Data and privacy
What Footer365 reads from Microsoft 365 and from your mail, what it stores and for how long, including campaign click data and what is sent to HubSpot when you connect it, and where to find the sub-processor list and security statement.
This article summarises what Footer365 does with data, for an IT administrator answering questions from a data protection officer or a security questionnaire. The legal detail is in the privacy policy, the data processing terms and the security page.
For the personal data in your Microsoft 365 directory, your organisation is the data controller and Footer365 (Chillishot Limited) acts as a data processor.
What Footer365 reads
From your directory, through the read-only permissions described in Permissions Footer365 asks for, and why: user and group attributes needed to build signatures (for example display name, job title, phone numbers and photo), group membership, and your verified domains. Photos your administrators or staff upload in Footer365 are kept beside these, as a new copy without the file's own details such as where a photo was taken, and are deleted when they are removed, when the person leaves your directory, and with your account. See Upload signature photos.
Footer365 writes nothing to your directory unless you turn on write-back to Entra ID for staff self-service. Then, through the separate Footer365 Directory Write application you consent to for it, Footer365 writes the details staff change, only for the fields and people you choose, and records every write in your audit log. See Let staff edit their own details.
From your mail, only what passes through the relay while a signature is added. Footer365 does not read or retain the body of your messages beyond injecting the signature and, in a reply or forward, tidying the signatures and banners it added to your organisation's earlier messages in the quoted part, as your Long conversations setting says. The relay does not keep a copy of any message. Where a signature shows the time sent or the recipient's name or domain, the relay works them out from the message's To line and its own clock as it signs, writes them into that one signature and keeps neither; people on Cc and Bcc are not used. See Merge fields and empty fields. For the sending alarm, the relay counts each sender's messages and recipients over the last 10 minutes, in its memory only, and keeps no recipient address; when a sender passes your limit, the sender's address and the two counts go into your audit log and an email to your technical contact and account owner. See The sending alarm. If your organisation uses the Outlook add-in only, no mail passes through the relay at all.
From the Outlook add-in, the signed-in person's identity, the address they are sending from, whether the message is new, a reply or a forward, and the domain part only of the recipients, used to choose the internal or external signature. With each message it signs, the add-in also reports which kind of Outlook it is running in and its own version, and whether the person deleted its signature before sending. With the Outlook add-in only, it also reports each message it had to send without a signature, with the reason.
From HubSpot, only when one of your Super Admins has connected it: the id of a company and the domains it is known by, to find the company a click belongs to. Nothing else is read from HubSpot.
From a source, only when one of your administrators has added one on Directory > Sources: the CSV or JSON file at the https address they gave, read on a schedule with the credential they saved, if any. Footer365 uses the column that says who each row is about and the columns they matched to details, applies those values to your people the way an import does, and does not keep the file. The address and the credential are encrypted, and only the address's host is shown beside the source and written to the audit log. The system that publishes the file is your organisation's own supplier, not one of Footer365's sub-processors: Footer365 reads it on your instruction. See Keep details up to date from a file.
From a web feed, only when one of your Super Admins has added one on Developers > Integrations for the Social feed element: the RSS or Atom feed at the https address they gave, read once a day and on Read now, and the picture each of its latest items names. Footer365 keeps the feed's title and, of its three newest items, only what a card shows, and does not keep the rest of the feed. The website that publishes the feed is your organisation's own, not one of Footer365's sub-processors: Footer365 reads it on your instruction. See Show your latest posts in signatures.
When a message is sent, the add-in reads its body on the sender's device only to check that its own signature is still there and, in a reply or forward, whether the quoted part holds a signature Footer365 added, and never sends the body to Footer365. A reply that does, when your organisation tidies long conversations, goes through the relay on its way out so the quoted part can be tidied. It reads the subject too, and sends Footer365 only the words in it that start with #, at most five, so that a message keyword can be applied and taken out; the rest of the subject never leaves the device. The add-in does not read the mailbox, other messages or attachments.
