Data processing terms

These terms apply where AfterOK ("the processor") processes personal data on behalf of your organisation ("the controller") in providing Spendlint, and are intended to meet Article 28 of the UK GDPR and, where it applies, the EU GDPR.

Subject matter and duration

Reading the controller's Azure subscriptions and Microsoft 365 tenant to produce cost reports, for as long as the controller keeps a tenant linked or a report stored.

Nature and purpose

Collection, storage and analysis of tenant configuration, metrics, billing and licence data, and the production of reports for the controller. No other purpose, no sale or sharing for advertising. No automated decisions about individuals are made: the service classifies licensed accounts by observed use (sign-in and activity dates) so the controller can decide about licences; the controller is responsible for its lawful basis, for informing its staff and for any impact assessment, and the processor assists on request.

Personal data and data subjects

Data subjects are the controller's staff and other account holders in its tenant. Personal data is limited to what Microsoft returns for licence analysis: display name, user principal name, licence assignments, account state, last sign-in date and last-activity dates from usage reports; plus the name and email address of the controller's own users of the service. No special-category data is sought.

The processor will

process personal data only on the controller's documented instructions, which are: to produce the reports the controller requests, and to compare later scans with earlier ones;
request read-only permissions and never write to the controller's tenant;
ensure staff with access are bound by confidentiality;
keep credentials encrypted at rest, serve everything over TLS, hold data in Microsoft Azure in the region stated in the privacy notice, and keep access to the smallest set of people needed;
delete report data 90 days after a scan, or sooner when the controller deletes a scan, unlinks a tenant or deletes its account, and delete or return all personal data at the end of the service unless law requires retention;
assist the controller with data-subject requests and with security, breach-notification and impact-assessment obligations, and notify the controller without undue delay, and in any event within 72 hours of becoming aware of a personal data breach affecting its data, with the information Article 33(3) requires as it becomes available;
engage a sub-processor only under written terms no less protective than these, remain liable to the controller for the sub-processor's performance, and give the controller notice of any intended change to the list below with 30 days to object;
tell the controller immediately if, in the processor's opinion, an instruction infringes the UK GDPR, the EU GDPR or other data protection law;
make available the information needed to demonstrate compliance and allow audits by the controller or an auditor it mandates, on reasonable notice;
not transfer personal data outside the UK or EEA except to the sub-processors listed below under appropriate safeguards (UK IDTA or addendum, or EU standard contractual clauses).

Sub-processors

Entity	Where	What it does	Safeguard
Microsoft Ireland Operations Ltd / Microsoft Corporation	EU (North Europe (Ireland))	Hosting of the service and its data; the Azure and Microsoft 365 APIs the controller authorises	Microsoft's data protection addendum; EU hosting, covered by the UK's adequacy regulations for the EEA
Stripe Payments Europe Ltd / Stripe, Inc.	Ireland / United States	Payments and invoices; receives the controller's billing contact only	Stripe's data processing agreement, with the EU standard contractual clauses and the UK addendum
Resend, Inc. (United States)	As stated by the provider	Delivery of report-ready, digest and billing emails; receives recipient addresses and the report summary	The provider's data processing terms with standard contractual clauses where data leaves the UK or EEA
Anthropic, PBC	United States	Two things. The narrative on every report, written from a brief of totals, finding titles and counts, and the subscription and tenant names. An answer to a question a reader types on their own report, sent only when someone asks, from a brief that also carries the question itself and the resource names, types, verdicts and monthly costs behind the findings. Neither brief carries a person's name, a finding's evidence, the contents of anything, or any credential	Anthropic's commercial terms and data processing addendum, with the EU standard contractual clauses and the UK addendum; inputs are not used to train models

Google LLC provides sign-in only, as an independent controller under its own terms; it receives no tenant data. The controller will be told of any intended change to this list and may object within 30 days.

Liability

Each party's liability under these terms is subject to the limits in the terms of service, except where the law does not allow it.