Legal

Privacy policy

Last updated 9 November 2026.

The short version

We read your Microsoft 365 directory to show you an audit, and we don't store it. No database and no marketing lists. Analytics only runs if you agree to it.

What we access

When you connect, you approve read-only Microsoft Graph permissions for:

• User accounts: names, email addresses, departments, job titles, whether each account is enabled, and assigned licences.
• Licence subscriptions: what your organisation has bought and how many are assigned.
• Usage reports: the last date each person used email, Teams, SharePoint, OneDrive, the Office desktop apps and Copilot in the past 90 days, and mailbox sizes.
• Connected apps: which outside apps people have signed in to with their Microsoft account, and the permissions those apps were given.
• Sign-in dates: when each account and guest last signed in, where your Microsoft plan includes this.
• Subscriptions: renewal dates and whether a licence is a trial.

What we keep

• Your Microsoft access token is stored encrypted in a cookie in your own browser and expires after about an hour. Disconnecting deletes it straight away.
• Directory data is fetched when you view the audit, used to build the page, and then discarded.
• Employee lists you upload are read once to do the comparison and then discarded.
• Prices you type in are saved in your browser's local storage and never sent to us, except alongside a comparison request so the totals use your prices.
• Server logs may record errors and request details for troubleshooting, kept for a short period by our hosting provider.

Analytics (only with your consent)

If you choose "Accept analytics", we use our own Second Shadow analytics to understand how the site is used. It records the pages you visit, how you arrived, page performance, clicks on links and, when you submit a form with no password field, the email address, name and phone number entered in it. Your audit results and anything you upload for the employee comparison are excluded.

Cookies and analytics

• Essential (always on): a cookie holding your encrypted Microsoft access token, a short-lived cookie that protects the sign-in process, and a cookie (smos_consent) that remembers your cookie choice for a year.
• Analytics (only if you accept): Second Shadow analytics stores a random visitor ID in your browser's local storage (_ss_vid) and records the information described above.
• Preferences: your light or dark mode choice and any prices you type in are kept in your browser's local storage.

If you choose "Essential only", analytics isn't loaded at all. You can change your mind at any time using "Cookie settings" at the bottom of every page. We don't use advertising cookies.

Your choices

You can disconnect at any time from the header. A Microsoft 365 admin can also remove the app entirely in Microsoft Entra admin centre → Enterprise applications.