Privacy notice for CanoeUX SharePoint Web Parts Essentials

CanoeUX SharePoint Web Parts Essentials (the “Package”, shown as CNX SP Web Parts Essentials in the web parts) is a collection of SharePoint Framework web parts that your organization deploys and runs in its own Microsoft 365 environment. This notice explains what information the web parts process, where it's kept, who controls it, and the few cases where information leaves your Microsoft 365 environment. Our privacy policy covers our website, including downloading the Package from it.

In short

• The web parts run in your organization's Microsoft 365 environment, with the permissions of the person using them. Their code is served from your own tenant, not by CanoeUX.
• CanoeUX doesn't operate any service for the Package. In normal use, the information the web parts show or store isn't sent to CanoeUX.
• Two features can connect to services outside Microsoft 365: a public holiday service, and an optional IP address service your administrator chooses. See Connections outside Microsoft 365.
• What CanoeUX learns about you when you get the Package depends on where you get it: see below.

Where you get the Package

Downloaded from canoeux.com

Downloading the Package from our website needs no account, no sign-in and no form. The file comes straight from our storage on Microsoft Azure. We add one to an anonymous count of the Package's downloads; to count repeated clicks only once, we use a short-lived, one-way hash of your IP address, which we don't store. Like any website host, Microsoft Azure may process technical information about the request, such as your IP address, browser and the time, to deliver the file and protect the service.

We don't keep a record of who downloads the Package, so we don't know who you are or which organization deployed it, unless you tell us.

From the Microsoft SharePoint Store

To get the Package from the Microsoft SharePoint Store, on your organization's Apps site or on Microsoft AppSource, you sign in with your Microsoft work account. Microsoft processes your sign-in and the acquisition under the Microsoft Privacy Statement (opens in a new tab) and the store's terms, not under this notice.

As the publisher, CanoeUX may receive information from Microsoft about the acquisition, depending on the listing and on what you agree to share when you get the Package: for example, your contact details, or reports on how many organizations installed it. We keep any such information in our Microsoft 365 environment (Exchange or SharePoint), use it only to follow up on the acquisition, and delete it as soon as it's been addressed, as described in our privacy policy.

Wherever you get it, the Package is the same and works the same way once it's deployed: everything below applies to both.

Who controls the information

Your organization deploys the Package and decides who can use it, which web parts appear on which pages, how they're configured, which lists and libraries they use, and which optional Microsoft Graph permissions are approved. The information the web parts show or store stays in your organization's Microsoft 365 environment, under its control and subject to its agreements with Microsoft and its own policies.

Your organization remains responsible for its Microsoft 365 tenant: its configuration, permissions, content and retention, the privacy notices it gives its own people, the legal basis for its processing, and answering requests about the information it controls.

CanoeUX doesn't receive, host or have access to the information in your tenant through the Package, so it's neither a controller nor a processor of that information. CanoeUX is the controller only of information you send it directly, such as a support request through our contact form, and of information Microsoft shares with it about Store acquisitions. Our privacy policy applies to both.

How the web parts work

• Each web part runs in the browser of the person viewing or editing the page, using that person's SharePoint permissions and, for some features, Microsoft Graph permissions approved by your Microsoft 365 administrator.
• SharePoint and Microsoft 365 permissions remain the security boundary: a web part never gives anyone access they don't already have. The deliberate exception is CNX SharePoint Control+, with which administrators and site owners can change SharePoint permissions (see below).
• The Package's code is installed in your tenant's app catalog and served from there, not from CanoeUX or a content delivery network.

Information the web parts process

Depending on the web part and how it's configured:

Most of this information comes from your Microsoft 365 environment and is processed in the browser. It isn't sent to CanoeUX. Much of it identifies people: names, email addresses, permissions, page addresses, files, screenshots and attachments are personal information, not anonymous data.

