Privacy Policy

Last updated: 27 October 2026 · ICO Registration: ZC142994

Summary: We collect only what we need to operate the service. We store your Azure scan data in the EU (Cloudflare's European Union jurisdiction). We do not sell your data. We use Anthropic's API to generate AI observations. It receives your infrastructure data and any text you type into the What If chat, as written. It never receives your email address, your name or your Azure access tokens. Section 5 has the detail.

1. Data controller

AZClarity is a trading name of Bennett AI Tech Ltd, a company registered in England and Wales, company number 17208567, at 24 Cheadle Road, Cheadle Hulme, Cheadle, Cheshire, SK8 5EW. We operate the AZClarity platform at azclarity.com. For data protection purposes, we are the data controller. We are registered with the Information Commissioner's Office (ICO) under registration number ZC142994. You can verify this at ico.org.uk. Contact us at support@azclarity.com.

2. What data we collect

Account data: Your email address, display name, and company name (from your Microsoft identity when you sign in). We use this to identify your account and send service emails.

Azure subscription data: Resource types, counts, regions, and SKU metadata from your Azure subscription. We do not collect resource names, tags, or configuration values beyond what is necessary to identify service types.

Access tokens: Azure OAuth access and refresh tokens, encrypted with AES-256-GCM, stored to enable scheduled scans without requiring you to re-authenticate.

MSP client-tenant data (MSP plan only): When an MSP connects a client's Azure tenant, AZClarity reads that client's Azure resource metadata (resource types, counts, regions, SKU and configuration metadata) using AZClarity's own read-only application identity, after the client has granted admin consent and assigned the Reader role. We never read customer content or data held inside those resources — only configuration and inventory metadata needed for the assessment. For this data the MSP is the data controller and AZClarity acts as a data processor on the MSP's instructions; the MSP is responsible for having a lawful basis and appropriate agreement with their client.

Usage data: Scan timestamps, AI call counts, and session activity. Used to enforce rate limits and detect abuse.

Payment data: Billing is handled by Stripe. We store only your Stripe customer ID — no card details are held by AZClarity.

3. Legal basis (UK GDPR)

Contract performance — processing necessary to deliver the service you subscribed to
Legitimate interests — security monitoring, abuse prevention, service improvement
Legal obligation — where required by law

4. How we use your data

To authenticate you and manage your subscription
To scan your Azure subscription and generate coverage reports
To generate AI observations using Anthropic Claude (infrastructure data and the text you type into What If chat; see section 5)
To send service emails (scan complete, payment, account notifications)
To detect and prevent fraud and abuse

5. AI and third-party processing

We use Anthropic's Claude API to generate AI observations. What it receives depends on the feature:

Scan analysis, narratives, change summaries and portfolio views: service types, counts and regions, finding titles, scores, the display names of your subscriptions and, if you set them, your organisation's sector and size band.
Estate map: the above, plus the names of your virtual networks, subnets and peerings.
What If chat: the question you type and the earlier messages in that conversation, exactly as written, together with a summary of the latest scan for that subscription.

We never send your email address, your name or your Azure access tokens to Anthropic. We do not remove personal data from free text or from names: anything you type into the What If chat, and any names you or your colleagues gave to subscriptions, networks or subnets, reaches Anthropic as written. Please do not put personal data in them. We filter text for phrases that look like prompt-injection attempts, and we remove email addresses, GUIDs and key-like strings from Claude's replies before showing them to you.

Anthropic's commercial terms, which incorporate its data processing addendum, state that Anthropic may not train models on this content. No data from one customer is used to generate results for another. What If chat messages and replies are stored in our database and are deleted when you remove the subscription they belong to.

We also use: Stripe (payment processing), Brevo (transactional email), Cloudflare (infrastructure, CDN, D1 database, backup storage) and GitHub (build and backup automation: the nightly database backup passes through a temporary GitHub build server that is discarded when the job ends, and is not stored by GitHub). Where these providers process data outside the UK and EEA they rely on transfer terms in their data processing agreements: Anthropic applies the EU standard contractual clauses with UK and Swiss addenda; Stripe is certified under the EU-US Data Privacy Framework and also incorporates the EU standard contractual clauses and UK transfer terms; Brevo's agreement relies on the EU standard contractual clauses and/or the EU-US Data Privacy Framework. Each also has its own privacy policy.

6. Data storage and retention

All data is stored in Cloudflare's European Union jurisdiction: the database (including its recovery history), session data and backups. Cloudflare's network handles each request at the location nearest the visitor, which can be outside the EU, so data can pass through there in transit. Two things are not held in the EU: AI features send the data described in section 5 of the Privacy Policy to Anthropic in the United States, and the nightly backup passes through a temporary GitHub build server in the United States. Where Cloudflare processes data outside the UK and EEA, it does so under its data processing addendum, which applies the EU standard contractual clauses and the UK International Data Transfer Addendum. Azure tokens are encrypted at rest using AES-256-GCM with per-token key derivation.

Retention periods:

Account data — retained while your account is active, deleted within 30 days of account closure
Scan results — retained for 12 months, then deleted
AI usage logs — metadata only (no prompt content), 90 days
Audit logs — 12 months
Error logs — 90 days (technical records of failures, which can include an email address)
Payment records — 7 years (legal obligation)
Database backups — a nightly copy of the database is kept in private Cloudflare storage, encrypted at rest, for around 14 days and then deleted automatically. Data you delete from your account can remain in these backups until they expire, and in Cloudflare D1's point-in-time recovery history for up to 30 days

7. Your rights (UK GDPR)

You have the right to: access your personal data, correct inaccurate data, request deletion, restrict processing, data portability, and object to processing. To exercise any right, email support@azclarity.com. We will respond within 30 days.

You also have the right to lodge a complaint with the ICO at ico.org.uk.

8. Cookies

AZClarity uses a single session cookie to maintain your login state. We do not use tracking cookies, advertising cookies, or third-party analytics. No cookie consent banner is required as we use only strictly necessary cookies.

9. Security

See our Security page for full details of our technical and organisational security measures.

10. Changes to this policy

We will notify you by email before making material changes to this policy. The date at the top of this page shows when it was last updated.

Contact

Data protection enquiries: support@azclarity.com