Privacy Policy

This Privacy Policy explains how Sentsai Inc., a corporation incorporated under the Canada Business Corporations Act, with its registered office in Ontario, Canada ("Sentsai", "we", "us", "our"), collects, uses, stores, and shares personal data when you use our Microsoft 365 licensing audit service.

Sentsai operates in a dual capacity. When you connect your Microsoft 365 tenant and run a scan, your organization is the data controller for the personal data of your employees (Microsoft 365 users), and Sentsai acts as a data processor, processing that data only to provide the contracted service under your documented instructions. The binding terms of that processor relationship are set out in our Data Processing Agreement.

Separately, for data relating to you personally as a platform user (your email address, account activity, and usage of our platform), Sentsai is the data controller and this policy explains how we handle that data. The same applies to visitors of our public website who never sign in, for the website visit data described in section 3(e), and to anyone who asks to join our email list, for the data described in section 3(f).

The distinction matters for your rights and our obligations:

• Your employees' data (Microsoft 365 user data): Your organization controls this data. Sentsai only processes it to run the scan and produce a report. We follow your instructions, retain the data only for the configured period (default 90 days), and delete it on request. The full terms are in the DPA.
• Your personal data as an administrator: Sentsai controls this data. We collected it when you signed in and we use it to manage your account, deliver the service, and communicate with you. The sections below explain our practices in full.

(a) Account data - collected when you authenticate with Microsoft:

• Your Microsoft account email address (user principal name)
• Your display name
• Your Microsoft tenant ID
• The name and email address of the person who runs each scan, recorded for accountability and shown on that scan’s report. Held on the scan record and deleted with it at the end of your retention period.
• A Microsoft OAuth access token - held exclusively in a server-side session store (Redis in production). The browser receives only an opaque, cryptographically random session ID cookie. The access token is never written to the database or sent to the browser.

(b) Microsoft 365 tenant data - retrieved via the Microsoft Graph API during a scan:

• User display names and user principal names (UPNs / email addresses)
• Microsoft internal user object IDs
• License assignment records (which SKUs and service plans are assigned to which users)
• Last sign-in timestamps (interactive and non-interactive)
• Last-activity dates from the Microsoft 365 active-user usage report for Exchange, OneDrive, SharePoint, Teams, Skype for Business and Yammer (Viva Engage), covering the preceding 180 days, and mailbox last-activity from the mailbox usage report
• Account status (enabled or disabled)
• MFA method registration status (whether each user has registered authenticator methods)
• Mailbox storage usage (in bytes)
• Guest account type flags
• Account creation date (retrieved for every account, not only guests)
• Directory role assignments (e.g., Global Admin, Exchange Admin)

(c) Usage and platform data - logged automatically:

• Timestamps of scan requests and report access events
• IP address of requests
• Browser user-agent string
• API endpoint access logs (rotated automatically and capped in size, so older entries are overwritten as new ones arrive; not retained long-term)

(d) Payment data - processed by Stripe on our behalf. We receive from Stripe a payment confirmation and a link to the receipt Stripe issues for that payment, which we store so you can open it from your billing page. If you choose optional automatic renewal, Stripe stores your payment method and creates a customer record, and we hold only Stripe's reference identifiers for them, together with a record of your renewal consent (when you agreed, from which IP address, under which Terms version, and the email address used when the card was saved). If you do not choose automatic renewal, each payment is a one-off charge and we hold no customer record or stored payment method at Stripe. In every case we do not store payment card numbers, CVVs, or bank account details, and we never will - the card is held by Stripe, not by us. Turning automatic renewal off stops any further charge, but it deliberately keeps the saved payment method at Stripe and the consent record, so you can turn renewal back on from your billing page in one click. Erasing your data or deleting your account is what removes these records: the Stripe customer record and the saved payment method are deleted, and the stored receipt links go with them, so the financial record we are required to retain no longer leads back to you.

(e) Website visit data - collected on our public website (the pages you can read without signing in) by optional advertising and analytics tags from Google and Microsoft, only as our Cookie Policy describes: outside the United States, off until you accept; inside it, advertising and analytics tags on unless you reject them; session recording (Microsoft Clarity) off everywhere unless you switch it on. They collect the pages you view and the page that referred you, the ad click identifier if you came from one of our ads, whether you pressed a sign-in, approval or “email your admin” button, browser and device type, cookie identifiers, your IP address (which the providers use to estimate an approximate location) and, for Microsoft Clarity, a recording of your clicks, scrolling and mouse movement with anything you type masked. None of these tags runs in the signed-in app, so none of them receives account data, tenant data or report content. We also keep a record of each cookie choice (a random identifier, the choice, the banner version, whether your browser sent Global Privacy Control, and the time; no IP address) so we can show what was agreed to.

