Privacy & security

Last updated: 27 September 2026

Mentoring Programs is a Microsoft Teams app built by Crosstown Tech, a software studio in Toronto, Canada. It helps a program owner run a mentoring program for a Teams team. This page says exactly what the app collects, who can see it, where it is kept and how to remove it.

The short version

• Participants talk to the app only in a private chat with its bot. Nothing about a pair is posted in a channel.
• The program owner sees whether pairs are meeting and the mood tap. The owner never sees the note a pair writes about what they worked on.
• From calendars, the app keeps one fact: "these two people met on this date". Never titles, descriptions or other meetings.
• Anyone can ask the bot "What do you have on me?" to see their data, or say "Delete me" to leave and erase it.

What the app collects

From Microsoft Teams

When the app is added to a team, Teams tells it who is in that team. The app stores, for each member: display name, email address, the Microsoft Entra object id, the Teams user id the bot needs to send a private message, and whether the person is a team owner, member or guest. The role comes from the TeamMember.Read.Group permission, which applies only to the team the app was added to and is granted by that team's owner when adding it.

From the sign-up card

Only what the person types or picks: department, years of experience (as a band such as "3–5"), the goals they want to work on or the skills they offer, how many mentees a mentor can take, an optional note, and answers to up to five questions the program owner adds. The card shows a link to this page before any of it is collected.

While the program runs

• Pairings, and when each pair started and ended.
• Check-in answers: whether the pair met, the mood tap, and an optional note about what you worked on.
• Meeting dates, from check-ins or from calendars (below).
• Closing-survey answers: progress (1–5), whether you'd recommend the program, and an optional quote, which is anonymous unless you tick "use my name".
• A log of the cards the bot sent, so the owner can resend one that failed.
• An audit log of owner and admin actions (create, match, re-match, close, export, delete).

Who sees what

• You see everything about yourself.
• Your partner sees your name, department, experience band and your goals or skills — not your other answers or your mood.
• The program owner (and up to two co-owners) sees sign-up answers, pairings, whether pairs met, meeting counts and moods per pair. Not the notes.
• App admins — people with the Microsoft 365 Global Administrator or Teams Administrator role, and anyone they appoint — see the list of programs in the company and can change owners, archive or delete programs.

Microsoft permissions

The app asks for the least it can work with, and nothing that needs an administrator to start:

• Sign-in (Teams single sign-on) — your name, email and Microsoft ids, for the program owner's tab. Participants never sign in.
• TeamMember.Read.Group — the roster of the one team the app is in, to know who is an owner.
• TeamsTab.Read.Group and ChannelSettings.Read.Group — to find which channel of that team has the Mentoring tab, so the owner's alerts open it. It looks through the team's channel tabs for its own and keeps only the ids of the channels that have it. It does not read messages or files.
• Calendars.ReadBasic (optional) — for meeting tracking. Microsoft's default settings require an administrator to approve it once for the company; the program owner gets a link to send them. Without it, the app asks "Did you meet?" instead.

Calendar access, precisely

With approval, the app reads — for mentoring pairs only — the start time, attendee list and cancelled flag of calendar events from roughly the last five weeks, from one member of the pair. If the other member of the pair is an attendee, it records the date. It does not request or store event titles, descriptions, locations or any other meeting. The access token that allows this is encrypted at rest (AES-256-GCM).

The app never writes to calendars. "Book 30 min" opens Teams' own new-meeting screen for you to send.

Where the data lives

Program data is stored with Convex (database and backend) in the United States. The owner's tab is served by Vercel. Messages between Teams and the app pass through Microsoft Azure Bot Service. All traffic is encrypted in transit. Organizations that need data kept in Canada can contact us before adding the app.

How long it is kept, and deleting it

• "Delete me" in the bot chat removes you from every program, closes your pairs (your partner gets a kind note), and erases your answers, check-ins, notes, survey answers, the cards sent to you and any calendar access. A placeholder named "Deleted participant" remains so the program's totals still add up.
• Archiving a program keeps its data for the report. An app admin can delete a program, which erases everything about it except the audit-log entry that it was deleted.
• Removing the app from a team pauses its programs. Their data is deleted 30 days later.
• Programs with no activity for 60 days are archived automatically.

What we don't do

• No advertising, no selling or sharing data, no training AI models on it.
• No reading of chats. The bot is not in the pair's own chat and cannot see it.

Contact

Questions or requests: support@crosstowntech.com. Crosstown Tech handles personal information in line with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA).