Controller for your account data: Layer Systems Ltd. For the data read from your tenant we act as your processor under the data processing terms.
Where you grant licence access, the report names the people in your tenant who hold licences and when they last signed in or used each workload, so that licences can be reclaimed. For that data you are the controller and we are your processor under the data processing terms. It is read for licence decisions, not for monitoring individuals; no decision about anyone is made automatically; and telling your staff how it is used is your responsibility as their employer.
To produce the report you asked for, to show you a preview, to unlock it after payment, to compare later scans with earlier ones, and to check a later bill for savings you took. Legal basis: performance of the contract with you, and our legitimate interest in keeping the service secure and improving it.
Data is stored on infrastructure operated by Layer Systems Ltd in Microsoft Azure (North Europe (Ireland)). Report files are deleted 90 days after a scan finishes; the newest report for a tenant on a plan is kept so the next scan can be compared with it. Deleting a scan, unlinking a tenant or deleting your account removes the related data at once. Ledger figures (amounts recovered, without any personal data) and purchase records are retained as required for accounting. Product analytics records are deleted after 730 days, and detached from your account the moment you delete it.
One cookie: the session cookie that keeps you signed in and protects forms against forgery. It is strictly necessary, lasts 14 days or until you sign out, and is not used to track you. There are no analytics, advertising or third-party cookies; payment happens on Stripe's own pages under Stripe's notice.
Microsoft (sign-in and the tenant data you authorise us to read), Google (sign-in), Stripe (payments), the transactional email relay we configure (your address and the report summary). No advertising, no resale of data. Stripe and some email providers process data in the United States under their data processing terms, which include the EU standard contractual clauses and the UK addendum; the list with each provider's role and safeguard is in the data processing terms.
None. Nothing in the service makes a decision with legal or similarly significant effect on anyone; every recommendation is reviewed and acted on by you.
Access, correction, deletion, restriction, objection and portability: the Account page lets you download everything the account holds as JSON and delete everything; each report's JSON export is the report in portable form. For anything else contact the operator. You can complain to the Information Commissioner's Office (ico.org.uk).