Privacy Notice

Last updated: 5 September 2026

This notice explains what personal data Ahmed Wael, sole proprietor, trading as The Global Assistant (TGAGlobal) collects when you visit www.theglobalassistant.click or use The Global Assistant, why we collect it, who we share it with and what rights you have. We collect only what the Service needs in order to work. We do not sell personal data, we do not share it for advertising, and we do not use it to train machine-learning models.

1. Two roles: controller and processor

For your account and billing data we are the data controller and this notice describes what we do with it. For the contents of automation outputs — data pulled from your Microsoft 365 tenant, which may describe your colleagues — your organisation is the controller and we act as your processor, handling it only on your instruction. If you need a data processing agreement, email us and we will provide one.

2. Data we collect

Account data. When you sign in with Microsoft we receive your name, email address, Microsoft user ID and tenant ID, and the plan and seat assigned to you. We do not receive or store your Microsoft password.

Tenant connection data. When an administrator connects a tenant we store the tenant ID, organisation name and SharePoint admin URL, the identifiers of the application registration created in your tenant, and a record of the permissions it holds. That application registration belongs to you: it lives in your Microsoft Entra ID, and you can inspect, restrict or delete it at any time. Access to it uses a certificate whose private key is held in our managed key vault and is used only to run automations you request; the certificate is specific to your tenant and works in no other.

Run data. For every automation you run we store the inputs you entered, the script name, who ran it, timestamps, status and the output. Outputs come from your own Microsoft 365 tenant and may contain personal data about people in your organisation — for example names, email addresses, mailbox sizes, licence assignments or sign-in dates.

Billing data. Payments are handled by Creem, the trading name of Armitage Labs OÜ (registry code 16977866, Rotermanni tn 14, Kesklinna linnaosa, Tallinn 10111, Estonia), our Merchant of Record. Creem collects your billing name, address, country, tax identifiers and card details directly, under its own buyer terms. We never see full card numbers. We store only your Creem customer and subscription IDs, plan, billing period, status and renewal date.

Assistant questions. When you use the in-app assistant we store the question you typed, which suggestion you clicked and how the answer was produced, so we can improve the catalogue and its search. Your question is sent to Microsoft Azure OpenAI together with descriptions of the matching scripts, and nothing else — no data from your Microsoft 365 tenant, and no run inputs or outputs, are sent to that service.

Technical data. Standard server logs — IP address, browser and device type, pages requested, timestamps and error traces — kept for security, abuse prevention and troubleshooting.

Correspondence. Emails you send to our support address and our replies.

3. Why we use it, and our legal basis

• To provide the Service — run automations, show your history, manage tenants, seats and plan limits. Basis: performance of our contract with you.
• To take payment and prevent fraud — process subscriptions, renewals and refunds. Basis: performance of our contract, and our legitimate interest in preventing fraudulent payments.
• To send service messages — failed runs, security notices, billing and plan changes. Basis: performance of our contract. These are not marketing emails and cannot be turned off while your account is active.
• To keep the Service secure and reliable — logging, rate limiting, debugging, capacity planning. Basis: our legitimate interest in a secure service.
• To comply with law — tax and accounting records, responding to lawful requests. Basis: legal obligation.

Where we rely on legitimate interests, we have considered the impact on you and limited what we collect accordingly. You can object at any time using the contact details below.

4. Cookies

We use one first-party session cookie to keep you signed in, and local browser storage for interface preferences such as theme. That is all. We run no advertising cookies and no cross-site tracking, and we use no cookies for analytics, so no cookie consent banner is required. Checkout happens on Creem’s own domain, which sets its own cookies there; see Creem’s buyer terms for detail.

We measure aggregate traffic to our public website pages using Umami, a privacy-focused analytics tool that sets no cookies, stores no personal data and does not track you across sites. It records anonymous page views, referrer and approximate country only.

Umami runs on the public website only. It is not loaded at all once you sign in, so no page you visit inside the application — and nothing in those addresses, including run identifiers and the names or e‑mail addresses of people in your tenant — is sent to it. Page views on the public pages are reported by us explicitly rather than collected automatically from the address bar.

5. Who we share data with

We use a small number of sub-processors, each bound to process data only for us:

• Microsoft Azure — application hosting, key management and script execution (United States).
• Supabase — application database and authentication records (Ireland, European Union).
• Umami Software, Inc. — cookieless analytics for our public website pages only, not for the signed‑in application; no personal data collected.
• Armitage Labs OÜ (trading as Creem) — Merchant of Record, payment processing, invoicing and tax (Estonia, European Union).
• Microsoft Azure Communication Services — transactional email.

We do not otherwise disclose personal data, except where legally required or to protect our rights or the safety of users. If the business is sold or reorganised, data may transfer to the acquirer under the same protections, and we will tell you first.

6. International transfers

Our application database — which holds your account, your run inputs and your run outputs — is hosted in Ireland, in the European Union. Script execution, application hosting and key management run in the United States, and the business is operated from Egypt. Where personal data originates in the European Economic Area, the United Kingdom or Switzerland, transfers are covered by the standard contractual clauses and equivalent safeguards our providers maintain, together with encryption in transit and at rest.

7. How long we keep it

• Account and tenant data — while your account is active, then deleted within 30 days of closure.
• Run inputs and outputs — while your account is active so you can review past runs; deleted with the account, or earlier on request.
• Assistant questions — the text of your question is deleted after 180 days. We keep the anonymous record of which script was suggested and clicked, which is what tells us where the catalogue is hard to search.
• Server logs — up to 90 days.
• Billing and tax records — retained by us and by our Merchant of Record for as long as tax and accounting law requires, typically several years, even after account closure.

Revoking our application in Microsoft Entra ID ends our access to your tenant immediately, independently of any deletion request.

8. Security

Data is encrypted in transit (TLS) and at rest. Tenant access uses certificate-based application authentication with the minimum permissions each plan requires; your tenant’s certificate private key lives in a managed key vault, and application secrets are held in the platform’s configuration store. Neither is in code or in source control. Production access is restricted to the operator of the Service and protected by multi-factor authentication. Each automation run authenticates only with your own tenant’s certificate and can reach no other tenant, and every run is recorded with its inputs, status and output. If a breach affects your personal data we will notify you and any relevant supervisory authority without undue delay, and within 72 hours where required.

9. Your rights

Depending on where you live, you may have the right to access your personal data, correct it, delete it, export it in a portable format, restrict or object to its processing, and withdraw consent where processing relies on consent. California residents may request disclosure of the categories of personal information collected and may opt out of sale or sharing — we do neither.

To exercise any right, email info@theglobalassistant.click. We will verify your identity and respond within 30 days. There is no charge unless a request is manifestly excessive. We will never restrict or degrade your Service for making a request.

If you are in the EEA or UK you may also lodge a complaint with your local data-protection authority. For personal data contained in automation outputs, the organisation that ran the automation is the controller — contact them first, and we will support them in responding.

10. Children

The Service is for business use by adults. It is not directed at children, and we do not knowingly collect personal data from anyone under 18. If we learn that we have, we will delete it.

11. Changes and contact

We will update this notice when our practices change and revise the date above; material changes are emailed to active subscribers. Questions, requests and complaints go to Ahmed Wael, sole proprietor, trading as The Global Assistant (TGAGlobal) at info@theglobalassistant.click. See also our Terms and Conditions and Refund and Cancellation Policy.