Privacy Policy

1. Who we are

ScopedIQ (“we,” “us”) is currently operated by Corby Bender as an early-access product. Contact us at corby.bender1976@gmail.com with any privacy question.

2. What we collect

• Account data: your email address and authentication credentials, handled by our authentication provider (Supabase Auth). We never see or store your plaintext password.
• Tenant configuration signals: when you connect a client's Microsoft 365 tenant, we read configuration and metadata via Microsoft Graph — MFA registration status, conditional access policy settings, sign-in logs (for legacy-authentication detection), directory role assignments, and guest account presence.
• Billing data: if you subscribe, payment details are collected and processed directly by Stripe — we never store full card numbers.
• Waitlist/contact data: if you join our waitlist, we store the email address you provide.

3. What we deliberately do not collect

We never request Microsoft Graph permissions that would let us read email content, file content, chat messages, or any other substantive client data. Our Graph access is read-only configuration/metadata only — we never request write/modify permissions on your connected tenants.

4. How we use your data

• To operate the scan pipeline and generate your security posture score and findings
• To generate the branded PDF reports you export
• To bill your subscription, if applicable
• To send you product, billing, or security-relevant emails

We do not sell your data or your clients' data to third parties.

5. Third-party subprocessors

• Supabase — database hosting and authentication
• Netlify — application hosting
• Microsoft Graph API — the source of connected-tenant configuration signals
• Stripe — payment processing
• Resend — transactional email delivery
• Google Analytics — website usage analytics (see below)

6. Analytics & cookies

We use Google Analytics on our public website (not inside the logged-in dashboard's application data) to understand which pages get read and how visitors find the site — standard page-view and referral analytics, not used to identify you individually. Google Analytics sets cookies in your browser to do this. You can opt out at any time using the Google Analytics opt-out browser add-on or your browser's cookie/tracking-protection settings.

7. Data isolation and retention

Each consultant account's tenant connections, scans, and findings are enforced as isolated at the database row-security layer — never visible to another consultant's account. Scan history is retained on a rolling window tied to your subscription tier (60 days on Standard, indefinite on Pro), with data past its retention window archived and then deleted after a short grace period.

8. Your rights

You can disconnect any client tenant at any time, which revokes our access to it. You can request export or deletion of your account data by emailing corby.bender1976@gmail.com.

9. Changes to this policy

We'll update the “last updated” date above if this policy changes materially, and will notify active subscribers by email.