What Footer365 stores
| Data | What it holds | How long |
|---|---|---|
| Directory data | The synced user and group attributes, group membership and domains | While your subscription is active; refreshed by sync rather than accumulated, so it reflects your directory as it stands |
| People outside your sync scope | If you choose who is synced, someone the scope leaves out is kept with what is held for them for 30 days after they leave it, so widening the scope brings them back as they were. After that Footer365 keeps no details of them, only the number of user mailboxes Microsoft 365 holds that it keeps no record of, so they are still counted as seats. See How directory sync works | The person is deleted, with everything held for them, 30 days after leaving the scope; someone new who is outside it is never kept. The number is counted again at each sync |
| Signature content | Templates, rules, campaigns, brand kits and uploaded images, including the images in your image library | While your subscription is active. Uploaded images no longer used by any template or campaign are removed automatically after a grace period, except images in your image library, which stay until you delete them |
| Directory sources | For each source you add: its name, format, the host of its address, the address and any credential (both encrypted), how often it is read, which column holds which detail, and how its last run went. The values a source sets are kept with the people they are about, like any value entered in Footer365 | While the source exists; deleted with it, with its values, or with your account |
| Social feed | For your web feed: its address, the name drawn on the cards, when it was last read and whether that worked, and who added it. Of its three newest items, the words as drawn, the date, the item's address and a card picture of each, which may name or show people | Replaced at each read that works, and kept as they are when a read fails; deleted when the feed is removed, or with your account |
| Source runs | For each run of a source: when it ran, what started it, who chose Run now, and counts of rows read, people matched, values changed and removed and rows not matched, with the reason if it failed. No person's address and no value | 90 days, then deleted; deleted with the source or with your account |
| Processing record | For each message: the sending address, the IP address of the mail server that sent it to Footer365, which rule and template applied and how many recipients it had, any message keyword typed in the subject and what it did, whether the Outlook add-in or the mail flow signed it, the kind of Outlook and the add-in version where the add-in signed it, whether the sender deleted the add-in's signature before sending, and for a reply how many of your organisation's earlier banners and signatures were taken out of the quoted part or shortened. No recipient addresses, no subject beyond a keyword, and nothing about the message content. People with the View insights permission see it per sender on the Coverage page | At most 90 days, then deleted, with the template and campaign versions only it named. After that only the number of messages handled each day is kept, in all and for each rule, template, campaign and survey, until your account is deleted, and the reports count those for older days |
| Campaign reach | For messages that carried a campaign banner only: the outside organisations the message reached, as email domains, never addresses. Your own domains are excluded, and at most 50 per message | Kept with the processing record |
| Campaign image loads | Only while one of your Super Admins has allowed counting image loads and a campaign has it turned on: which campaign's banner image loaded and in which message, and when it first loaded, once per message. No recipient address, IP address or browser details | Your click data retention period, then deleted; deleted with the campaign or with your account |
| Your offices | The addresses and ranges you list under Your offices, with the name you gave each, when it was added and who added it, and the timing test's setting. Your own offices' addresses, never anybody else's | Kept with your account until you remove them; deleted with your account |
| Campaign clicks sent to HubSpot | Only while one of your Super Admins has HubSpot connected: for each human click sent, the domain of the outside organisation the message went to, the HubSpot company the note was written on, and whether it was written. The connection itself: the HubSpot account, who connected or disconnected it and when. HubSpot's access, encrypted. No recipient address, IP address or browser details | The record of each click: your click data retention period, then deleted. HubSpot's access: deleted when HubSpot is disconnected or refuses it. All of it is deleted with your account |
| Survey answers | For each answer to one of your surveys: the answer, the email it came from and its sender's address, name and department, the template, whether the scanner filter held it, and any comment the recipient typed. No recipient address, IP address or browser details | Kept with your account; deleted with the survey, or with your account |
| Contact cards | While your organisation has contact cards on: a random code for each person's card, your choice of what cards show, your logo and colour, and how many times each card was opened, scanned and saved each day. For QR codes that open a web address: the address as your template holds it and its scans each day. No visitor's IP address, browser details or anything else about who opened a card or scanned a code | Kept with your account, deleted with it |
| Meeting backgrounds | Each background's design, who it is offered to and its dates, and how many times each was downloaded or could not be drawn each day. No picture of anybody: each person's copy is drawn in their own browser, and no record is kept of who downloaded what | Kept with your account; deleted with the background, or with your account |
| Audit log | Configuration changes, provisioning steps and mail-processing outcomes, with who did what and when | Information entries 90 days, warnings 180 days, errors 1 year, and entries about the health of the service itself 30 days. After your account is deleted, only its entries about security, consent, the agreements and billing are kept for those periods; the rest are deleted 30 days after the deletion |
| Account and contact data | Names, work email addresses, phone numbers and job titles of your account contacts, and company details | While your account is open |
| Sign-in sessions | The name, work email address, IP address and browser details of each sign-in to the portal | Deleted with your account; otherwise 90 days after the session expired or was signed out |
| Agreement records | Who accepted the agreements for your organisation and when, the versions accepted, your organisation's details at the time, and any notices of change and objections | 7 years after your subscription ends, including after your account is deleted |
| Invoices | Invoices, credits and the other financial records of your account | Six years from the end of the financial year they relate to, as the law requires, including after your account is deleted |
Card details are handled by the payment provider and are never stored by Footer365; only a payment token, the card's brand, its last four digits and its expiry date are held.
