Privacy Policy — Eclor Waterfall
In one sentence: Eclor Waterfall collects, transmits, stores and shares no data — it runs entirely inside the Power BI sandbox, and the Publisher never sees your data or anything about you.
1. Publisher
Eclor Waterfall (the "Visual") is published by ECLOR (the "Publisher"), a company registered in France.
- Contact: contact@eclor-data.com
2. About the Visual
The Visual is a Power BI custom visual distributed through Microsoft AppSource. It runs exclusively inside the sandbox iframe provided by the Power BI host (Power BI Desktop, Power BI Service, Power BI Mobile, Power BI Embedded). Its sole function is to render the data already present in the user's Power BI report as an SVG chart.
3. Core commitment: no data collection
The Publisher has access to no data from the report and no information about the user. No data is collected, transmitted, stored, shared, sold, or rented to any third party — by the Visual or by the Publisher — under any circumstance.
In concrete terms, the Visual does none of the following:
| Category | Guarantee |
|---|---|
| Outbound network traffic | No fetch, XMLHttpRequest, WebSocket, EventSource, navigator.sendBeacon, Worker, nor any external resource load (CDN, image, script, font). |
| Persistent client-side storage | No use of localStorage, sessionStorage, indexedDB, document.cookie, Cache API, BroadcastChannel. |
| Third-party telemetry | No SDK such as Google Analytics, Mixpanel, Amplitude, Sentry, Datadog, LogRocket, FullStory, Segment, or equivalent. No tracker, no pixel. |
| Fingerprinting | No reading of navigator.userAgent, navigator.platform, navigator.languages, screen.*, Date.getTimezoneOffset(), WebGLRenderingContext, AudioContext, RTCPeerConnection, or any other signature intended to identify the user or their device. |
| Cookies | No cookie, first-party or third-party, is read or written by the Visual. |
| Outbound export | No call to host.exportContent, host.fileDownload, host.launchUrl, nor to any other Power BI host API that would let data leave the sandbox. |
| Elevated privileges | The manifest capabilities.json declares "privileges": [] — the Visual requests no extended privilege (no WebAccess, no ExportContent, no LocalStorage). |
4. Report data
Power BI report data reaches the Visual through the official Microsoft API (VisualUpdateOptions.dataViews). That data is only:
- transformed in memory to compute the chart layout,
- rendered as SVG nodes inside the sandbox iframe DOM,
- shown in native Power BI tooltips (
host.tooltipService).
The data never leaves the sandbox iframe. It is not logged, serialized, or transmitted to any third party. It remains under the exclusive control of Microsoft (as the operator of Power BI) and of the user (as the owner of the report).
5. GDPR compliance
The Publisher carries out no processing of personal data within the meaning of Article 4(2) GDPR through the Visual. As a result:
- No record of processing activities (Article 30 GDPR) is required for this Visual.
- No legal basis (Article 6) needs to be invoked, since there is no processing.
- No Data Processing Agreement (DPA) between the Publisher and the user is required.
- The Publisher is neither controller nor processor in the GDPR sense for the data displayed in the Visual.
The user remains responsible for the GDPR compliance of their Power BI report as a whole (data quality, retention, data-subject rights). Using the Visual does not change this responsibility.
6. Security
The Visual follows the Microsoft Power BI Custom Visual SDK security requirements:
- No use of
eval,new Function,innerHTML,outerHTML,document.write,insertAdjacentHTML. - All textual values originating from the user are escaped before being injected into SVG attributes or text nodes.
- All colour values are validated against a strict pattern before being injected.
- The code is shipped under strict TypeScript (
strictNullChecks,noImplicitAny).
7. Settings persistence
The formatting choices the user makes in the Format pane (colors, fonts, Cumulative/Comparison mode, pillar marking, conditional "fx" color rules, analysis-table options, etc.) are persisted by Power BI itself inside the report definition (the .pbix file, or the report artifact on the Power BI Service), through the host's official persistence API.
- This persistence is handled entirely by Microsoft; the Visual only writes these configuration objects via the host API. It writes nowhere else.
- These settings are never transmitted to the Publisher or any third party, and contain no report data — only display preferences.
- When a report is published to the Power BI Service, these settings travel with the report and stay within the user's Power BI tenant, under Microsoft's and the user's organization's governance. The Visual adds no extra storage or transfer.
8. Changes
The Publisher may update this policy. The current version is always available at this page's URL, which is also the URL provided in the Visual's AppSource listing. The "Last updated" date at the top of this document is authoritative.
9. Contact
For any question regarding this policy: contact@eclor-data.com.