XGXrmGhost

Legal

Privacy Policy

Version 1.4.0 — effective 2026-10-23.

1. Scope

This is the Privacy Policy v1.4.0 for XrmGhost.

This Privacy Policy covers our handling of personal data in connection with the XrmGhost service, our website, billing, support, analytics, and product telemetry. Cookie and analytics disclosures are included in this document; we do not publish a separate cookie policy in this version.

This Privacy Policy is the legal document. The technical notice at https://docs.xrmghost.tech/cli/privacy/ describes, field by field, what the XrmGhost CLI and the plugin host send, why, for how long, and how to turn telemetry off. The two documents are kept consistent with each other; where they say the same thing in different words, this Privacy Policy prevails.

2. Controller and contact

The controller for the processing described in this Privacy Policy is Agostini Lab S.r.l., Via Montebello 3, 35141 Padova (PD), Italy, VAT number and tax code 04767140280, which operates XrmGhost. In this Privacy Policy, "XrmGhost", "we", and "us" refer to Agostini Lab S.r.l.

For privacy questions, data subject requests, or other legal/privacy matters, you can contact XrmGhost at legal@xrmghost.tech.

3. Categories of data we process

We may process the following categories of personal data and related information:

  • account, profile, contact, and support information;
  • billing and transaction information processed in connection with payments and subscriptions;
  • website and product usage information, including analytics and telemetry data;
  • diagnostic data about CLI commands and plugin runs, limited to a fixed list of fields: for example the command name, its outcome and duration, the CLI version, the type and message of an error raised by the CLI itself, and the timing and outcome of a plugin run. The error message is free text produced by the error and may contain a file path or the URL of your Dataverse environment. This category does not include your plugin code, your plugin's output or trace, the name of your plugin or assembly, your scenario files, or any Dataverse record;
  • an indication of whether a command was run by a person, by an AI agent (and which agent, from a fixed list), or by a CI pipeline (the actor fields described in Section 4);
  • service and operational data processed through the XrmGhost application stack, including Dataverse and Azure services, and service and security logs, which include your IP address when a rate limit triggers; and
  • device, installation, and environment information used for telemetry and machine registration, including pseudonymized machine registration identifiers and related operational metadata.

4. Current telemetry and machine registration reality

Product telemetry from the XrmGhost CLI is enabled by default. You can opt out of telemetry transmission by setting the environment variable XRMGHOST_TELEMETRY to 0. Only the value 0 (after surrounding whitespace is trimmed) opts out; if the variable is absent or set to any other value, telemetry remains enabled. The plugin host honours the same variable.

The opt-out stops telemetry transmission only. Licensing, machine registration (including the active-day counting described below), and API-key validation remain active while XRMGHOST_TELEMETRY=0 is set, because they are necessary to provide and secure the service.

Telemetry that was already queued on your device before you opted out remains on disk: while XRMGHOST_TELEMETRY=0 is set it is neither sent nor deleted, and its transmission may resume if you remove the variable.

Machine registration. Each time the CLI starts, it registers the installation with the service. The registration carries a random installation identifier (the Platform ID) created on first run and stored on your device; one-way SHA-256 hashes of your machine name, operating-system user name, and user domain, computed on your device so that we do not receive those values in clear; the operating-system description; the .NET runtime description; and the CLI version. The hashes use no secret key, so someone who already knows one of those values could compute the same hash: we therefore treat them as pseudonymous, not anonymous. The service records the time of the first and of the latest registration. To recognise a reinstallation on the same machine after the Platform ID has been deleted, the service computes a further hash over the three hashed values above and uses it to link duplicate registrations; that hash is derived only from fields already listed here and adds no further data from your device.

We use the pseudonymized machine registration identifier to distinguish installations, support service operations, apply subscription or entitlement logic, investigate abuse, and troubleshoot reliability or security issues. XrmGhost intends that registration identifier to function as an operational pseudonym rather than as a directly identifying customer-facing label.

As part of machine registration, the service counts active days for an installation: on the server, at registration time, it counts, per pseudonymized machine registration identifier, the number of distinct UTC days on which the CLI registered. Because this counting is part of machine registration, it continues while XRMGHOST_TELEMETRY=0 is set.

The CLI writes a local state.json file in the XrmGhost application-data directory on your device. That file caches the latest machine-registration state returned by the service: the trial start and day index, the active-day count, the trial state, and at most one service notice. The CLI does not send the state.json file anywhere.

