Privacy Policy

This page describes how Erik's ToolBox for Business Central handles data, what external connections it makes, and how your information is protected. Understanding these details helps you make informed decisions about deploying and configuring ToolBox in your environment.

Overview

Erik's ToolBox is designed to operate within the boundaries of your Microsoft Dynamics 365 Business Central environment. The application prioritizes data privacy by keeping your data within Business Central wherever possible and only communicating with external services when you explicitly configure it to do so.

ToolBox is published by hougaard.com. The current version is 3.0.0.0.

Data Collection and Processing

What Data ToolBox Processes

ToolBox processes the following types of data as part of its normal operation:

AL Source Code: The code you write in the ToolBox editor is parsed, compiled, and executed within the Business Central environment. Your code is stored as program records in the Business Central database.
Business Central Table Data: When you execute AL code that reads or modifies records, ToolBox accesses the relevant Business Central tables. The Data Inspector and Batch Processing features also access table data directly.
User Information: ToolBox maintains a user list with access levels for each user. This information is stored in Business Central tables.
Audit Trail Data: ToolBox logs user actions (such as code execution, configuration changes, and user management events) in an audit trail stored within Business Central.
Configuration Settings: Your ToolBox setup is stored in Business Central setup tables. The AI provider configuration (endpoint, access key, model) is stored in the AI Provider table of the AL AI Services app.
AI Conversations: Conversations with the ToolBox Agent and the SQL Agent are stored per user in the AI Conversation table of the AL AI Services app, including your messages, the model's replies, tool results (program source, statement text, table metadata, sample rows, console output), and files you attached. You can review and delete them on the AI Conversations page.

What Data ToolBox Does Not Collect

ToolBox does not independently collect analytics, usage statistics, or tracking data beyond what the Business Central platform itself provides. There is no separate data collection mechanism that reports back to the publisher.

Data Storage

Local Data Storage

All ToolBox data is stored within your Business Central environment using standard Business Central storage mechanisms:

Program records and source code are stored in Business Central tables within your database.
User lists and access levels are stored in Business Central tables.
Audit trail entries are stored in Business Central tables.
Configuration settings are stored in Business Central setup tables.
License keys are stored using Business Central's IsolatedStorage feature, which provides secure per-extension key-value storage that is not accessible to other extensions.

Data Residency

Because all ToolBox data is stored within your Business Central environment, data residency follows the same rules as your Business Central deployment:

SaaS environments: Your data resides in the Microsoft Azure region where your Business Central tenant is hosted, in accordance with Microsoft's data residency policies.
On-Premises environments: Your data resides on your own infrastructure, under your direct control.

ToolBox does not maintain any separate data stores outside of your Business Central environment.

External Connections

ToolBox communicates with external services in specific, well-defined scenarios. Each external connection is described below, along with what data is transmitted and under what circumstances.

License Validation

Service: check.hougaardlicense.com

When it connects: ToolBox contacts the license validation server when you register or validate your license key. This occurs during the initial registration process and periodically to verify that the license remains active.

What is sent: Your license key is transmitted to the validation server for verification. The server responds with the validation status.

What is not sent: No Business Central data, user data, source code, or other application data is sent to the license server.

Your control: This connection is required for production environments. Sandbox environments do not require license validation and can function without this connection. The licensed product codes are 4565, 4570, 4571, and 4572.

AI Agents

Services: One of Azure Open AI, ChatGPT Open AI, Anthropic (Claude), LM Studio, Google Gemini, xAI Grok, Mistral, DeepSeek, Moonshot Kimi, Alibaba Qwen, Zhipu GLM, or MiniMax, depending on your configuration. The calls are made by the AL AI Services app.

When it connects: The ToolBox connects to the configured AI provider each time you send a message to the ToolBox Agent or the SQL Agent, and again for every tool call the model makes while answering.

What is sent: The agent's instructions, your messages, the model's earlier replies, and the results of the tools the model called. Tool results can contain the program or SQL statement in the editor, table and field metadata, sample rows the model requested from your tables, and the console output or execution result of a run. Files you attach in the chat are sent as well. The whole conversation is re-sent with every call.

What is not sent: Your API keys, and any data the model did not request through a tool. The agent has no access to tables beyond what your own permissions allow and only reads rows when it calls the sample-row tool.

Your control: The agents are optional. You configure the provider, endpoint, access key, and model on the AI Providers page and choose which provider the ToolBox agents use. If no provider row is marked for the ToolBox agents, no connections to AI services are made. You choose the provider and are responsible for reviewing its privacy and data handling policies. LM Studio keeps all traffic on your own network.

Program Storage Sync

Services: Azure Blob Storage (*.blob.core.windows.net) or the GitHub API (api.github.com), depending on the configured backend.

When it connects: When Program Storage is configured, ToolBox connects to the chosen backend to push your shared programs (when you save) and pull other environments' shared programs (when you open the ToolBox).

What is sent: The source code of your shared programs is transmitted to the backend — as a blob for Azure Blob Storage, or as individual .al files (plus a small metadata file recording tenant, environment, and nickname) committed to a repository for GitHub. Authentication uses the Azure access key or the GitHub personal token you provide.

What is not sent: Business Central table data is not sent by this feature; only shared program source code and the environment metadata described above. Programs not marked as Shared are not transmitted.

