Privacy Policy
This page describes how Simple Agent Designer handles data, communicates with external services, and what you should consider for data privacy and compliance.
Data Handling Overview
Simple Agent Designer processes business data using external AI services. Understanding the data flow is important for compliance with your organization's privacy policies and applicable regulations.
What Data is Sent to AI Providers
When an agent processes a workload, the following data may be sent to the configured AI provider:
Always Sent
| Data | Purpose |
|---|---|
| Agent instructions | System prompts that define the agent's behavior |
| Company name and country | Context for business-appropriate responses |
| Local currency code | Financial context for the agent |
| Current date | Temporal context |
| Workload description | The task instructions provided by the user |
Conditionally Sent
| Data | When Sent |
|---|---|
| Workload Type instructions | When the workload type has custom instructions |
| Attached files (Excel, PDF, images) | When the workload has an Additional Data attachment |
| Business Central record data (as JSON) | When using Table Splitter or DataContext |
| Tool call results | When the agent uses tools and those tools return BC data |
| Previous conversation messages | During multi-turn processing or interactive chat |
Data in Tool Calls
When an agent uses tools that query Business Central:
- The AI model requests specific data (e.g., "look up customer C10000")
- Simple Agent Designer executes the query locally and returns results to the AI
- The returned data (field values, record content) is sent to the AI provider as part of the conversation
This means any Business Central data accessible to the user could potentially be sent to the AI provider if an agent with tools enabled requests it.
Where Data is Processed
Data is sent to whichever provider(s) your agents are configured to use. Each agent uses one provider, so review the data location for every provider in use across your agents:
| Provider | Data Location |
|---|---|
| ChatGPT OpenAI | Processed on OpenAI's servers (US-based) |
| Anthropic (Claude) | Processed on Anthropic's servers (US-based) |
| Google Gemini | Processed on Google's servers |
| xAI Grok | Processed on xAI's servers (US-based) |
| Mistral | Processed on Mistral AI's servers (EU-based) |
| DeepSeek | Processed on DeepSeek's servers (China-based) |
| Moonshot Kimi | Processed on Moonshot AI's servers (China-based) |
| Alibaba Qwen | Processed via Alibaba DashScope (international endpoint) |
| Zhipu GLM | Processed on Zhipu AI's servers (China-based) |
| MiniMax | Processed on MiniMax's servers |
| Azure OpenAI | Processed in your Azure tenant's configured region |
| LM Studio | Processed on your local hardware — no data leaves your network |
Note the geographic location of each cloud provider when assessing data residency and cross-border transfer obligations. If data must not leave your network, use LM Studio; if it must stay in a specific region, use Azure OpenAI.
Provider Privacy Policies
Each AI provider has its own privacy policy and data handling practices. Review the policy of every provider your agents use, including:
- OpenAI: Review OpenAI's privacy policy and API data usage policy
- Anthropic: Review Anthropic's privacy policy
- Google Gemini: Review Google's privacy policy and the Gemini API terms
- Azure OpenAI: Review Microsoft's privacy statement and your Azure service terms
- Other cloud providers (xAI, Mistral, DeepSeek, Moonshot, Alibaba, Zhipu, MiniMax): Review each vendor's published privacy policy and data usage terms before sending business data
- LM Studio: Data stays on your hardware — governed by your own policies
Data Storage in Business Central
Simple Agent Designer stores the following data within your Business Central database:
| Data | Table | Description |
|---|---|---|
| AI Provider API Keys | AI Provider Hgd | Stored as text in the BC database (masked on UI) |
| Agent Instructions | AAI Worker Hgd | Custom instructions stored as blobs |
| Workload Descriptions | AAI Workload Hgd | Task descriptions stored as blobs |
| Workload Attachments | AAI Workload Hgd | Uploaded files stored as blobs |
| Process Activity Logs | AAI Process Activity Hgd | Complete AI responses stored as blobs |
| Agent Work Outputs | AAI Agent Work Hgd | Generated reports/files stored as blobs |
| System Prompts | AAI System Prompt Hgd | Orchestration message templates |
All data stored in Business Central follows your existing BC data protection and backup policies.
Data Retention
Simple Agent Designer does not automatically delete data. The following data persists until manually removed:
- Workloads and child workloads remain until deleted by a user
- Process Activity records remain until the associated workload is deleted
- Agent Work entries remain until manually cleaned up
- API keys remain in the AI Provider table until changed or removed
Consider implementing a regular review process for:
- Old workloads and their activity logs
- Agent Work entries that are no longer needed
- Processed results that may contain sensitive information
Recommendations for Data Privacy
Minimize Data Exposure
- Use specific instructions — tell agents exactly what data to request rather than allowing open-ended data exploration
- Limit tool access — only enable tools on agents that genuinely need to access BC data
- Use filters — when configuring DataBased workload types, apply the narrowest possible filters
- Review activity logs — regularly check what data agents are sending to AI providers
Choose the Right Provider
| Privacy Requirement | Recommended Provider |
|---|---|
| Data must not leave your network | LM Studio (local) |
| Data must stay in your Azure tenant | Azure OpenAI |
| Standard commercial confidentiality | ChatGPT OpenAI or Anthropic (both offer API data usage policies) |
| Regulatory compliance (GDPR, HIPAA, etc.) | Consult your compliance team and review provider certifications |
Protect API Keys
- API keys are stored in the Business Central database
- They are masked on the UI but stored as plain text in the table
- Restrict access to the AI Provider setup page to administrators only
- Rotate API keys periodically
- Never share API keys in workload descriptions or agent instructions
Audit and Compliance
- Use Process Activity logs as an audit trail for AI-initiated actions
- Use Agent Work entries to track what documents agents created
- Use Workload Links to trace documents back to their AI source
- Retain activity logs as long as your compliance requirements dictate
Data Processing Agreement
If your organization requires a Data Processing Agreement (DPA) for the use of AI services, contact:
- Your AI provider(s) (OpenAI, Anthropic, Google, Microsoft, or any other vendor your agents use) for their DPA terms
- Hougaard for any additional data processing terms related to the extension itself