Who ran the command. Each telemetry record carries three fields that state who drove the command and nothing else about that party: actor (one of human, agent, ci, or unknown), agent_name (a name from a fixed list, present only when the actor is an agent; any other name is recorded as other), and is_ci (true or false). They are derived from the --actor option, from the XRMGHOST_ACTOR environment variable, from the presence of environment variables that AI agents and CI systems set, or from whether the console is interactive. We read whether those variables are set, not their contents, and we do not send their values. The plugin host also records whether it runs in CI and whether the session is interactive; those host-side flags stay on your device and are not sent to us. The actor fields are used for aggregate measurement only; no command behaves differently because of them. XRMGHOST_TELEMETRY=0 stops them together with the rest of telemetry.

Field-level description. The current list of fields sent by the CLI and the plugin host, with examples and retention per field, is published at https://docs.xrmghost.tech/cli/privacy/. That page is updated in the same release whenever a release changes what is sent.

We use telemetry and machine registration data because they are necessary for service operations, security monitoring, troubleshooting, reliability analysis, subscription administration, and product improvement.

5. Cookies, analytics, and similar technologies

This Privacy Policy also covers our use of cookies, analytics, and similar technologies. We do not publish a separate cookie policy document in this version.

We use Pirsch for website analytics on our websites, www.xrmghost.tech and docs.xrmghost.tech. Pirsch is a cookieless analytics service: it does not set cookies or use similar technologies on your device, does not process personal data, and does not use persistent identifiers to recognize or track you across visits or websites. It provides only aggregated statistics about website visits, such as page views, referrers, and general browser or device categories. Because Pirsch is cookieless and does not use personal data or persistent identifiers, our websites do not display a cookie banner for analytics.

The customer portal sets one strictly necessary session cookie (auth_token) after you sign in, so that you stay signed in while you use it; it is not used for analytics or tracking. Payment pages in the portal load Stripe.js, which may set Stripe's own fraud-prevention cookies, as described in Stripe's privacy documentation. Neither requires consent, and no cookie banner is displayed for them.

Product telemetry is separate from website analytics. Product telemetry from the XrmGhost CLI, and the pseudonymized machine registration identifiers described in Section 4, support operation of the service, diagnostics, security, reliability monitoring, and product improvement. They are not collected through Pirsch, and Pirsch website analytics do not use them.

6. Why we process data

We process personal data to:

  • provide and operate the XrmGhost service;
  • register installations and operate service-connected features associated with your subscription or use of the service;
  • authenticate users and manage service functionality;
  • process billing and payment events, including payments handled through Stripe;
  • send transactional email about your account and subscription, such as password resets and renewal notices;
  • measure aggregated website usage through Pirsch cookieless analytics, without personal data or persistent identifiers;
  • analyze service usage and product behavior through product telemetry, including how often the CLI is run by people, by AI agents, and by CI pipelines;
  • maintain security, investigate incidents, prevent abuse, and troubleshoot issues;
  • keep the records of past licences, invoices, and payments that we need to answer questions about them and to meet our accounting and tax obligations;
  • communicate with customers and respond to support, contractual, or legal requests; and
  • improve product quality, reliability, and roadmap decisions.

7. Legal bases

Where GDPR or similar laws apply, we rely on contract and legitimate interests as the primary legal bases described in this policy, and on legal obligation for the records that the law requires us to keep.

  • Contract (our Terms of Service): XrmGhost does not use a separate customer contract; the binding agreement is our Terms of Service. On that basis we process data as necessary to provide the service, register installations, manage subscriptions, process payments, deliver support, and fulfill our obligations to customers under those Terms. Where machine registration or related operational processing is required for service-connected functionality, that processing forms part of the contractual service relationship governed by the Terms of Service.
  • Legitimate interests: for processing necessary to secure, monitor, troubleshoot, analyze, improve, and administer the service and related website experience, including product telemetry used to understand service performance, reliability, and use, and the retention of account records for the audit period described in Section 10 so that we can answer questions about past licences, invoices, and payments. Pirsch website analytics are cookieless and do not process personal data or persistent identifiers, so they do not require a legal basis for personal data processing and do not require cookie consent or a cookie banner.
  • Legal obligation: for keeping invoices and accounting and tax records for the periods required by applicable law, and for responding to lawful requests from authorities.