Where information is stored

• Web part settings on SharePoint pages: settings and the content authors add, which can include selected people's names, sign-in names, email addresses and job titles, messages, links, images, logos and icons. Images uploaded from a device are stored in the page itself.
• SharePoint lists: glossary terms (CNX Glossary), holidays (CNX Holidays) and saved assessments (CNX SharePoint Control+).
• Saved assessments: who ran each assessment, the site, its groups, owners, members and other people with access, permission details, files, folders, sharing links and findings, with the full result attached as a file.
• The browser's memory: information being shown, assessed, diagnosed, exported or sent, while the page is open.
• Browser storage: a few settings, described in Browser storage.
• Exports: files people choose to download, which can contain personal information, permissions, page and site addresses, groups, files, folders and sharing links.

Connections outside Microsoft 365

In normal use, the web parts communicate only with your SharePoint sites and Microsoft Graph. These are the exceptions.

Public holidays (CNX Holidays)

When its SharePoint list has no holidays for the selected country and year, CNX Holidays can get public holidays from the public service at nagerholidays.com, from the browser. The request asks only for a country and a year; it carries no credentials and no SharePoint information. Like any web request, it reveals the device's IP address and browser to that service, whose own practices apply.

Public IP address (CNX User Diagnostics)

Off by default. If an administrator turns it on, CNX User Diagnostics asks an HTTPS service chosen by the administrator for the person's public IP address. That service receives the IP address and may keep its own logs. Your administrator is responsible for choosing it, and for its terms, location and retention.

Links people choose to follow

Links in the web parts, such as Learn more links to our documentation, support links set up by authors or Support CanoeUX, open other websites only when someone selects them.

CNX User Diagnostics

• Before it calls Microsoft Graph, the web part shows a privacy notice and asks the person to choose enhanced or basic diagnostics. The choice is kept for the browser tab and forgotten when the tab is closed.
• Diagnostics are gathered and shown in the browser. As designed, nothing is sent to CanoeUX and the web part has no telemetry; the optional IP address service above is the only exception.
• Sensitive values are hidden by default, on screen and in every copy and download: email addresses, sign-in names, IDs, site addresses and public IP addresses. People must confirm before they show them.
• Access tokens, cookies, authorization headers, secrets and unrelated browser storage are never read, shown or exported.
• Results are kept in the browser's memory for up to 30 minutes per page (5 by default), to avoid repeating requests.

Emails sent by the web parts

Three features send email through Microsoft Graph, with the delegated Mail.Send permission, only when the signed-in person selects Send or Submit:

• CNX Support, Give Feedback: a feedback email can contain the sender's name and email address, the full address of the page (including any query string or fragment), their rating, whether they may be contacted, their description, and any files, pasted images or screenshots they add. Taking a screenshot requires the browser's screen-sharing prompt and captures only what the person chooses to share, and people are reminded not to include private or sensitive information. Depending on the settings, the email is sent from the person's mailbox or from a shared mailbox they're allowed to send as. It isn't saved in their Sent Items.
• CNX Glossary, Suggest a term: the suggested term and the suggester's details go to the glossary's publisher email address. The email isn't saved in Sent Items.
• CNX Holidays, Send email: the holidays shown, as a PDF, go to the recipients the person chooses. The email is saved in their Sent Items.

These emails go to the recipients that your organization's authors or users choose, usually your own people, such as your support team. They aren't sent to CanoeUX unless a CanoeUX address is chosen as a recipient.

Microsoft Graph permissions

The Package asks for the delegated Microsoft Graph permissions below. A Microsoft 365 administrator decides whether to approve them, in the SharePoint admin center. Each web part uses only the permissions its features need, and the web parts keep working, with fewer features, when a permission isn't approved.

In SharePoint Framework, approved permissions are granted to a principal shared by every SharePoint Framework solution in your tenant (SharePoint Online Web Client Extensibility), not to this Package alone. Review them with all your SharePoint Framework solutions in mind. SharePoint information is always read and changed with the signed-in person's own SharePoint permissions.

CNX SharePoint Control+

CNX SharePoint Control+ helps administrators and site owners review who can access what. With the right permissions, people can use it to:

• view users, groups, memberships, owners, permission assignments, sharing links and the ways people get access;
• add people to SharePoint groups or remove them;
• change permission levels and restore permission inheritance;
• remove sharing links and access that's no longer needed;
• save, export, compare and delete assessments.