(f) Email list data - collected only if you ask for the sample report by email on our sample report page, tick the consent box (it is never ticked for you), and then confirm by clicking the link in the one confirmation email we send: your email address, stored encrypted; a keyed hash of the address (HMAC-SHA256), used to find your record and to avoid adding you twice; and a record of your consent, made up of the version of the exact wording you ticked, the page you were on, when you asked and when you confirmed. We do not record your IP address or browser for this. Until you confirm, the confirmation email is the only email we send to the address.

(g) Free tenant lookup - when you use the tenant lookup on our website, what you type (a domain, a tenant name or ID, or an Azure subscription ID) is sent from our server to Microsoft’s public sign-in and Azure Resource Manager endpoints, to Microsoft Graph’s tenant information lookup (signed in as Sentsai’s own application, never as you or your organization), and to public DNS to answer the question. If you paste an email address, your browser removes everything before the @ first, so only the domain reaches us. The answer is held in memory for ten minutes so a repeat lookup is quick; the lookup is never written to a database or a log. Your IP address is used only by our rate limiter, in memory, to stop abuse.

We use the data we collect for the following purposes:

• Delivering the service: to authenticate you, connect to your tenant, run a license audit scan, and generate a report with findings and recommendations.
• Security and fraud prevention: to detect and investigate unauthorized access, abuse, or fraudulent activity on our platform.
• Compliance and legal obligations: to maintain audit logs as required by applicable data protection, financial, and security laws and regulations.
• Service improvement: we may use aggregate, anonymized, and de-identified usage statistics about the product (e.g., how many scans are run, average report size) to improve the service. This data cannot be linked back to individual users or organizations. The website analytics and session recordings in section 3(e) are different: they are pseudonymous, tied to a browser rather than a name, and governed by your cookie choice.
• Communications: to provide you with transactional notifications within the product (scan status, report availability, terms updates). Receipts for card payments are issued and emailed to you by our payment processor, Stripe, not by us.
• Email list: if you asked for it and confirmed (section 3(f)), to email you the sample report and then Microsoft 365 licensing tips, currently three of them, about 3, 10 and 30 days after you confirm. We use the address for nothing else, and share it only with Resend, which delivers the email.
• Advertising measurement: if you reach us by clicking one of our online ads, the advertising platform (for example Google or Microsoft) adds a click identifier to the landing-page address. We read that identifier from the address itself or, if you allowed advertising cookies, from the cookie in which the platform’s own tag kept it, and, if you go on to connect your organization’s Microsoft 365 tenant or to purchase a subscription, we report that event back to the advertising platform that sent you, so we can measure how effective our advertising is. We send only the click identifier, which of those two events happened, the fee paid if it was a purchase, and the date. We never send directory data, your organization’s name, or anything about the person who signed in, and we never send anything about an organization that did not arrive from one of our ads. Sentsai itself sets no cookie for this. If you rejected advertising cookies on our website, or your browser sends Global Privacy Control, we send nothing at all, even when the address carried a click identifier.
• Website advertising and analytics: on our public website only, and only as described in our Cookie Policy, Google and Microsoft tags (Google Ads, Microsoft Advertising and Microsoft Clarity, and Google Analytics if we turn it on) help us measure which ads bring visitors, show our ads to people who have visited (remarketing), and see where visitors find the site unclear. Google and Microsoft can combine this with what they know from other websites to personalize the ads you see; you can turn that off with each of them, and with our Cookie settings.

We do not sell your data. The one place information leaves for an advertising company’s own use is the optional website tags in section 3(e), which see only your visits to our public pages and which you can turn off. We do not use your account data or your employees' data for any purpose other than producing your report and operating, supporting, and securing the Service, and we never use it to train machine-learning models. Support access is deliberately narrow: our administrative console is read-only and shows account records (such as the administrator contact email and subscription state), billing records, and de-identified report aggregates. It is built so it cannot display the names or email addresses of the people in your directory, nor the text of any finding. Every administrative view of your account is written to the same tamper-evident audit log you can export, including the identity of the person who looked.

