What they may do · DPDP §6(4)
What Microsoft does with your data
Microsoft's statement discloses five of the six uses in its own words (its ads wording did not survive our check). Web beacons on other companies' sites, training its AI models including LLMs on your data, biometric sign-in data, sharing with affiliates and vendors, and no fixed retention period.
-
Shares your data with partners
Passed to group companies, advertisers or analytics firms you never chose.
What this costs you. Your number and habits travel to companies you have never heard of and never agreed to. This is the step where the spam calls start.
Show me where they say that
Microsoft’s own policy says “We provide data to Microsoft-controlled affiliates and subsidiaries and to vendors working on our behalf.”
Our summary provides data to Microsoft-controlled affiliates and subsidiaries and to vendors working on its behalf.
-
Follows you onto other websites and apps
Their tracking carries on after you leave, through pixels and SDKs embedded elsewhere.
What this costs you. You get recognised on sites that have nothing to do with them. Closing the app does not close the file.
Show me where they say that
Microsoft’s own policy says “We sometimes place our web beacons on other companies’ websites or ads to help us understand how interactions with Microsoft advertisements lead to actions, such as purchases, or to learn about your activity on partner sites”
Our summary places web beacons on other companies' websites and ads to learn about your activity on partner sites.
-
Keeps your records long-term
Held on after you stop using the service.
What this costs you. Years after you delete the app, the record is still sitting there — and every year it sits there is another year it can leak.
Show me where they say that
Microsoft’s own policy says “Because these needs can vary for different data types and the context of our interactions with you or your use of our products, actual retention periods can vary significantly.”
Our summary states no fixed retention period — actual retention periods can vary significantly.
-
Processes your face or other biometrics
Face matching, liveness checks or similar.
What this costs you. You can change a leaked password in a minute. You cannot change your face. A biometric breach is permanent in a way nothing else is.
Show me where they say that
Microsoft’s own policy says “Biometric data. Unique data about you from specific technical processing related to your physical, physiological, or behavioural characteristics to verify or confirm your identity. For instance, you can use your fingerprint or facial recognition to sign in to your Windows device via Windows Hello”
Our summary collects biometric data — fingerprint or facial recognition — to verify your identity, for example Windows Hello sign-in.
-
Trains AI models on your content
Your photos, messages or activity are used to train machine-learning models.
What this costs you. This one has no undo. Once your content is inside a trained model, no erasure request can lift it back out.
Show me where they say that
Microsoft’s own policy says “As part of our efforts to improve and develop our products, we may use your data to develop, train, and fine-tune our AI models, including large language models (LLMs).”
Our summary may use your data to develop, train and fine-tune its AI models, including large language models.
What the policy does not mention
These are uses Microsoft’s policy is silent on. Silence is not a promise — it means the document does not say, and we do not infer either way.
- Builds an advertising profile of you
Microsoft is one app. How many are on your phone?
Most people carry twenty to forty. Add yours and see the total in one screen — how many share your data, profile you for ads, or follow you across the web. Then take it back from all of them at once.
Manage my data with Saaph.in →Free to check · no account needed · built in India for the DPDP Act
Questions
What does Microsoft do with my personal data?
According to Microsoft's own privacy policy, read on 2026-08-13, it discloses 5 of the six uses we track: shares your data with partners, follows you onto other websites and apps, keeps your records long-term, processes your face or other biometrics, trains ai models on your content.
Can I withdraw my consent from Microsoft?
Section 6(4) of India's Digital Personal Data Protection Act 2023 gives you the right to withdraw consent for processing you agreed to. The Act's substantive provisions commence in stages up to May 2027, so a request made now asks for voluntary compliance and puts the date on record. Processing a company carries out under a legal obligation — such as KYC records the RBI requires — cannot be withdrawn.
Does Microsoft track me for advertising?
Yes — Microsoft's published policy discloses this. The exact sentence it is based on is quoted on this page, with the date we read it and a link to the source.
Every use above is one Microsoft declared in its own published privacy policy, which we
read on 2026-08-13. Quotes are verbatim; the summary beside each one is ours
and is labelled as ours. Nothing here is inferred.
Saaph.in is a DPDP consent and request management platform operated by Ronin Works
Private Limited. It is a communication facilitator, not your legal or authorised
representative. The DPDP Act 2023 commences in stages up to May 2027, so a request
made today asks for voluntary compliance and records the date you asked.
Our privacy policy