Last updated: 10/10/2026
This Privacy Policy describes how JFDI web parts, developed and provided by JFDI Consulting Ltd, process and protect personal information. It covers the web parts listed below and any others that link to this page. Product-specific details appear under the relevant name.
This policy applies to the web parts and their associated licensing service. It does not apply to the JFDI Planner Suite, which has its own Planner Suite Privacy Policy, or to other JFDI products.
Because this page is hosted on jfdi.info, use of this website is also covered by our website Privacy Policy and Cookie Policy. Those policies explain the website’s use of data and cookies. This policy describes what the installed web parts transmit and store.
The web parts this covers
This policy also covers any other JFDI web part whose product page or Microsoft Marketplace listing links to it.
Where your data lives
Every JFDI web part is a SharePoint Framework (SPFx) solution that runs inside your organisation’s own Microsoft 365 tenant, in the signed-in user’s browser. There is no JFDI-hosted application tier between your users and their data.
A web part reads SharePoint and Microsoft 365 content as the signed-in user, through SharePoint’s own APIs and Microsoft Graph. Business content stays in your tenant or the user’s browser. JFDI does not receive a copy of that content through the licensing service. Access to tenant content for support requires your organisation’s authorisation. Licensing data is described below.
Information the web parts process
The personal information a web part handles is information already present in your Microsoft 365 tenant, read with the signed-in user’s own permissions. Depending on the web part, this can include:
My Sites for SharePoint
My Sites reads information about the sites the signed-in user owns, belongs to, follows, or has recently visited or edited, using SharePoint and Microsoft Graph under that user’s permissions. Site results and display preferences are cached in the browser. Results are reused for ten minutes; older results can remain for up to a week and appear while fresh results load.
Following or unfollowing a site through My Sites updates the user’s SharePoint following preferences, not site content. Site results are not sent to JFDI.
Licence checks send the tenant ID and product ID with the signed-in user’s Entra token to JFDI’s licensing service. When an administrator assigns or releases a licence seat, the service also receives the Entra ID of the user concerned.
Browser storage
Some web parts keep small amounts of data in the user’s browser storage, such as a cached result or a display preference, so the page loads quickly and remembers the user’s choices. This data stays on the user’s device, is never sent to JFDI, and can be cleared at any time by clearing the browser’s site data.
What leaves your tenant
Licence checks and licence seat management send information to JFDI.
Each web part validates its licence through a secure, encrypted (HTTPS) call to the JFDI licensing service. The call carries your Microsoft 365 tenant ID and the product ID, and is authenticated with a Microsoft Entra ID token for the signed-in user, so the service can confirm that your organisation has an active subscription and that the user holds a licence. When an administrator assigns or releases a licence seat, the service receives the Entra ID of the user concerned. These requests identify the tenant and users for licensing purposes.
The licence check does not carry site contents, list contents, file contents, or any other business data. No web part contains third-party tracking, analytics, advertising, or data-collection components. No data is sold, shared, or transferred to third parties. These licensing requests are separate from the site information a web part reads in your tenant.
Subscriptions bought through the Microsoft commercial marketplace are also processed by Microsoft, under Microsoft’s own privacy statement.
Permissions
Web parts operate entirely within the permissions the signed-in user already holds. A user can only see content they are already authorised to access in SharePoint and Microsoft 365, so placing a web part on a page never grants anyone access to a site or item they could not already reach.
Web parts use delegated Microsoft Graph and licensing permissions. A SharePoint administrator approves any additional permissions in the SharePoint admin centre. Some permissions, such as User.Read for My Sites, are already granted by SharePoint. Each web part’s product page lists the permissions it requests.
Authentication
Authentication is handled by Microsoft Entra ID, using your organisation’s existing sign-in, conditional access and multi-factor authentication policies. The web parts use Entra access tokens rather than collecting your password. There is no separate account to create or manage.
Your rights and your control
Your organisation manages content in its tenant using its Microsoft 365 tools for retention, deletion, export and subject access. Browser caches and preferences are held separately and can be removed by clearing the browser’s site data. For questions or requests about personal information held by the JFDI licensing service, contact us.
You can remove any web part at any time from your App Catalog.
Changes to this policy
We update this policy when the way our web parts handle information changes, including when a new web part is brought under it. The date at the top reflects the most recent revision.
Contact
For questions about this Privacy Policy or data protection across our web parts, contact us.