Privacy

• Message metadata from the two nominated mailboxes only: sender, recipients, date and time, folder, importance, whether attachments exist, Outlook's Focused/Other classification, and the subject line.
• Never the message body, preview text or attachments.
• Subject lines are the most sensitive field and may contain participant names. They are access-controlled, every search is audited, and they are covered by retention. Core IT can turn subject storage off and purge stored subjects.

• The CEO (executive): both nominated mailboxes.
• The State Manager SA (manager): their own mailbox only, with no data from the CEO's mailbox, not even totals.
• Core IT (administrator): settings and sync health only. Message-level data needs a recorded reason (“break-glass”), expires automatically and is audited.
• “Open in Outlook” links are shown only to the mailbox owner.
• Sign-in is with Livability Care Microsoft 365 accounts on an allow-list. The database enforces access on every query.

In Australia: the database is in Supabase's Sydney region (ap-southeast-2) and the application runs in Vercel's Sydney region (syd1). Application logs contain no names, addresses, subjects or message identifiers.

• Up to 12 months of history is collected at the start. Message-level data is deleted after 24 months; daily totals are kept for trends.
• The audit log records sign-ins, message-level views, searches, exports, overrides and settings changes.
• LCA owns the data. The CEO or Core IT can generate a full export (all tables as CSV) at any time from Settings → Data export.
• If the service ends, Core IT hands over a final export, removes the mailbox access in Exchange and the app registrations in Entra, deletes the hosting projects and confirms deletion in writing.
• To ask for an export, a correction or deletion, contact Core IT or LCA's privacy officer.