8. Vendors and processing ecosystem

Our current processing ecosystem includes Microsoft (Azure, Dataverse, Entra and Microsoft account sign-in, Microsoft 365 and Exchange Online), GitHub, Stripe, and Pirsch.

  • Microsoft Azure (West Europe region) hosts the licensing service, telemetry storage, and service logs.
  • Microsoft Dataverse is part of the application and data-processing stack and holds customer accounts and subscriptions.
  • Microsoft Entra and Microsoft account support sign-in to the customer portal with a Microsoft identity.
  • Microsoft 365 and Exchange Online deliver our transactional email, such as password resets and renewal notices.
  • GitHub supports sign-in to the customer portal with a GitHub identity, hosts our documentation site, and hosts the plugin host package that the CLI downloads.
  • Stripe supports payment and billing processing.
  • Pirsch supports cookieless website analytics for www.xrmghost.tech and docs.xrmghost.tech, without cookies, personal data, or persistent identifiers.

9. Hosting and geographic scope

XrmGhost currently uses EU data residency for the XrmGhost-hosted service components covered by this policy, including the Azure-based hosting footprint used for those components.

Some supporting providers or related business operations may still involve access from, storage in, or transfers to countries outside the European Union or European Economic Area. Where that occurs, XrmGhost will rely on an available lawful transfer mechanism and appropriate safeguards, such as contractual protections required by applicable law.

10. Retention

We keep personal data for the following periods:

  • Product telemetry and run diagnostics are deleted from our storage 24 months after they are received.
  • Machine registration data (the Platform ID, the hashed machine, user, and domain names, and the related registration metadata) is kept until you ask us to delete it.
  • Account data (name, email, billing details, and the record of your licences and payments) is kept while your account is active. When you delete your account, it is not removed at once: we keep it for audit purposes for 24 months from your last sign-in or from the deletion of your account, whichever is later, so that we can answer questions about past licences, invoices, and payments. When that period ends, the record is anonymised: name and email are blanked, and what remains is a licence and payment history that cannot be linked back to you.
  • Invoices and accounting and tax records are kept for as long as applicable tax law requires, by us and by Stripe.
  • Service and security logs, including the IP addresses written when a rate limit triggers, are kept for 30 days.
  • Website analytics produced by Pirsch contain no personal data and are kept only as aggregated statistics.

We may retain other categories of personal data for different periods depending on the purpose of processing, contractual requirements, legal obligations, support needs, security needs, and dispute resolution requirements.

11. Data sharing

XrmGhost may share personal data with service providers, processors, advisors, or authorities when needed for service delivery, compliance, security, support, analytics, billing, machine registration, or legal reasons.

Current service providers and processing ecosystem participants are listed in Section 8: Microsoft (Azure, Dataverse, Entra and Microsoft account, Microsoft 365 and Exchange Online), GitHub, Stripe, and Pirsch. Microsoft and GitHub receive your sign-in identity when you use them to sign in; Microsoft 365 receives your name and email address to deliver transactional email; GitHub sees the IP address of visitors to the documentation site and of CLI installations that download the plugin host; Stripe receives the name, email, billing address, tax identifier, and payment method needed for payments and invoices. Pirsch receives only the website visit information needed to produce aggregated, cookieless website statistics; it does not receive personal data, persistent identifiers, product telemetry, or machine registration identifiers.

We may also disclose data where required by law, to enforce our rights, or to protect the service, our users, or third parties.

12. Security

We use technical and organizational measures intended to protect personal data in our systems. However, no system is completely secure.

XrmGhost uses pseudonymized machine registration identifiers in the registration path described in this policy: the machine name, user name, and user domain are hashed on your device before they are sent. Even where data is pseudonymized, we treat related operational information with appropriate technical and organizational safeguards because pseudonymized data can still be personal data under applicable law.

13. Your rights

Depending on applicable law, you may have rights to request access, correction, deletion, restriction, objection, portability, to lodge a complaint with a supervisory authority, or to seek other privacy-related remedies.

Deletion requests are honoured subject to the retention periods in Section 10: during the 24-month audit period after account deletion, account data is anonymised rather than erased, and invoices and accounting and tax records are kept for as long as the law requires.

You can contact us about those rights at legal@xrmghost.tech.

14. Policy updates

We may update this Privacy Policy from time to time. If we make material changes, we may update the version, effective date, or related notices associated with this document.