We rely on the following legal bases under Article 6 of the UK GDPR / EU GDPR:

• Contract performance (Art. 6(1)(b)): Processing your account data (name, email, tenant ID, OAuth token) and running the Microsoft 365 scan is necessary to perform the contract you entered into when you accepted the Terms of Service. Without this processing, we cannot provide the service.
• Legitimate interests (Art. 6(1)(f)): Security logging (IP addresses, access timestamps, user-agent strings), fraud prevention, aggregate usage analytics, and measuring the effectiveness of our own advertising (attributing a tenant connection or a purchase to the ad click that led to it, via a click identifier carried in the URL). Our legitimate interest is in operating a secure, reliable service and in understanding which of our marketing works. We have assessed that these interests are not overridden by your interests or fundamental rights.
• Consent (Art. 6(1)(a)): the optional advertising, analytics and session-recording cookies and tags on our public website, and reading a click identifier from those cookies, for visitors in the EEA, the UK and Switzerland, who are asked before anything loads (as Article 5(3) of the ePrivacy Directive and regulation 6 of the UK PECR require). You can withdraw consent at any time from Cookie settings, which does not affect processing that took place before.
• Consent (Art. 6(1)(a)) for the email list: the sample report and licensing tips described in section 3(f) are sent only with your consent, given by ticking an unticked box and confirmed by clicking the link we email you. You can withdraw it at any time with the unsubscribe link in every one of those emails, which does not affect emails already sent.
• Legal obligation (Art. 6(1)(c)): Retaining certain records (e.g., payment records, security logs) for the periods required by applicable law.

Outside the GDPR, Sentsai, as an Ontario company, relies on consent under Canada’s PIPEDA. Visitors in Canada are asked first, as Quebec’s Law 25 requires for tracking technology. For visitors in the United States, advertising and analytics tags rely on notice at the point of collection with an immediate, one-click opt-out (the Reject button, Cookie settings, or Global Privacy Control), and session recording relies on express consent.

Our commercial email is governed by Canada’s Anti-Spam Legislation (CASL) wherever you are. The email list in section 3(f) relies on your express consent under CASL, asked for with our name, postal address and a contact address shown beside the form, and every email it sends identifies Sentsai Inc., gives our postal address and carries a working unsubscribe link.

• Scan findings (employee data): PII fields are automatically nulled after your configured retention period (90 days by default, configurable between 30 and 365 days) by an automated job that runs every 24 hours. You can change the retention period via account settings or PUT /gdpr/retention. You can trigger immediate deletion at any time via DELETE /gdpr/erase. Deletion is permanent and irreversible.
• Account data: retained for the duration of your relationship with Sentsai and deleted within 30 days of account closure or erasure request, unless a legal retention obligation applies (e.g., financial records).
• Aggregate summary figures: for each scan we retain the scan date and three non-personal totals beyond the scan retention period above - the account count, the identified-savings figure, and the compliance-gap count - so you can see your progress over time and so we can personalize the optional re-audit reminder. These are account-level figures about your own licensing (not employee data); they contain no employee personal data, are included in your data export, and are deleted immediately on erasure or account deletion.
• Audit log (action records): action, timestamp, and resource reference fields are retained indefinitely as an immutable audit trail - they are never deleted. The IP address and user-agent string within audit entries are anonymized (set to null) after your configured retention period has elapsed, in accordance with the GDPR storage limitation principle (Article 5(1)(e)).
• Payment records: a transaction record (amount, date, pricing tier, Stripe payment reference, refund status, and a link to the Stripe receipt) is retained for at least 7 years, as required by applicable financial record-keeping regulations. On erasure or account deletion these records are stripped of personal data and de-linked from your account; the resulting de-identified transaction record may be kept beyond that period as a financial record. It contains no employee personal data and no scan findings.
• Website visit data: the optional cookies last as long as our Cookie Policy states for each (from one day to two years) unless you delete them or withdraw consent. What the tags send is held by Google and Microsoft under their own retention rules; Microsoft Clarity keeps session recordings for 30 days unless we mark one to keep. Any advertising audience we create from visitors to our website keeps people for no more than 90 days after their last visit (Google Ads also keeps one audience it creates automatically, of people who reached us from Google Search or a Google ad, for up to 540 days under its own rules; we cannot change it and do not use it to target ads), and set Google Analytics, if we use it, to keep data for two months.
• Cookie choice records: kept for two years, then deleted automatically.
• Email list: a request that is never confirmed is deleted automatically 30 days after it was made. Once you confirm, your address and consent record are kept until you unsubscribe. When you unsubscribe, we immediately delete your address. We keep a keyed hash of it (HMAC-SHA256, from which the address cannot be read back) so it is never emailed by the list again, even if someone enters it on the form later, together with the evidence of the consent you gave: which wording you agreed to, on which page, and when you asked, confirmed and unsubscribed. Canada’s anti-spam law requires us to be able to prove consent for the emails we sent; none of this identifies you without your address. If you want it deleted as well, email privacy@sentsai.com; we will then have no way to stop the address being added again.

