Legal

Privacy policy

Last updated 9 November 2026.

The short version

We read your Microsoft 365 directory to show you an audit, and we don't store it. No database, no tracking cookies, no marketing lists.

What we access

When you connect, you approve read-only Microsoft Graph permissions for:

• User accounts: names, email addresses, departments, job titles, whether each account is enabled, and assigned licences.
• Licence subscriptions: what your organisation has bought and how many are assigned.
• Usage reports: the last date each person used email, Teams, SharePoint, OneDrive, the Office desktop apps and Copilot in the past 90 days, and mailbox sizes.
• Connected apps: which outside apps people have signed in to with their Microsoft account, and the permissions those apps were given.
• Sign-in dates: when each account and guest last signed in, where your Microsoft plan includes this.
• Subscriptions: renewal dates and whether a licence is a trial.

What we keep

• Your Microsoft access token is stored encrypted in a cookie in your own browser and expires after about an hour. Disconnecting deletes it straight away.
• Directory data is fetched when you view the audit, used to build the page, and then discarded.
• Employee lists you upload are read once to do the comparison and then discarded.
• Prices you type in are saved in your browser's local storage and never sent to us, except alongside a comparison request so the totals use your prices.
• Server logs may record errors and request details for troubleshooting, kept for a short period by our hosting provider.

Cookies

We only use strictly necessary cookies: one holding your encrypted Microsoft access token, and one short-lived cookie that protects the sign-in process.

Your choices

You can disconnect at any time from the header. A Microsoft 365 admin can also remove the app entirely in Microsoft Entra admin centre → Enterprise applications.