1. Who we are
ScopedIQ (“we,” “us”) is currently operated by Corby Bender as an early-access product. Contact us at corby.bender1976@gmail.com with any privacy question.
2. What we collect
- Account data: your email address and authentication credentials, handled by our authentication provider (Supabase Auth). We never see or store your plaintext password.
- Tenant configuration signals: when you connect a client's Microsoft 365 tenant, we read configuration and metadata via Microsoft Graph — MFA registration status, conditional access policy settings, sign-in logs (for legacy-authentication detection), directory role assignments, and guest account presence.
- Billing data: if you subscribe, payment details are collected and processed directly by Stripe — we never store full card numbers.
- Waitlist/contact data: if you join our waitlist, we store the email address you provide.
3. What we deliberately do not collect
We never request Microsoft Graph permissions that would let us read email content, file content, chat messages, or any other substantive client data. Our Graph access is read-only configuration/metadata only — we never request write/modify permissions on your connected tenants.
4. How we use your data
- To operate the scan pipeline and generate your security posture score and findings
- To generate the branded PDF reports you export
- To bill your subscription, if applicable
- To send you product, billing, or security-relevant emails
We do not sell your data or your clients' data to third parties.
5. Third-party subprocessors
- Supabase — database hosting and authentication
- Netlify — application hosting
- Microsoft Graph API — the source of connected-tenant configuration signals
- Stripe — payment processing
- Resend — transactional email delivery
6. Data isolation and retention
Each consultant account's tenant connections, scans, and findings are enforced as isolated at the database row-security layer — never visible to another consultant's account. Scan history is retained on a rolling window tied to your subscription tier (60 days on Standard, indefinite on Pro), with data past its retention window archived and then deleted after a short grace period.
7. Your rights
You can disconnect any client tenant at any time, which revokes our access to it. You can request export or deletion of your account data by emailing corby.bender1976@gmail.com.
8. Changes to this policy
We'll update the “last updated” date above if this policy changes materially, and will notify active subscribers by email.