Privacy Policy

Ugurlabs UG (haftungsbeschränkt)
Fährstraße 217, 40221 Düsseldorf, Germany
Commercial register: Amtsgericht Düsseldorf, HRB 113979
Managing Director: Ugur Koc
Email: support@ugurlabs.com

When you open this website, our hosting provider (Vercel Inc.) processes technically necessary data (IP address, time, page requested, user agent) in server logs in order to provide and secure the service (Art. 6(1)(f) GDPR). The application runs in EU data centers; a data processing agreement including the EU Standard Contractual Clauses is in place with Vercel.

This website uses session cookies for sign-in and workspace selection, and Crisp cookies to maintain support conversations. See our Cookie Policy for details.

For reach measurement we use Vercel Web Analytics, a cookieless method that records only aggregated, anonymized page views (Art. 6(1)(f) GDPR). No cross-device profiles are built and no IP addresses are stored.

You sign in with a Microsoft work or school account through Microsoft Entra ID. There is no other sign-in method and LicenseMeter never sees or stores a password. Microsoft receives the sign-in request: which application is asking (LicenseMeter), the address to return you to, and the three permissions requested (openid, profile, email). Microsoft then authenticates you under your organization’s own rules, including multi-factor authentication.

LicenseMeter receives your display name, your username, your email address where Microsoft releases it, your Microsoft object ID and your tenant ID. Signing in requires no administrator rights and reads nothing in your organization’s Microsoft 365. This data is required to provide the account (Art. 6(1)(b) GDPR).

Microsoft is listed as a subprocessor below. Sessions are then maintained by a first-party, HTTP-only cookie set by LicenseMeter (see our Cookie Policy).

When an organization connects its Microsoft 365 tenant, LicenseMeter processes the following data of the tenant’s users on that organization’s behalf (Art. 28 GDPR): display name, UPN, account status, user type, creation date, license assignments, last sign-in timestamp and the last activity date per service. Mailbox, file or message content is never read; access is technically limited to read-only permissions.

If the organization additionally connects optional connectors, LicenseMeter processes, under the same engagement, the following data as well: member email addresses and product assignments from Adobe, Zoom, Atlassian and Salesforce; console member lists and daily API cost totals from OpenAI and Anthropic; and member lists pasted via CSV from ChatGPT and Claude.

The data is stored in a Postgres database in the EU (Frankfurt region) and is deleted immediately and in full when the workspace is disconnected. Where the organization connects its Microsoft tenant using its own application registration (“bring your own”), the credentials it supplies are stored encrypted (AES-256-GCM) and used solely for the read-only sync; they are never logged or disclosed. A data processing agreement (DPA) is provided to each organization before production use.

The Free plan requires no payment method. Paid plans are bought through Microsoft Marketplace or through Polar, which sells them as merchant of record. Payment details are entered with and processed by those providers; we do not receive or store card details.

Crisp provides the support chat available across our website and dashboard. Loading the chat connects your browser to Crisp and shares technical connection information, including your IP address and the page URL. Messages and contact details you choose to provide are processed to respond to your request. We do not automatically attach your account profile, connector credentials or scan results to the chat.

Resend delivers support form submissions by email. Submission limits and a hidden spam field help prevent abuse. Where enabled, Cloudflare Turnstile additionally verifies submissions. Please do not include passwords, access tokens or tenant exports in support messages.

For details about the chat provider, see Crisp’s privacy policy. Contact support@ugurlabs.com for questions about or deletion of your support conversation.

We engage the following subprocessors to process personal data on your behalf:

• ·Vercel Inc.: Application hosting and content delivery, EU (Frankfurt function region) (EU processing; SCCs for any support access from outside the EU).
• ·Supabase Inc.: Managed PostgreSQL database (primary data store), EU (AWS eu-central-1, Frankfurt) (EU processing; SCCs for any support access from outside the EU).
• ·Microsoft (Microsoft Ireland Operations Ltd. / Microsoft Corporation): Identity platform (sign-in, admin consent) and Microsoft Graph API, EU Data Boundary; US fallback (EU Standard Contractual Clauses (Microsoft Products and Services DPA)).
• ·Resend Inc.: Transactional and notification email delivery, EU (Ireland region) (EU processing; SCCs where applicable).

The current list is part of the DPA.

To be distinguished from these are the source systems named in section 4 (Adobe, Zoom, Atlassian, Salesforce, OpenAI, Anthropic, and the lists pasted via CSV from ChatGPT and Claude): LicenseMeter reads data from them, on the organization’s behalf, on a read-only basis. They are data sources, not subprocessors of LicenseMeter; no personal data is shared with them beyond the authenticated read request.

Account and product data is stored for as long as the workspace is connected. On disconnect, all synchronized data is deleted; remaining copies in routine encrypted backups are overwritten within the backup rotation window (currently around seven days). The hosting provider’s server logs are subject to that provider’s deletion periods.

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR), as well as the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). For data we process on behalf of your organization, please contact your organization as the controller in the first instance.

Privacy questions: support@ugurlabs.com