Privacy notice

NovaWeaver is run by Federico Paolo Oberdan Storti, an individual (not a company) established in Italy, who is the data controller. Contact: f.storti@outlook.com — for anything here, including the rights below.

There is no Data Protection Officer, because no Art. 37 trigger applies: we are not a public authority and do no large-scale monitoring or special-category processing. There is no Art. 27 representative, because that duty falls only on controllers established outside the Union.

About those logs, precisely. They strip a fixed list of sensitive field names and any email-shaped string — not the same as “no personal data”. The stripping works on field names, so anything under a name we do not treat as sensitive passes through: error text from Dataverse or our database, which can echo names from your client’s tenant, and your own name or any free text you typed. The address of a connected environment is no longer written to a log in readable form — we record a one-way digest of it instead — but nothing in the scrubber would have caught it, so treat that as a decision we made at each site rather than a guarantee of the machinery. We would rather say so than claim a scrubbing we do not perform.

There is no profiling and no automated decision-making, and no analytics, advertising or session-replay tooling installed anywhere.

• Database, authentication and file storage — in the EU (Ireland, eu-west-1); provider US-headquartered.
• Application hosting — our server functions run in Ireland, but the provider’s edge network is global, so request metadata for visitors outside the EU is handled outside the EEA. US-headquartered.
• Rate limiting and short-lived caching — this store is in the EU (Ireland, eu-west-1). Your email or IP address is replaced with a keyed hash before being used as a key here: pseudonymisation, not anonymisation. Rate-limit keys expire within 60 seconds; the export-cooldown key after 24 hours; a cached Dataverse access token shortly before that token itself expires. That cache key contains your account and environment identifiers.
• Error monitoring — set up against the provider’s EU (Germany) region; US-headquartered. Your browser sends content-security-policy and Trusted-Types violation reports to it directly, so it sees your IP and user-agent for those.
• Email delivery for confirmation and password-reset messages, sent through our authentication provider’s own built-in mail relay — no custom SMTP provider is configured, so no separate email vendor is involved.
• Content delivery and DNS (Cloudflare) — the domain is proxied, not DNS-only, so Cloudflare terminates TLS and every request passes through it — including the pages we render for you while signed in. It also sets its own security cookies on your device (listed below). US-headquartered, global edge.
• Microsoft — when you connect an environment we talk to Microsoft Entra and to your own Dataverse tenant, with the permissions you grant. We never send Microsoft your NovaWeaver password or email address.
• Have I Been Pwned — receives only the five-character hash prefix above, plus our server’s IP. Its hosting region we cannot establish.

Several are US-headquartered, so their staff may access data from outside the EEA for support and administration. We have not yet completed the data-processing agreements and transfer documentation for these providers. We would rather state that than imply paperwork we do not hold. The remaining “still confirming” points are open items, not reassurances. No analytics platform or ad network is installed anywhere, and nothing in the product takes a payment.

• Your account and its contents — designs, extracted metadata, documents, publishers, environments — until you delete the item or your account. No inactivity expiry, no automatic clock.
• Security records — 365 days, deleted by a scheduled daily job; sooner if you delete your account.
• Rate-limit counters — 60 seconds; the data-export cooldown, 24 hours.
• Cached Dataverse access tokens — until five minutes before the token itself expires.
• Server logs and error reports — held by our hosting and monitoring providers under their own retention settings. We cannot delete an entry already written, and we are confirming the exact periods they apply.

You can access your data, have it corrected or erased, restrict or object to the processing we base on legitimate interests, and take it elsewhere (portability). Two are self-serve:

• Access and portability — Settings → Export your data streams a ZIP of your profile, environments, designs, extracted metadata, documents and security records.
• Erasure — Settings → Delete account removes the account, its database rows and its stored files. You type a confirmation phrase and your password; if you use a second factor, the session you are in must already have been verified with it.

Three honest limits: the export has size caps and says inside the archive if it truncated; it omits what our authentication provider holds — sign-in history, or the label you gave an MFA device; and if you change your name in Settings, the original name you signed up with stays with that provider, which we cannot correct in-app either. Email f.storti@outlook.com and we will complete it by hand. There is also no in-app way to change your account email today; write to us.

If you think we have got this wrong, complain to a supervisory authority — in Italy the Garante per la protezione dei dati personali, or the one where you live or work.

Nothing here is required by law. An email address and password are a contractual requirement: without them we cannot create or secure an account, so you cannot use NovaWeaver. Your name is optional, and so is connecting a Dataverse environment — you can build and document a model without one.

Those are the things our own code stores. Because the domain is proxied through Cloudflare, it also sets security cookies of its own — __cf_bm for bot management, and cf_clearance if you are ever shown a challenge. We do not control their contents or lifetimes; Cloudflare documents them as strictly necessary, which is why they too sit outside the consent question. Every one of ours either delivers the service you asked for or remembers a preference you set yourself; none is used for analytics, profiling or advertising. That is why we ask for no consent and show no cookie banner: it would offer a choice that does not exist.

You connect with Microsoft’s device code flow: you sign in on Microsoft’s own page, so that exchange never passes through our servers and we never see your Microsoft password. We receive a refresh token, store it encrypted (AES-256-GCM) and use it only server-side. Access tokens never reach your browser; every Dataverse call is made from our backend.

We read schema metadata only — table, column, relationship and option-set definitions. Nothing in the product queries your business records.

That metadata still contains free text written by your client’s Dataverse administrators, and we do not inspect or filter it. It is your client’s content, mirrored into your workspace because you asked for it, and you choose what to extract. How controller and processor roles fall on that content is a point we are working through with legal counsel; we will update this notice when it is settled.

Disconnecting an environment, or deleting your account, removes our copy of the token and the environment record. Disconnecting does not delete what you already extracted: the design, its metadata and the name you gave the environment stay in your workspace until you delete the design or your account. It also does not revoke the grant at Microsoft — to do that, remove NovaWeaver’s access from your Microsoft account.

If we add a provider, a new kind of data, or anything else stored on your device, this notice changes before that ships. See also our terms of service.