Exorcist 365 by ValorCloudPrivacy Statement - Exorcist 365
1. Scope and responsibility
Exorcist 365 is operated by ValorCloud. For audits performed within a customer Microsoft 365 tenant, the customer organization determines the authorized purpose and applicable lawful basis. Privacy questions may be sent to the contact below to identify the appropriate controller.
2. Data processed
- Professional identity data used for sign-in and attribution, such as display name, UPN or work email, tenant identifier and Microsoft 365 object identifier.
- Read-only Microsoft 365 data needed for the audit, limited to the workloads the customer's administrator has enabled and consented to (least-privilege, incremental consent granted per workload when it is turned on). Depending on the enabled workloads this may include: accessible SharePoint sites and OneDrive resources with file and folder metadata, versions and sharing information; Exchange mailbox settings, messages and calendar events; Microsoft Teams teams, channels, membership, chat and channel messages, and channel activity (last-message timestamps used to flag empty or dormant channels); and Microsoft Entra directory objects such as users, groups, guests and role assignments.
- Content search results. When you search for a pattern, Exorcist 365 uses the tenant's native Microsoft Search to locate the pattern inside item content — file content and, for the enabled workloads only, Exchange and Teams messages. The app reads only what is needed to reveal the branch that contains a match and to show match counts; it does not copy, export or store message or document bodies. Searches run in the customer tenant and in the browser session.
- Backlog content, including the submitted message, category, date, app version, language and professional attribution. Voting transmits a user identifier to prevent duplicate votes; the voting identifier is stored as a hash by the backlog service.
3. Purposes
Data is processed to authenticate users, perform authorized document-governance audits, generate reports and recommendations, operate the shared product backlog, manage votes, publish user-approved DataRoom metadata, and support service security and troubleshooting. Audit operations do not modify source documents.
4. Storage, visibility and retention
Audit work and reports may be stored locally in the user's browser. Shared backlog submissions are sent to the configured Azure service and may be visible to other app users, including the submitted professional attribution. Shared entries should be assumed to remain available until the service administrator or support team corrects or removes them.
5. DataRoom publications
When the user explicitly publishes a DataRoom, Exorcist 365 writes metadata and links to a selected SharePoint list. Source documents remain in their original locations and their permissions are not changed. The target-list audience may nevertheless see published titles, paths, summaries, sensitivity information and other metadata even when they cannot open the source document. The app previews this exposure and requires confirmation before publishing. Exorcist-managed fields may be updated on later publications; existing user data and editorial fields are preserved.
6. Data minimization and security
Use the app only with the permissions and legitimate business purpose required for the audit. Administrators should grant the minimum necessary delegated permissions, control access to the backlog service, and define an appropriate retention policy.
7. GDPR / RGPD rights
Where GDPR applies, individuals may have rights of access, correction, deletion, restriction, portability and objection, and may lodge a complaint with their competent supervisory authority. Local app data can be cleared from the app settings. Requests concerning shared backlog data should identify the relevant submission and be sent to the organization administrator or support contact.