We are committed to protecting your personal data in accordance with Sri Lanka's PDPA No. 9 of 2022 and the EU General Data Protection Regulation (GDPR).
1. Data Controller
Henkei Corporation (Private) Limited ("we", "us", "our") is the data controller for personal data processed at mcps.work. That covers four things: the public website and its published resources, the M365 Graph MCP connector, the student subdomain service, and the readers' area of the Books section (Your 30 Days with Foundry). Where a section below applies to only one of them, it says so.
2. Personal Data We Process
M365 Graph MCP is a pass-through connector. We do not store your Microsoft 365 data on our infrastructure. The following data is processed transiently to fulfil your requests:
Microsoft 365 Data (on-Behalf-of-User)
- Email messages, subject, sender, recipients, body, read/written on your behalf when you explicitly instruct the AI assistant.
- Calendar events, title, start/end time, attendee list.
- Contacts, display name, email addresses, phone numbers.
- Mailbox settings, timezone, auto-reply configuration.
Authentication Data (in Memory Only)
- OAuth 2.0 access tokens (validity: up to 1 hour), held in process memory only.
- OAuth 2.0 refresh tokens (validity: up to 7 days), held in process memory only; deleted on logout or token revocation.
- Microsoft Entra ID user identifier (sub claim), used for session isolation.
Website Enquiries (Sent by Email)
- Name, email address, organisation, enquiry topic and the message you write, submitted through the consultation, training or support forms. These are emailed to us and are not written to a database.
Student Subdomain Service (Stored)
- Email address, used to send a one-time sign-in code and the annual renewal reminder.
- The subdomain label you claim and its DNS configuration.
- Session tokens and sign-in codes, held as keyed hashes rather than in the clear.
- This is the one part of the service that keeps a durable record. It is held in Azure Table Storage in our own region, and it is separate from any M365 data.
Books: Your 30 Days with Foundry (Stored)
- When you register: your display name, your email address, and an optional one line about what you want to build. Nothing else is asked for. We also record the date you agreed to this notice.
- What you choose to send us there: questions for an expert (with whether you said it is OK to share them anonymously), consultation requests (the questions you ticked, your context, call or written reply, and the times that suit you), and feedback on the book (chapter, rating and comments).
- Sign-in links and sessions, held as keyed hashes rather than in the clear.
- Who sees it: the author and the experts he invites to answer readers. A question is only published, without your name or email, if you ticked "OK to share anonymously".
- It is held in Azure Table Storage in our own region, and each question, request or piece of feedback is also emailed to the author so he can reply. We block text that looks like a password, token or key, and ask you never to paste one.
3. Purpose & Legal Basis
- Consent (s. 5 with Schedule I(a)), you authenticate via Microsoft OAuth and explicitly authorise each action.
- Contractual necessity (s. 5 with Schedule I(b)), processing is required to deliver the service you requested.
- Legitimate interest (s. 5 with Schedule I(f)), server-side logging for security and troubleshooting.
- Consent (s. 5 with Schedule I(a)), for the Books 30 Days area: you agree, in plain words, when you register. The purposes are signing you in, answering your questions, arranging consultations and improving the book. We use the data for nothing else.
- Consent (Article 6(1)(a)), OAuth authorisation.
- Contractual necessity (Article 6(1)(b)), service delivery.
- Legitimate interest (Article 6(1)(f)), security logging, fraud prevention.
4. Sub-Processors & Third Parties
We rely on the following sub-processors to deliver this service:
- Microsoft Corporation, Microsoft Graph API (data source), Microsoft Entra ID (authentication), Azure Container Apps (hosting). Microsoft's privacy policy applies to data held in your Microsoft 365 tenant.
- Anthropic, PBC, Claude AI models process your natural-language instructions and the M365 data you share with them. Anthropic's enterprise data handling commitments apply.
- Google LLC, Google Analytics (GA4) collects anonymised page-view statistics (pages visited, approximate location, device type). No M365 data or personal email/calendar content is sent to Google.
5. International Data Transfers
Requests are forwarded to Microsoft Graph API servers. Microsoft maintains data residency commitments for EU/EEA customers under the EU Data Boundary programme.
When you use Claude AI features, your data is processed by Anthropic's infrastructure. For EU/EEA users this constitutes a transfer to the United States under Standard Contractual Clauses (SCCs).
Google Analytics data is processed by Google LLC in the United States under SCCs. Analytics data is anonymised and does not include M365 content.
For Sri Lankan users, cross-border transfers comply with section 26 of the PDPA.
6. Data Retention
- OAuth access tokens: up to 1 hour (Microsoft-imposed TTL). Not persisted to disk.