Campaign click data
When somebody clicks a link in a campaign banner, Footer365 records which campaign and link, when, whether it looks like an automated link scanner, whether it was left out of your figures and why, the kind of email program and device, the country the request came from, and for a limited time the IP address and user agent of the request. A click is left out when it is a scanner, comes from one of the addresses you list under Your offices, or comes within the seconds you choose of the message being sent; the reason stays with the click after its address is cleared.
- The IP address and user agent are cleared after 90 days by default. You can set your own period, up to 365 days, under Campaign click privacy in Account settings, using the Keep for field. Leaving it empty follows the Footer365 default.
- The click itself is kept for at most 12 months, so your campaign figures do not change when the details are cleared, and is then deleted. Once the two details are cleared, the click identifies no one.
- The country is worked out when the click is made, from the IP address, in a file of address ranges that Footer365 holds itself: DB-IP's free IP to Country Lite, which Footer365 downloads once a month. The address is looked up inside Footer365 and sent to no one, so DB-IP receives nothing about your recipients and is not a sub-processor. Only the two-letter country is kept, and it stays when the address is cleared, as the email program and device do. A page that shows countries links to DB-IP.com, as the file's licence asks.
- No recipient is ever named. Footer365 cannot say who followed a link.
- Your organisation can turn click tracking off. On the Click tracking card in Account settings, turning off Count clicks on links in signatures sends every link in your signatures straight to where it points, and nothing is counted from a link or an image: no click, no IP address or browser details, no banner image load. A tracked link in a message sent before then still opens its destination while its campaign runs, with nothing recorded. Clicks already recorded are kept as they were and cleared of their details as above. Each campaign can also be left uncounted on its own.
More detail is in Click data and privacy.
Campaign clicks sent to HubSpot
Footer365 sends nothing to a CRM unless one of your Super Admins connects HubSpot on Developers > Integrations. Once it is connected, Footer365 sends HubSpot each human click on a campaign banner as a note on the company the message went to: the campaign and the link clicked, who sent the message and when it was clicked, on the company found by the domain of the organisation the message went to. A click is never sent with a recipient's email address or the clicker's IP address or browser, and a click by a mail scanner is never sent at all. Only clicks made after the moment of connecting are sent.
HubSpot is your organisation's own supplier, chosen and connected by you, not one of Footer365's sub-processors: Footer365 sends it these records on your instruction, and what HubSpot does with the notes is between you and HubSpot. Disconnecting stops the sending, and Footer365 then asks HubSpot to revoke its access and deletes it; notes already written stay in HubSpot. See Send campaign clicks to HubSpot.
The same facts can be sent to your own systems with the campaign.clicked webhook event, which only your organisation's own endpoints can take. See Send events to your systems with webhooks.
Campaign image loads
Footer365 does not count opens unless your organisation turns it on. A Super Admin can allow it on the Count image loads card in Account settings, after confirming that your organisation has checked whether its recipients' consent is needed and accepts responsibility for that decision, because counting when an image in an email loads is treated much like a cookie under PECR and the EU's ePrivacy rules. Each campaign is then turned on separately. While a campaign counts, its banner is sent as a link to an address made for each message rather than inside the message, and Footer365 records the first load of each message, without the reader's IP address or browser details. See Click data and privacy.
