Privacy Policy
Effective date: 22 July 2026
This Privacy Policy explains how DevPro Studio Pty Ltd ("DevPro Studio", "we", "us") handles personal information in connection with Certify, our SharePoint workflow automation platform (the "Service"). It is written to align with the Australian Privacy Principles under the Privacy Act 1988 (Cth), and section 11 explains how we handle personal data of individuals in the EEA and the UK.
1. Our role
Certify runs workflows on top of your organisation's own Microsoft 365 / SharePoint Online environment. For the business content inside your tenant — documents, list items, and similar records — your organisation is the data controller and we act on your behalf (a processor) to execute the workflows you configure. For the limited operational data we hold to run the platform (described below), we act as the controller.
2. "No data at rest" for your business content
Your business content stays inside your own SharePoint tenancy. When a workflow runs, our engine reads and writes the specific items that workflow touches, processes them transiently in memory to perform the configured actions, and does not retain a copy of that content afterwards. We do not mine, sell, or use your business content for any purpose other than executing and auditing the workflows you set up.
3. Information we do collect and store
| Category | Examples | Why |
|---|---|---|
| Account & tenant data | Your Microsoft Entra tenant ID, organisation name, the email addresses and names of administrators and staff who use the platform. | To connect Certify to your tenant, authenticate users, and provide support. |
| Configuration | Workflow definitions, action settings, branding, and email templates you create. | To store and run your workflows. |
| Operational & audit logs | Workflow run history, audit trail entries, approval records, error and diagnostic logs (which may reference item identifiers and the email addresses involved in an action). | To run workflows reliably, let you trace what happened, and diagnose faults. |
| AI prompts | Text you submit to AI-assisted features and the usage counts associated with it. | To generate the requested output and enforce usage quotas. |
| Billing | Subscription, invoice, and contact details. | To administer your subscription. |
4. How we use information
- to provide, operate, secure, and support the Service;
- to execute the workflows and actions your organisation configures;
- to authenticate users and enforce access controls;
- to monitor performance, detect and fix faults, and protect against abuse;
- to communicate with you about the Service and your subscription;
- to comply with our legal obligations.
We do not sell personal information.
5. Service providers and disclosure
We share information only as needed to run the Service, with providers that support it. Each provider receives only the minimum data required for its function:
- Microsoft — Microsoft 365, SharePoint Online, and Entra ID, which host your tenant and authenticate users;
- Our AI provider — receives the prompt text you submit to AI-assisted features, solely to return a result;
- Our logging and email/CDN providers — used to record operational events and to send and host workflow emails and assets;
- Hosting and infrastructure — the servers on which the Certify engine and administration portal run.
We may also disclose information where required by law, to enforce our terms, or to protect the rights, safety, and security of DevPro Studio, our customers, or the public.
6. Hosting and location
The Certify engine and administration portal are hosted on infrastructure operated by DevPro Studio in Australia. Your business content remains in your own Microsoft 365 tenancy, in the region you have configured with Microsoft. Some service providers may process limited operational data outside Australia; where that occurs we take reasonable steps to ensure appropriate protection.
7. Retention
We keep operational and audit data only as long as needed for the purposes above. By default, workflow run history and audit records are retained for up to 90 days (or the most recent runs per workflow) and then automatically pruned; account and billing records are kept for as long as your subscription is active and as required by law. Your business content is retained by you in your own tenant, under your own retention settings. When your subscription ends, we return or delete the operational data we hold for your organisation on written request, and in any event delete it within 30 days, except for records we are required by law to retain.
8. Security
We use technical and organisational measures to protect information, including encrypted transport, least-privilege access to customer tenants, encryption of stored secrets, and restricted administrative access. No method of transmission or storage is completely secure, but we work to protect information against unauthorised access, loss, and misuse. If we become aware of a data breach affecting your personal information, we will notify affected customers without undue delay and, where required, the relevant regulator.
9. Cookies and local storage
The administration portal and approval pages use authentication cookies and browser storage (including Microsoft authentication library tokens) strictly for sign-in, session state, and security. We do not use advertising or cross-site tracking cookies.
10. Your rights
Subject to applicable law, you may request access to, or correction of, the personal information we hold about you, and you may make a privacy complaint. Because most business content lives in your own tenant, requests relating to that content are usually handled by your organisation directly. To make a request to DevPro Studio, contact us using the details below. We will respond within a reasonable time. If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.
11. International visitors (GDPR / UK GDPR)
Where the EU or UK General Data Protection Regulation applies to personal data we handle, the following also applies:
- Roles. For business content processed inside your tenant by the workflows you configure, your organisation is the controller and we act as a processor on its documented instructions. For the operational data described in section 3, we act as a controller.
- Legal bases. We process personal data to perform our contract with your organisation, for our legitimate interests in operating, securing, and improving the Service, and to comply with legal obligations.
- Your rights. You may request access to, rectification or erasure of, or restriction of processing of your personal data, object to processing based on legitimate interests, and request portability of data you provided to us. Contact us using the details below to exercise these rights.
- International transfers. The limited operational data we hold is processed in Australia (and by the service providers described in section 5). Where personal data is transferred out of the EEA or UK, we take reasonable steps to ensure appropriate safeguards, such as standard contractual clauses, are in place.
- Complaints. You may lodge a complaint with your local data protection supervisory authority.
12. Children
The Service is intended for use by organisations and their staff and is not directed to children.
13. Changes to this policy
We may update this Privacy Policy from time to time. We will revise the effective date above and, for material changes, take reasonable steps to notify you.
14. Contact
For privacy questions or requests, contact our privacy contact at privacy@devpros.com.au.