- OAuth refresh tokens: up to 7 days. In process memory only; deleted on restart, logout, or revocation.
- M365 content (mail, calendar, contacts): never stored. Data is fetched on-demand, returned to the AI model, and immediately discarded.
- Server access logs: retained for up to 30 days for security monitoring. Logs contain IP addresses, timestamps, and HTTP status codes, no message content.
- Google Analytics: anonymised usage data retained per Google's default retention policy (14 months).
- Website enquiries: retained in the receiving mailbox for as long as needed to answer you and to keep a record of the engagement.
- Subdomain sign-in codes and sessions: short-lived. Codes expire on use or shortly after issue; sessions last 12 hours.
- Subdomain claims: held while the claim is active, and released 30 days after a claim lapses.
- Books 30 Days: sign-in links expire after 15 minutes or on first use; sessions last 30 days. Your registration and what you sent us are kept until you delete your account, or ask us to. The email copy sent to the author is deleted within 30 days of that request.
7. Security Measures
- All traffic encrypted with TLS 1.2+ (HTTPS enforced, HSTS with preload enabled).
- OAuth 2.0 with PKCE; tokens never exposed in URLs or logs.
- Rate limiting and request-ID tracing on all endpoints.
- Container-level isolation; no persistent disk storage.
- Azure Container Apps hardened environment.
- Input validation and HTML-escaping on all user-supplied content.
Breach Notification
- Notify the Authority in the form, manner and time set by rules made under the Act (s. 23).
- Notify affected data subjects in the circumstances those rules prescribe (s. 23).
- Notify the supervisory authority within 72 hours (Article 33).
- Notify affected individuals without undue delay where high risk exists (Article 34).
8. Your Data Subject Rights
- Right of access (s. 13)
- Right to withdraw consent and to object (s. 14)
- Right to rectification or completion (s. 15)
- Right to erasure (s. 16)
- Right not to be subject to automated individual decision making (s. 18)
- Right of appeal to the Authority (s. 19), and to complain to the Personal Data Protection Authority of Sri Lanka
Response time: one month, extendable by two further months with notice (s. 17)
- Right of access (Article 15)
- Right to rectification (Article 16)
- Right to erasure / "right to be forgotten" (Article 17)
- Right to restriction of processing (Article 18)
- Right to data portability (Article 20)
- Right to object (Article 21)
- Right to lodge a complaint with your national supervisory authority
Response time: 1 calendar month
If you registered for Your 30 Days with Foundry, you can do two of these yourself, at any time: sign in and press Download my data (access), or Delete my account, which removes your registration and every entry in one step (erasure). To correct your name or your one line, register again with the same email.
To exercise any right, email info@henkeicorp.com with your request and sufficient information to verify your identity.
9. Children's Data
M365 Graph MCP is designed for professional and organisational use. We do not knowingly collect personal data from children under 18 years of age. If you believe we have inadvertently collected such data, please contact info@henkeicorp.com immediately.
10. Cookies & Analytics
Google Analytics 4 (GA4) runs on the pages of this website, including the
published training decks, except the Books section (everything under /books/),
which loads no analytics, no tracking and no advertising cookies. It collects anonymised usage statistics: pages visited, approximate
country, device type, and how far a reader gets through a deck. GA4 sets first-party cookies
(_ga, _ga_*) to distinguish visitors. No M365 data, no email or
calendar content, and no directly identifying information is included in analytics events.
Analytics runs on the website only. The MCP connector endpoints and the student subdomain service are not instrumented, so using the connector sends nothing to Google.
Beyond analytics cookies, this website does not use tracking pixels, advertising cookies, or
persistent tracking identifiers. Three cookies are functional rather than analytical: the OAuth
state parameter, a short-lived cryptographic nonce that prevents CSRF during the login flow,
__Host-mcps_domains, the signed-in session for the student subdomain service, and
__Host-mcps_books, the signed-in session for the Books 30 Days area, set only when you sign in
there. None of them is used for tracking.
You may opt out of Google Analytics by installing the Google Analytics Opt-out Browser Add-on.
11. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in the law, our practices, or the service. The effective date is shown in the page header. Continued use of the service after a policy update constitutes your acceptance of the revised terms.
For significant changes that affect your rights we will make reasonable efforts to notify connected users.
12. Contact Us
For questions about this Privacy Policy, to exercise your data subject rights, or to report a concern:
Sri Lankan users may also contact the Personal Data Protection Authority of Sri Lanka. EU/EEA users may contact their national data protection supervisory authority (e.g. ICO in the UK, CNIL in France, DPC in Ireland).