Your control: Program Storage is entirely optional and set to None by default. You choose the backend, the account/repository, and the credentials. The GitHub backend used here is independent of the Data in GitHub feature and can point at a different repository.

GitHub Integration (Data in GitHub)

Service: GitHub API (api.github.com or your GitHub Enterprise instance)

When it connects: ToolBox connects to GitHub when you use the Data in GitHub feature to push or pull table data to or from a GitHub repository.

What is sent: Business Central table data that you select for synchronization is transmitted to GitHub and stored in the specified repository. Authentication is performed using a Personal Access Token that you provide.

What is not sent: Only the table data you explicitly configure for synchronization is sent. No other Business Central data is transmitted.

Your control: The Data in GitHub feature is entirely optional. You configure the GitHub repository, Personal Access Token, and the specific tables to synchronize. You are responsible for securing your Personal Access Token and managing access to your GitHub repository.

Remote Packages

Service: Another Business Central environment (configured by you)

When it connects: ToolBox connects to a remote Business Central environment when you use the Remote Packages feature to transfer data between environments.

What is sent: The table data included in the remote package definition is transmitted between the source and target Business Central environments. Authentication credentials for the remote environment are required.

What is not sent: Only the data defined in the remote package is transferred. No other data is sent.

Your control: Remote Packages are entirely optional. You define the package contents (tables and filters), configure the remote environment connection, and initiate the data transfer. You are responsible for ensuring that the remote environment credentials are valid and that you have the appropriate permissions.

Symbol Downloads

Service: Business Central API

When it connects: ToolBox connects to the Business Central API when you download or refresh symbols for IntelliSense.

What is sent: Standard API authentication credentials are used to request object metadata from the Business Central API.

What is received: Metadata about Business Central objects (tables, pages, codeunits, etc.) is downloaded and cached locally within your Business Central environment.

Your control: Symbol downloads are initiated by you and require appropriate API access permissions.

Telemetry

Application Insights

ToolBox supports integration with Azure Application Insights for telemetry data collection. This integration is optional and follows the standard Business Central telemetry framework.

When active: If your Business Central environment is configured with an Application Insights connection, ToolBox telemetry events may be included in the telemetry data sent to your Application Insights instance.

What is collected: Standard extension telemetry events as defined by the Business Central telemetry framework.

Your control: This integration follows your Business Central environment's telemetry settings. If you have not configured Application Insights for your environment, no telemetry data is collected or transmitted. The telemetry data goes to your own Application Insights instance, not to the publisher.

Credential Storage

ToolBox stores various credentials and authentication tokens as part of its configuration:

Credential	Storage Location	Used For
License key	IsolatedStorage	License validation against `check.hougaardlicense.com`
AI API key	AI Provider table (AL AI Services app)	Authentication with AI providers for the agents
GitHub Personal Access Token	ToolBox Setup table	Authentication with GitHub for Data in GitHub feature
Program Storage credentials (Azure access key or GitHub token)	ToolBox Setup table	Authentication with the Program Storage backend for syncing shared programs
Remote environment credentials	ToolBox Setup table	Authentication with remote BC environments for Remote Packages

Important considerations:

Credentials stored in the ToolBox Setup table are accessible to users with appropriate Business Central permissions. Ensure that access to the setup table is restricted to authorized users.
License keys stored in IsolatedStorage are secured by the Business Central platform and are not accessible to other extensions.
Credentials are only transmitted to their respective services as described in the External Connections section above. They are not sent to the publisher or any other third party.
You are responsible for generating, rotating, and revoking credentials such as API keys and Personal Access Tokens.

User Responsibility

As the user and administrator of Erik's ToolBox, you are responsible for:

AI Provider Selection: Choosing an AI provider for the agents and reviewing that provider's privacy policy and data handling practices. Different providers have different policies regarding data retention, processing, and use of submitted content.
GitHub Token Security: Generating and securing Personal Access Tokens for the Data in GitHub feature. Tokens should be created with the minimum required permissions and rotated periodically.
Remote Credentials: Managing and securing the credentials used for Remote Packages. Ensure that credentials provide only the necessary level of access.
User Access Management: Assigning appropriate access levels to ToolBox users. The Permissions page describes the three access levels and their capabilities.
Data Classification: Understanding what data your ToolBox programs access and ensuring that data handling complies with your organization's policies and applicable regulations.
Network Security: Ensuring that your network configuration allows the necessary external connections while maintaining appropriate security controls.

Audit and Accountability

ToolBox maintains an audit trail of user actions within the application. This feature supports accountability and compliance by providing a record of:

Who performed an action
What action was performed
When the action occurred

The audit trail is stored locally within your Business Central environment and is accessible to users with appropriate permissions. It is not transmitted externally.

Changes to This Policy

The privacy practices described on this page apply to Erik's ToolBox version 3.0.0.0 published by hougaard.com. Privacy practices may be updated in future versions. Review the documentation for your specific version to ensure you have current information.

Questions

If you have questions about how ToolBox handles your data, contact hougaard.com. For technical support, see the Support page.

License Terms -- End User License Agreement details
Setup Overview -- Configuration and settings review
AI Agents Setup -- Configuring AI providers
Conversations -- What is stored about agent conversations
Permissions -- User access levels and management