TeamSpaces privacy policy

Last updated: 28 October 2026

This policy describes how TeamSpaces, published by VAMC Technologies (“we”, “us”), handles data. TeamSpaces comes as a web part for Microsoft SharePoint and as an extension for Azure DevOps (together “TeamSpaces”, “the app”). The sections below apply to both, except where one is named.

Summary

TeamSpaces runs entirely inside your Microsoft 365 tenant. We do not collect, receive, store or process any of your data. The app has no servers, no telemetry and no analytics. It makes network requests only to your own SharePoint Online tenant, and, if your organisation turns on the optional import from Confluence, to your own Confluence site through a relay that your organisation deploys and runs (see below).

What the app stores, and where

Everything TeamSpaces saves is written to the SharePoint site where it is used, with the permissions of the signed-in user, through Microsoft’s SharePoint APIs:

This content stays under your organisation’s control. It is governed by your Microsoft 365 settings and policies for retention, eDiscovery, sensitivity labels, backup and access. You can delete it at any time, like any other SharePoint content. Removing the app does not delete it.

Azure DevOps

The extension runs inside your Azure DevOps organisation, in the browser, with the permissions of the signed-in user. It makes network requests only to Azure DevOps (dev.azure.com and its own services), and stores:

Removing the extension does not delete the repositories. The extension’s data storage is managed by Azure DevOps under Microsoft’s terms. Linking a page to a work item adds an ordinary link on the work item.

While someone edits a page, the extension keeps a copy of their draft in the browser’s storage (IndexedDB) on that device, until it has been saved to the repository, so an edit isn’t lost if the browser closes. It also remembers small preferences in local storage, such as the last space used and the width of the page tree.

Importing from Confluence (optional)

This section applies to the SharePoint web part. (The Azure DevOps extension imports Confluence exports from a folder, read in the browser.) The import from Confluence is off unless a site owner enters a relay address in the web part’s settings. When someone uses it:

• They enter their Confluence address and their own Confluence token. The token is kept in the browser’s memory only while the import dialog is open, and is never saved.
• The browser reads the chosen Confluence space (pages, attachments the pages use, page icons, comments and the names of the people who wrote them) through the relay, and saves it to your SharePoint site as described above.
• The relay is a small Azure Function that your organisation deploys in its own Azure subscription (its source is published with the app). It only forwards read requests to the Confluence sites your organisation allows, and it stores nothing. We do not operate a relay and receive none of this data.

Page views, starred and recent pages

• Page views. In Azure DevOps, the extension counts how often each page is read: one number per page per month, in the extension’s storage in your organisation, counted once per browser session. No names, times or other details are kept. A space admin can turn counting off in the space’s Content settings.
• Starred and recent pages. The pages you star or read last are kept for you: in Azure DevOps in the extension’s storage in your organisation, in SharePoint in your browser’s local storage.

Content from other sites

TeamSpaces sends nothing to other sites on its own. Two features load content from sites a space chooses:

• Embeds show a page of another site (a video, a design, a board, a report) in a frame. Your browser loads it from that site, which may set its own cookies, under its own privacy terms. Embeds are allowed only from the sites listed in the space’s Content settings.
• PlantUML diagrams are off until a space admin turns them on and names a PlantUML server. A diagram’s text is then sent to that server to be drawn. Mermaid diagrams are drawn in the browser and their text isn’t sent anywhere.

Personal data

The app uses the name and email address of the signed-in user, which it gets from SharePoint or Azure DevOps, to:

• record who holds an edit lock or owns a draft,
• record the author in a page’s header when the page is published, and the author of a comment.

In Azure DevOps it also looks up people (names, email addresses and pictures) through Azure DevOps, for @mentions and profile cards. SharePoint and Azure DevOps themselves record who created or changed each file, list item and commit. When pages or comments are imported, the original authors’ names and email addresses from the imported files are stored with that content on your site.

None of this information is sent to us or to any third party.

Cookies and browser storage

TeamSpaces sets no cookies. (For the Azure DevOps extension’s browser storage, see “Azure DevOps” above.) To save typing, the Confluence import remembers the Confluence address and the e-mail address last used for it in the browser’s local storage, on that device only (never the token). SharePoint Online and Azure DevOps use their own cookies under Microsoft’s privacy statement.

Microsoft 365 Copilot

Published pages are ordinary files on your SharePoint site, or in your Azure DevOps wiki. If your organisation uses Microsoft 365 Copilot, Copilot can read them according to your tenant’s settings, its connectors and the users’ permissions. Drafts and comments are excluded from search. That processing is done by Microsoft under your agreement with Microsoft, not by us.

Children

The app is a business tool and is not directed at children.

Changes

If this policy changes, we will update this page and its date.

Contact

Questions about this policy: support@vegha.ai