We share data with the following sub-processors to deliver the service. We have a Data Processing Agreement or equivalent safeguard in place with each sub-processor.

Advertising platforms. Separately from the sub-processors above, we send conversion data to advertising platforms to which we upload conversion records - currently Google Ads (Google LLC, United States) and Microsoft Advertising (Microsoft Corporation, United States). These are not sub-processors: they do not process data on our instructions, and each acts as an independent controller for its own advertising purposes under its own terms. What we send is the click identifier that brought you to us, the fact that your organization connected its tenant or made a purchase, the fee paid if it was a purchase, and the date. We send this only for organizations that arrived from one of our ads, and we never send directory data, names, email addresses, your organization’s name or anything from a report. That upload happens server to server after the fact. Separately, on our public website only, the same two companies’ tags (and Microsoft Clarity) collect the website visit data described in section 3(e), as our Cookie Policy sets out. For what they then do with it, Google and Microsoft are independent controllers under their own privacy statements; for visitors in the EEA and the UK, Sentsai and each of them are joint controllers of the collection on our pages and its transmission, and Sentsai is your point of contact for that part. Google Analytics, if we turn it on, processes data for us under Google’s data processing terms.

Email communications. We use Resend to send you two kinds of email. Service (transactional) emails, such as report-ready notices and reminders that your subscription is about to expire, are part of the service and are always sent. Receipts for card payments come from Stripe rather than from us. Marketing emails, such as follow-ups after a free scan and occasional reminders that it may be time to re-run your audit, are sent on the basis of our legitimate interest in keeping existing customers informed about a service they have used. Every marketing email includes a one-click unsubscribe link; unsubscribing stops all marketing email while leaving service emails unaffected. If you joined our email list on the sample report page, you also receive the sample report and licensing tips described in section 3(f). Those go only to people who asked for them and confirmed by email, on the basis of that consent, and each carries its own unsubscribe link (one button on the page it opens) and supports the one-click Unsubscribe button in mail apps such as Gmail and Outlook. Either takes effect the moment you use it, well inside the ten business days CASL allows. Apart from the optional website tags in section 3(e), which Google and Microsoft also use for their own advertising and which you can turn off, we never share your data with any third party for that third party's own marketing.

All of our sub-processors are based in the United States, which is outside the UK and EEA. Transfers of personal data to these sub-processors are covered by one or more of the following safeguards:

• The EU-US Data Privacy Framework and UK Extension, where the recipient is certified;
• Standard Contractual Clauses (SCCs) as approved by the European Commission or UK ICO, incorporated into our data processing agreements with sub-processors;
• Other equivalent appropriate safeguards as recognized under applicable data protection law.

The optional website tags described in section 3(e) also send data to Google and Microsoft in the United States. Both companies are certified under the EU-US Data Privacy Framework and its UK Extension and Swiss counterpart.

For visitors and customers in Canada: Sentsai is based in Ontario, and the personal information described in this policy is stored and processed in the United States by the service providers named above. While there, it is subject to United States law and may be accessible to courts, law enforcement and national security authorities of that country.

You may request details of the specific transfer mechanism applicable to any sub-processor by contacting privacy@sentsai.com.

Under the UK GDPR, EU GDPR, and equivalent data protection laws, you have the following rights regarding your own personal data (account data). For rights relating to your employees' data, see our Data Processing Agreement.

• Right of access: request a copy of the personal data we hold about you - GET /gdpr/export
• Right to rectification: request correction of inaccurate or incomplete personal data.
• Right to erasure ("right to be forgotten"): request deletion of your account and all associated data - DELETE /gdpr/erase. For full account deletion: DELETE /account/delete.
• Right to restriction: request that we restrict the processing of your data in certain circumstances.
• Right to data portability: receive your data in a structured, machine-readable format.
• Right to object: object to processing based on legitimate interests.
• Right to withdraw consent, and to opt out of targeted advertising: turn the optional website cookies off at any time from Cookie settings at the bottom of our pages. In the United States, rejecting them (or browsing with Global Privacy Control switched on) opts you out of the use of your visit for targeted advertising. Consent to the email list is withdrawn with the unsubscribe link in any of its emails.