Saved assessments show who can reach which sites, files and folders. New assessment history lists are restricted to the site owners group and the person who ran the assessment. If that fails, for example on a site without an owners group, the lists keep the site's permissions, and site owners should restrict them. Keep access to these lists, and to exports, to the people who need it.

Retention and deletion

• Web part settings: until the web part, its settings or the page are changed or deleted, subject to your Microsoft 365 retention and recovery settings, such as page versions and the recycle bin.
• List items: until someone with permission changes or deletes them, subject to versioning, the recycle bin and retention policies. Deleted holidays, and deleted or purged saved assessments, go to the site recycle bin rather than being erased.
• Saved assessments: CNX SharePoint Control+ keeps the number set in Assessments to keep per site (10 by default) and sends older ones to the recycle bin.
• Diagnostics: in the browser's memory for up to 30 minutes; the consent choice until the tab is closed.
• Browser storage: some preferences and dismissals stay until they're cleared or replaced.
• Emails and attachments: according to the Microsoft 365, Exchange, records management and legal hold policies of your organization and of the recipients.
• Exports: wherever people save or share them.

Recycle bins, retention policies, backups, records management rules and legal holds can keep information after it's deleted.

Browser storage

The web parts set no cookies. A few keep small settings in the browser:

• CNX User Diagnostics: the consent choice, until the tab is closed (session storage).
• CNX Message: which messages the person dismissed, and until when (local storage).
• CNX Holidays: the regions selected (local storage).
• CNX SharePoint Control+: favorite and recent sites (local storage).
• CNX Glossary: the column matches chosen during an import, until the tab is closed (session storage).

None of it is used for advertising or tracking, and none of it is sent to CanoeUX. Clearing the browser's site data removes it.

Security

The web parts are designed to protect information with measures such as:

• using the signed-in person's own SharePoint and Microsoft Graph permissions;
• validating input, cleaning HTML, escaping text, checking addresses, allowing only safe link types and opening new windows safely;
• hiding sensitive diagnostic values by default;
• asking the browser's permission before capturing a screenshot;
• restricting new assessment history lists, where SharePoint allows it.

No software is completely secure. Your organization's Microsoft 365 security settings, permissions and policies remain essential.

International transfers and service providers

The Package doesn't send information from your tenant to CanoeUX, so CanoeUX uses no service providers to process it. Microsoft provides Microsoft 365 to your organization under your organization's agreements with Microsoft, which govern where that information is stored. The services described in Connections outside Microsoft 365 are operated by others, who may be located outside Canada.

Support requests you send us through our contact form, and information Microsoft shares with us about Store acquisitions, are kept in our Microsoft 365 environment (Exchange or SharePoint) and deleted as soon as they've been addressed. Feedback sent with CNX Support goes to the recipients your organization sets up, not to CanoeUX.

Your privacy rights

The information in your organization's Microsoft 365 environment, including everything the web parts show or store, is controlled by your organization. CanoeUX can't access, correct, export or delete it. For requests about it, such as access to or correction of your information, contact your organization, for example its IT or privacy team.

For information CanoeUX controls, such as messages or support requests you send us, see Your rights in our privacy policy. It describes the rights you may have under Canada's PIPEDA, the GDPR in the European Economic Area, the UK GDPR and US state privacy laws, and how to exercise them.

Children

The Package is business software for organizations and isn't directed at children. Your organization's Microsoft 365 environment may nevertheless hold information about minors, for example in a school, and your organization is responsible for it and for how the web parts are used with it.

Changes to this notice

We may update this notice, for example when the Package changes. The date at the top of this page shows when it was last revised.

October 18, 2026: first version of this notice, for CanoeUX SharePoint Web Parts Essentials.

Contact us

For questions about this notice, privacy requests, or support for the Package, use our contact form at www.canoeux.com/contact, select “Something else” and mention that your message is about privacy or the Package. Our terms of use describe the Package's license.