Recipients who stop banners
A campaign can offer a link that lets a recipient stop your banners. When someone uses it, Footer365 keeps a one-way code made from their address with a key held for your organisation, when it was made and which campaign carried the link, and never the address itself. As each message is sent, the addresses of its recipients are made into the same codes to see whether any of them has opted out, and nothing is written. The codes are deleted when the person asks for banners again, when your organisation shows banners again at their request, or with the rest of your account's data. See Letting recipients stop banners.
Contact cards
A contact card is a public page, at an address made from a random code, showing the details your organisation chose for one person. It is off until one of your Super Admins turns it on. The page is built from your directory each time it is opened and holds nothing else; it closes at once when the cards are turned off, when the person's account is turned off or they leave your directory, or when the card is given a new link. To count a visitor once a day, Footer365 keeps a one-way code made from the visitor's IP address and browser in memory for about a day, and never stores it. See Contact cards.
Meeting backgrounds
A meeting background's picture is drawn in the browser of the person who opens My signature, from the design and that person's own name, job title, department and company, and handed only to them. Footer365 stores the design and a daily count of downloads per background, and no picture and no record of who downloaded what. See Meeting backgrounds for Teams and video calls.
Where data is held
Footer365's servers are hosted by LCN (Team Blue) in the United Kingdom. Your mail is processed there, and your directory, signature and account data are stored there. The Data region you choose when you sign up decides which of Footer365's mail relays processes your mail; the United Kingdom is the region offered today. The full list of sub-processors, with what each does and where, is on the sub-processors page.
Security
- Everyone signs in through Microsoft Entra ID. Footer365 never sees or stores passwords.
- All traffic is encrypted in transit with TLS, and mail between Exchange Online and the relay requires TLS in both directions.
- The access tokens and credentials Footer365 holds for your organisation, and for the services it connects to on your behalf, are encrypted at rest by the application itself, with AES-256.
- Configuration changes, provisioning steps and mail-processing outcomes are recorded in the audit log, which you can read in the portal. See Audit log.
See the security page for the full statement, including how to report a vulnerability.
Deletion
When your subscription ends, signatures stop and Footer365 takes itself out of your Exchange Online (see Removing Footer365). Your data is then kept for 30 days so you can export it, including your audit log, and your account and its data are deleted within a further 30 days. The Cancel subscription page shows both dates, and you are emailed a week before the deletion. A Super Admin can have the account deleted sooner from the same page, or you can ask Footer365 support through the contact page. See Cancel your subscription.
The deletion removes everything held for your account from the live system in one step: the directory data, portal users and sign-in sessions, signature content and uploaded images, the processing record and its daily totals, campaign clicks, image loads and reach, the HubSpot connection and the record of clicks sent to it, survey answers and comments, contact card settings and counts, meeting backgrounds and their counts, directory sources and their runs, and your account and contacts. Each step of it is recorded. These are kept on purpose:
- Your Microsoft tenant ID and the date your trial started, so that a free trial cannot be taken twice. It holds no name, address, user or mail data, and is kept indefinitely.
- Invoices and the other financial records for the period the law requires, above, then deleted.
- The agreement records, and the record of the deletion itself, for 7 years after your subscription ended, then deleted.
- The audit log entries for your account about security, consent, the agreements and billing, until their periods above have passed. The rest of your account's entries are deleted 30 days after the deletion.
- Any reseller transfer request your organisation was part of, with your contact's email address removed and every person's name replaced, because it counts towards the reseller's own history.
- If your account was ever flagged for campaign link abuse, the link findings behind that decision, for 1 year after the deletion, then deleted.
If taking Footer365 out of your Exchange Online has not finished by the deletion date, the data is deleted as soon as it has finished, or has been found impossible because Footer365's access has gone. Copies in Footer365's backups are deleted as those backups expire, within one month, and are never restored to the service.
Still stuck?
Tell us what you were trying to do and what you saw. Include the sender, a recipient and roughly when a message was sent, and we can trace it.