Rights that affect your whole organization - erasure, consent withdrawal, and changing the retention period - require a Microsoft 365 administrator, because a Sentsai account belongs to the tenant rather than to an individual and those actions apply to everyone in it. Access and data export are available to any signed-in user. To exercise any of these rights, use the self-service API endpoints above or contact privacy@sentsai.com. We will respond within 30 days. We may need to verify your identity before processing certain requests.

If you are on our email list but have no account, the self-service endpoints do not apply to you: write to privacy@sentsai.com for a copy or the deletion of your email list record, or simply unsubscribe with the link in any of its emails.

To exercise rights on behalf of your employees (as data controller), use the same self-service endpoints with your administrator credentials, or contact us and we will assist. Note that the erasure endpoint applies to your whole tenant. To delete the data of a single named individual, email privacy@sentsai.com with that user's UPN or Microsoft object ID; we complete it within 30 days by deleting the scan records that contain that individual, and confirm in writing (clause 9 of the Data Processing Agreement).

We implement appropriate technical and organizational measures to protect personal data against unauthorized access, loss, destruction, or alteration, including:

• Encryption in transit using TLS 1.2 or higher for all traffic between your browser and Sentsai and between Sentsai and third-party services; internal component traffic runs on a private network that is not reachable from the internet;
• Field-level encryption at rest (Fernet: AES-128-CBC with HMAC-SHA256 authentication) for scan findings and generated reports - the columns containing your employees' personal data. Account profile fields and audit-log entries are protected by strict access controls, tenant isolation, and automated anonymization rather than field-level encryption;
• Strict row-level access controls ensuring each organization can only access its own data;
• Audit logging of report views and downloads, scan activity, authentication, payment, consent and data-rights actions, recorded at those specific points rather than as a general request log;
• Automatic deletion of scan data after the configured retention period;
• Vulnerability management, dependency patching, and regular security reviews;
• A written confidentiality agreement for any personnel or contractor before they are granted access to personal data, with that access limited to what their role requires, reviewed at least annually, and revoked when it is no longer needed.

If you discover a security vulnerability, please report it responsibly to security@sentsai.com.

Data breach notification. Despite these measures, if a personal data breach occurs we act in line with applicable data protection law. Where we process data on behalf of a customer (as processor), we notify that customer without undue delay and in any event within 72 hours of becoming aware of the breach, so they can meet their own notification duties (see our Data Processing Agreement, clause 10). Where we act as controller of the affected data (for example, account administrator details), we notify affected individuals and the relevant supervisory authority where required by law, without undue delay. In all cases we maintain an internal record of personal data breaches - their nature, effect, and the remedial action taken - as required by Article 33(5) GDPR.

The signed-in app uses only strictly necessary cookies: a session cookie for your authenticated session, a 30-day account-reference cookie, and a short-lived sign-in protection cookie. These cookies are:

• Set as httpOnly - not accessible to JavaScript running on the page;
• Set as Secure - transmitted only over HTTPS;
• Scoped to our domain and not shared with third parties.

Our public website also uses a strictly necessary cookie that remembers your cookie choice, and can use optional advertising, analytics and session-recording cookies from Google and Microsoft. Outside the United States those load only after you accept in our cookie banner; in the United States advertising and analytics cookies load unless you reject them or your browser sends a Global Privacy Control signal, and session recording only if you switch it on. They never run in the signed-in app. Every cookie, what it does and how long it lasts is listed in our Cookie Policy, and you can change your choice at any time from Cookie settings.

For privacy-related questions or to exercise your rights, contact our Data Protection contact:

Email: privacy@sentsai.com

Person in charge of the protection of personal information (Quebec Law 25, s. 3.1): the Chief Executive Officer of Sentsai Inc., 2727 Steeles Avenue West, Unit 103-109, Toronto, Ontario M3J 3G9, Canada, reachable at privacy@sentsai.com.

If you are not satisfied with our response, you have the right to lodge a complaint with your data protection supervisory authority:

• Canada (federal / PIPEDA): Office of the Privacy Commissioner of Canada - priv.gc.ca
• Quebec (Law 25): Commission d'accès à l'information - www.cai.gouv.qc.ca
• California (CCPA/CPRA): California Privacy Protection Agency - cppa.ca.gov
• EU: The supervisory authority in the EU member state where you reside or work.
• UK: Information Commissioner's Office (ICO) - ico.org.uk