Privacy Policy

Dockli (“we”, “us”, the “App”), operated by Tiny Tugboat (Pty) Ltd., brings your Microsoft 365 files into Windows File Explorer. This policy explains what data the App and this website process, and why. We designed Dockli to keep your data inside your own Microsoft 365 tenant.

1. Our privacy-first architecture

Dockli acts on your behalf against Microsoft Graph, scoped strictly to the permissions your organization has granted and to files you can already access. Key points:

• Authentication uses Microsoft’s native Windows broker (MSAL / WAM). Your credentials never pass through Dockli.
• Access tokens are stored locally, encrypted at rest using the Windows Data Protection API (DPAPI).
• The local host binds to loopback (localhost) only and is not exposed to your network.
• Your file contents remain in Microsoft 365. Dockli does not copy your files to our servers.

2. Data we process

On this website

We collect standard server logs and privacy-friendly, aggregated analytics (page views, referrers). If you submit the “Book a demo” or contact form, we process the details you provide (name, work email, company, message) to respond to you.

In the Dockli app

• Account identifiers — your signed-in email and tenant id, to authenticate and license your seat.
• Diagnostic events — limited, non-content telemetry (e.g. feature usage, error reports) to keep the App reliable.
• AI features (Spark) — when you use Ask Dockli, the content you reference is processed to generate a response and is scoped to your permissions. It is not used to train foundation models.
• Usage analytics — when each user's Dockli checks its licence (at sign-in and roughly hourly while open), we record which days and hours that user was active, and when their seat was claimed or released. Tied to the tenant id and user id.
• AI usage metadata (Spark) — for each Ask Dockli request we record the type of request (a new prompt, an action step, or an email-writing assist), the names of the actions the assistant took (for example “search” or “rename”), and token counts. We never record the text of prompts or responses, or the contents or names of your files.

We use usage analytics and AI usage metadata to operate and support the service, understand adoption, manage capacity and AI cost, and improve Dockli. They are visible only to authorised Tiny Tugboat staff and are never sold or used for advertising.

3. Legal bases

We process data to perform our contract with you (providing the App), for our legitimate interests (securing and improving the service), and with your consent where required (e.g. optional analytics).

4. Sharing & sub-processors

We use Microsoft Azure for hosting (including Azure SQL in Sweden Central for licensing and usage analytics, and Azure Application Insights in West Europe for AI usage metadata) and Microsoft Graph as the data source you connect to. We do not sell your personal data.

5. Retention

Diagnostic data is retained only as long as needed to operate and secure the service. Usage analytics and daily AI usage totals are kept for about 13 months; detailed per-request AI usage metadata is kept for 90 days. Locally stored tokens are removed on sign-out or uninstall. You can ask us to delete usage data for your organization or a user at any time.

6. Your rights

Depending on your location (including GDPR and South Africa’s POPIA), you may have rights to access, correct, delete, or port your data, and to object to processing. Contact us to exercise these rights.

7. Contact

Questions or requests: support@dockli.io. See also our Terms of Use and EULA.