XRAI for Teams Privacy Policy

This privacy policy governs the XRAI for Teams (“Service”) developed by XRAI Inc. (“we,” “us,” or “our”), detailing how we handle authentication data across Microsoft Teams integrations.

Introduction

The Service operates as an addon to Microsoft Teams, providing enhanced functionality while maintaining strict privacy standards for all user data.

Integration Methods

The Service operates through a standardized authentication framework:

1. Microsoft Teams Integration: Uses Microsoft Entra ID for authentication and user identification within your organization.

2. Meeting Verification: Optionally verifies meeting participant membership when enabled by authenticated users.

No personal identifiers (names, emails) or credentials are retained beyond active sessions.

Information Collection

Teams Integration (Entra ID)

When integrating with Microsoft Teams environments, we request:

OAuth Scopes and Purpose

• Temporary Tokens: Short-lived credentials (15-minute validity) for API operations.

• User Metadata: Non-sensitive identifiers for authorizing XRAI Stream access.

Meeting Verification

For Teams meeting integrations:

• Authentication Data: Name and email from Microsoft Entra ID.

• Meeting Context: Meeting ID and participant status for verification purposes.

Use of Information

When you use Microsoft Entra ID to access our addon, we only collect the information you authorize Microsoft to share with us. This typically includes your name and email address, and is used exclusively to verify your identity and meeting participation status when requested.

Scope-Specific Data Handling

Entra ID Scopes in Practice:

• profile:

  • Used solely to identify users requesting XRAI Stream access with user-specified preferences.

• onlinemeetings.read:

  • Used exclusively to verify meeting participation status without accessing meeting contents or sensitive metadata.

Universal Restrictions

• No Behavioral Tracking: Credentials and data obtained from Microsoft are never used for analytics, advertising, or behavioral tracking.

• No Cross-Scope Escalation: Tokens and permissions are strictly limited to the scopes you authorize and cannot access other resources within Teams or Microsoft 365.

Data Sharing Policies

We do not share, sell, or disclose any data obtained from Microsoft Entra ID with any third parties, partners, or affiliates, for any reason. All information received from your Microsoft account is used exclusively to provide and maintain the functionality of our addon as described above. We will never transmit, sell, or distribute your Microsoft account data to anyone outside our organization, under any circumstances.

Security Framework

OAuth Security Protocols

Scope Minimization:

• Least Privilege Design: profile access limited to:

  • Verifying user identity.

  • Authorizing XRAI Stream access.

• Read-Only Enforcement: presence.read prevents modifications to meeting settings.

Technical Safeguards:

• Token Binding: Session tokens restricted to:

  • Originating IP address.

  • Pre-registered client IDs.

• Ephemeral Storage: Credentials stored in memory-protected buffers with automatic zeroization after 900 seconds.

User Controls

Scope Management

Teams Users:

• Revocation: Terminate active sessions via Microsoft account security settings.

• Permission Adjustment: Control addon access through Teams administrator settings.

Audit Capabilities

Session Logs: Metadata-only records of:

• Scope usage timestamps.

• Meeting verification events.

Export Format: JSON logs available on request for compliance audits.

Compliance and Transparency

We comply with all applicable privacy laws and only use your data as described in this policy. Any changes to our data handling practices will be reflected in this Privacy Policy, and we will seek your consent if required.

Your privacy and the security of your Microsoft account data are our top priorities. If you have any questions about how your information is handled, please contact us using support@xrai.glass.

Regulatory Compliance

Privacy Law Alignment

Policy Updates

Version Control:

• Change Notifications: Email alerts for scope-related policy modifications.

• Grace Period: 30-day transition window for deprecated scopes.