This is a draft prepared by Paragon MSP and has not yet been reviewed by legal counsel. It describes accurately how the portal works today. Please raise anything that does not match your expectations before relying on it.
This portal shows an organization how much its people use the AI tools it pays for. It records how often those tools were used and by whom. It does not record what anyone asked them to do.
What is stored about you
The complete list| What | Why | Where it comes from |
|---|---|---|
| Your name and work email address | So your organization's administrator can see which seats are being used, and so your own usage can be shown to you. | Microsoft's usage reporting for your organization's tenant. |
| Your Microsoft user ID | To match usage records to the right person without relying on an email address, which can be reassigned to somebody else. | Microsoft's usage reporting, or derived from your work email address where Microsoft does not supply an ID. |
| Counts of activity - how many prompts, tasks or sessions, and on how many days | This is the measurement the portal exists to show. | Microsoft, and any other AI vendor your organization has connected. |
| The date you last used each application | To show which tools are being used and which are not. | Microsoft's usage reporting. |
| Cost or credit consumption attributed to you, where the vendor publishes it | So spending can be compared against the budget your organization set. Several vendors do not publish this per person, and the portal says so rather than showing a blank. | The vendor's own billing reporting. |
| A record of each time somebody opened this portal - who, when, and which page | Your usage data is being shown to your employer. A record of who looked at it is what makes that accountable. | Generated by the portal when you or an administrator signs in. |
What is never collected
Equally important- The text of any prompt, question or instruction you typed.
- The content of any document, message, email or file.
- Anything an AI tool produced for you.
- Your password. Sign-in is handled entirely by Microsoft; the portal never sees or stores credentials.
- Any tracking across other websites. The portal sets one cookie, for your signed-in session, and uses no analytics or advertising services.
Your employer decides that its people's usage is measured and is the controller of that data. Paragon MSP LLC operates this portal on their behalf as a processor, and acts only on their instructions.
An administrator at your organization sees organization-wide figures and a per-person breakdown for their own organization only. You see your own detail if you have been given the member role. Paragon MSP staff can see each client's configuration and can administer it, but the usage tables are deliberately not opened to Paragon's cross-client role. No client can see another client's data under any circumstances - this is enforced by the database itself, not only by the application.
Usage records and the access log are deleted automatically once they pass the retention period agreed with your organization. The current setting is 400 days. Deletion runs every day as part of the same scheduled task that loads new data.
In Microsoft Azure, in the United States. Data is encrypted in transit and at rest. Access to the database is restricted to the portal itself, using an identity that cannot read across organizations.
Nothing is sold, and nothing is shared for advertising. The portal reads from Microsoft and from any AI vendor your organization has connected; it sends nothing to them beyond the request for your organization's own reports.
You can ask for a copy of what is held about you, ask for it to be corrected, or ask for it to be deleted. Because your employer is the controller, please raise the request with them first; they can ask Paragon to act on it, and we will. Depending on where you live you may also have a right to complain to a data protection authority.
If what the portal collects changes, this notice is updated at the same time, and the effective date above changes with it.
Anything here that does not match what you were told, or that you would like changed: privacy@paragon-msp.com. Raising it before it matters is always easier than afterwards.