Microsoft 365 Calendar Scheduler & Sync Privacy Policy
Last Updated: September 30, 2026
This policy explains what Microsoft 365 Calendar Scheduler & Sync (the "App") handles, where it goes, and what you control. The App is provided by OneSpace ("we", "us").
1. What the App is
The App runs inside your Freshworks account. It connects Freshservice to your Microsoft 365 calendars so agents can schedule meetings from records and so assigned work appears on Outlook calendars.
2. We do not receive your data
The App runs on the Freshworks platform and talks directly to Microsoft and Freshservice. We don't operate servers that receive, copy or store your calendar, mailbox or Freshservice data. The data flows described below stay between your Freshworks account and your Microsoft 365 tenant.
3. What data the App handles
| Data | Where it comes from | What the App does with it |
|---|---|---|
| Calendar availability (free/busy and out-of-office status) of agents and attendees | Microsoft Graph | Reads it to suggest meeting times. Not stored. |
| Calendar events (subject, time, attendees, Teams link) | Microsoft Graph | Creates, updates and cancels events. Reads them live for display in the sidebar. The App stores only an event ID and a few linking fields (see below), not the event contents. |
| Mailbox time zone | Microsoft Graph | Reads it to show correct times. |
| Directory lookups (an agent's name and mailbox, matched by email address) | Microsoft Graph | Used by Personal Work Sync to find each agent's calendar. Matches are cached for up to 24 hours. |
| Freshservice record details (tickets, changes, problems, releases, tasks, project tasks: title, dates, assignee, requester, status, group, category) | Freshservice API | Used to schedule meetings and to create or update synced calendar events. |
| Ticket description text | Freshservice API | When an agent schedules a meeting, the description is reduced to plain text, cut to 500 characters, and included in the invite. Personal Work Sync events do not include the description. They carry a subject and a link back to the record. |
| Sign-in tokens | Microsoft | Used to act on your behalf. See section 5. |
4. What the App stores
The App stores data in the Freshworks platform's storage for your account. It stores:
- Linking records: the Freshservice record ID, the Microsoft event ID, the target calendar type, which agent created the event, and sync timestamps.
- Agent status: an agent's ID, email, connection status, and when the connection was last verified. No tokens are stored here.
- Sync bookkeeping: progress markers, run counts, and sync health and error logs.
- Settings: your admin configuration (for example which work types sync, automation rules, and each agent's preferences).
It does not store event subjects, attendee lists, meeting bodies, mailbox contents, or ticket descriptions.
5. Credentials
- Agent sign-in tokens are held in the agent's browser by the Freshworks platform. The App's server code never has access to them.
- Admin Microsoft sign-in is held and refreshed by the Freshworks platform.
- Personal Work Sync credentials (the Tenant ID, Client ID and client secret of the Azure app your organization creates) and your Freshservice API key are saved as secure settings in the Freshworks platform. We don't see them.
- We never ask for, and the App never stores, a Microsoft password.
6. Permissions the App requests from Microsoft
- Agent sign-in (delegated): read and write the agent's calendars, including shared calendars they can access; read mailbox settings; read basic profile; maintain access between sessions.
- Admin sign-in: the permissions needed to list Microsoft 365 Groups and users and to write to shared and group calendars you configure.
- Personal Work Sync (application permissions on your own Azure app):
Calendars.ReadWriteandUser.Read.All. These let the App write to agents' calendars in the background and look up mailboxes by email. They're granted by your administrator and can be revoked at any time by deleting the app registration.
7. Who data is shared with
- Microsoft: the App sends requests to Microsoft Graph and Microsoft sign-in. Microsoft's own privacy terms apply to that data.
- Freshworks: the App runs on, and is sold through, the Freshworks platform and Marketplace. Freshworks' privacy terms apply to data in your Freshworks account.
- We don't sell data, don't use it for advertising, and don't share it with any other third party.
8. Retention and deletion
- Data stays in your Freshworks account's storage until you remove it or uninstall the App.
- On uninstall, the App attempts to delete its stored records for your account. Calendar events it already created in Microsoft 365 remain on those calendars. Delete them in Outlook if you don't want them.
- Turning off sync stops new updates. Events already on calendars stay and are no longer updated.
- An agent who opts out of sync is excluded from further syncing.
- Revoking access: an admin can revoke the App's consent in Microsoft Entra, or delete the Azure app registration used by Personal Work Sync, at any time.
9. Security
The App uses the Freshworks platform's secure storage for secrets, sends data only over HTTPS to Microsoft and Freshservice, and does not write secrets to logs. No system is perfectly secure, and we can't guarantee absolute security. To report a security issue, write to [email protected].
10. Your rights (GDPR and similar laws)
You're the controller of your calendar and Freshservice data, and the App processes that data on your behalf inside your own accounts. Requests to access, correct or delete personal data should go to your organization's administrator, who can act on the data directly in Freshworks and Microsoft 365. If a request reaches us, we'll point it to you. TODO: Legal to confirm the controller/processor wording and whether a data processing agreement is needed.
11. Children
The App is for workplace use and isn't directed at children.
12. Changes to this policy
We'll post changes on this page and update the date above. Material changes will be announced through the Freshworks Marketplace listing or by email.