, etc.).

Xpress Manage365 maintains the data it collects on secure cloud infrastructure. The following providers support our service delivery, each bound by appropriate data protection agreements:

• Microsoft cloud infrastructure — Xpress Manage365 hosts its application, automated workflows, and customer data on Microsoft cloud servers and data centres. Microsoft acts as our infrastructure provider; Xpress does not share customer data with Microsoft beyond what is technically necessary for hosting the service.
• Razorpay Software Private Limited — payment gateway processing for partner subscriptions (India and international transactions)
• AI analysis engine — for advanced analytical narratives in PRO report variants. Customer data is not used to train AI models.
• Email delivery services — for transactional email delivery (consent URLs, reports, notifications)

We may also disclose data to comply with legal requirements, court orders, or government requests, or to protect Xpress's legal rights and property.

Xpress Manage365 is operated from India, with primary data storage on Microsoft cloud servers in Microsoft's Indian data centres. As a global platform serving partners worldwide, we may process data across multiple jurisdictions.

Where data is transferred internationally, we implement appropriate safeguards including:

• Standard Contractual Clauses (SCCs) for transfers to/from the European Economic Area
• Cloud provider data protection terms for infrastructure transfers
• Region-specific data residency where contractually agreed

We implement industry-standard security measures to protect data:

• Encryption — TLS 1.2+ for data in transit; AES-256 encryption for data at rest
• Authentication — salted hash password storage; OAuth 2.0 for read-only access to Microsoft 365
• Access Control — role-based access; principle of least privilege
• Audit Logging — comprehensive activity logs across all platform operations
• Monitoring — continuous security monitoring and anomaly detection
• Reviews — periodic security assessments and penetration testing

While we maintain rigorous security practices, no system is 100% secure. We encourage partners to follow security best practices for their administrator accounts.

We retain data only for as long as necessary:

• Active subscription period — full data retention while service is active
• Reports — historical reports retained for 24 months for trend analysis
• Billing records — retained for 7 years for taxation compliance (Indian law)
• Audit logs — retained for 12 months
• Post-termination — most data deleted within 90 days; legal/financial records retained per applicable law

Partners may request earlier deletion subject to legal retention obligations.

Depending on your jurisdiction, you may have the following rights regarding personal data:

• Access — request a copy of personal data we hold about you
• Correction — request correction of inaccurate data
• Deletion — request deletion subject to legal retention requirements
• Restriction — request restriction of specific processing activities
• Portability — receive your data in a structured, machine-readable format
• Objection — object to processing based on legitimate interests
• Withdrawal of Consent — withdraw consent (does not affect prior processing)
• Lodge Complaint — file a complaint with your local data protection authority

To exercise these rights, contact support@xpress.co.in. We will respond within 30 days.

Our partner portal uses only essential cookies and browser storage required for:

• Session management and login state
• Security and CSRF protection
• User interface preferences

We do not use third-party advertising cookies, tracking pixels, or behavioural analytics. Partners can disable cookies in their browser settings, though this may impact platform functionality.

Xpress Manage365 is a B2B platform designed for Microsoft Partners and their business customers. The service is not intended for use by individuals under 18 years of age, and we do not knowingly collect personal data from children. If we discover such data, we will delete it promptly.

As a partner using Xpress Manage365, you agree to:

• Obtain valid admin consent from authorised customer representatives (Global Administrators)
• Inform your customers about Xpress Manage365's role in their reporting
• Provide accurate customer information during tenant onboarding
• Comply with applicable data protection laws in your jurisdiction
• Promptly notify us of consent revocation, customer disputes, or security concerns
• Maintain the security of your partner portal credentials

We may update this Privacy Policy from time to time. Material changes will be communicated via:

• Email notification to registered partner contacts
• Notice on the partner portal upon next login
• Updated "Last updated" date at the top of this page

Continued use of the service after updates constitutes acceptance of the revised policy.

For questions, concerns, or requests regarding this Privacy Policy or your data:

• Email: support@xpress.co.in
• Phone: +91 22-66122000
• Address: Xpress Computers Limited, 205, Woodrow, Veera Desai Road, Andheri (West), Mumbai 400053, Maharashtra, India
• Data Protection Officer: dpo@xpress.co.in