Privacy Policy.

1. Data controller

The controller responsible for data processing in connection with the Service is:

Managing Director: Ugur Koc
Email: support@ugurlabs.com

2. Website

The website is hosted on Vercel. When you visit it, our hosting provider processes request data such as your IP address, the requested page, the time of the request and your browser’s user agent in order to deliver the site and keep it secure.

• We do not use analytics, tracking or advertising on kairavo.com.
• The website sets no cookies.
• The website saves no new data in your browser’s local or session storage. Data that earlier versions of the website saved there stays in your browser and is never sent to us. You can remove it by clearing your browser’s site data.

3. Private preview waitlist

The waitlist uses double opt-in. When you enter your email address, we send one confirmation email to it through our email provider Resend. The email contains a link that is valid for 7 days and carries your address in signed form, so we do not store your address while we wait for your confirmation. Opening the link shows a confirmation page; your address is added only when you select Confirm my email there.

When you confirm, your address is stored as a contact in our waitlist at Resend together with a record of your consent: the time you confirmed and the version of the signup text you agreed to are recorded when you confirm. Confirming an address that is already recorded does not change the record. We may also receive a notification with your address in our own mailbox. If you do not confirm, your address is not added to the waitlist and we do not store it. It then remains only in Resend’s records of the confirmation email it delivered and, if the link was opened, in our hosting provider’s request logs, under their retention.

We use your address only to invite you to the private preview and to send you information about it. Every email we send to the waitlist has an unsubscribe link.

To limit abuse, the website keeps short lived attempt counters keyed by a hash of your IP address or email address. They expire after at most one hour, are held only in the memory of the server handling the request and are not stored.

4. Community keys

When you request a free Community key, we store your email address, the time of your consent, the source of the request and a hash of the key. The key itself is not stored by us. Resend delivers the key to your email address. To limit abuse, we store hashed, keyed fingerprints derived from your IP address and email address, never the raw values, for up to three days.

When you activate a Community key, we store a random installation ID, the Microsoft Entra tenant ID, your operating system and the app version.

5. Desktop app

Kairavo for Windows and macOS collects Intune and Entra data on your own computer. It signs in to Microsoft directly, as a public client without a secret, through an Entra app registration in your own tenant, and calls Microsoft Graph directly from your machine. There is no Kairavo proxy or relay in between.

• Your tenant data, Microsoft access and refresh tokens and the data the app collects never reach our infrastructure.
• Collected data, change history, reports and automation runs are stored in a database on your computer that accepts connections from that computer only.
• The app keeps its token cache, license key and settings in an encrypted store protected by the operating system (DPAPI on Windows, Keychain on macOS).
• The app contains no telemetry, analytics or crash reporting. Its logs stay on your computer. A diagnostics export is a file you save yourself, and it reaches us only if you send it to us.
• If you connect the app to services you choose, such as an AI model provider, alert delivery, a ticketing system, a hardware warranty service, a Git host or a script catalog on GitHub, the app sends data from your computer directly to that service. We are not involved in that transfer, and those services process the data under your agreement with them.

The only Kairavo server the app contacts is our licensing service, described in the next section.

6. License checks

To check your plan, the app contacts our licensing service at kairavo.com when you activate a key, when you sign in to or remove a tenant, when the app starts after more than a day, when you choose Check now, about every six hours while it runs, and when you deactivate an installation. Depending on the request, the licensing service receives:

• your license key, or no key when your organization shares its license with your tenant;
• a random installation ID generated by the app, which identifies the installation and not you or your device hardware;
• the Microsoft Entra tenant ID being licensed;
• when the app activates or refreshes a key, or has no valid key for a tenant, the client ID of the Entra app registration you signed in with and a short lived Microsoft sign-in token (ID token) as proof of the tenant and app registration you signed in to. We use them only to share a paid license with the tenant or to check whether the tenant has a shared license, and ignore them for Community keys. The token contains identity claims such as your name and user principal name. We verify it with Microsoft’s public signing keys, use only its tenant ID and the ID of the app registration it was issued to, and do not store it;
• your operating system and the app version;
• for refresh and deactivation requests, the ID of the activation;
• your IP address, which is processed at the request level by our hosting provider and used transiently to limit request rates.

What we store: each activation of a paid key (installation ID, tenant ID, operating system and app version) is recorded with the license key in Polar, our merchant of record. This includes the installations of other administrators who use a license shared with their tenant, which the key holder can see in the Polar customer portal. Community activations are stored in our own database as described above. When a paid license key is activated while signed in to a tenant, the license is shared with that tenant by default, and we store the tenant ID, the client ID of the app registration and the Polar IDs of the license key, its plan and the sharing activation, never the key itself, in our own database.

Purpose: we use this data only to validate your license, to enforce the tenant limits of your plan, and to let other administrators who sign in to a tenant through the shared app registration use a license that its key holder shares with the tenant. The service answers with a signed entitlement that lets the app keep working offline for up to 30 days.

7. Updates

Unless you turn off automatic updates in the app’s settings or by policy, and while at least one tenant holds a valid license, the app reads the public release feed of the Kairavo desktop repository on GitHub 15 seconds after it starts and every six hours, and downloads installer files from GitHub. These requests contain no tenant data and no tokens. GitHub receives standard request data such as your IP address and processes it under its own privacy policy.

8. Purchases through Polar

Polar Software Inc. acts as merchant of record for Kairavo subscriptions. Polar processes payments, invoices, taxes and license keys, and receives your billing details directly when you purchase, under its own privacy policy. You manage your subscription, invoices and installations in the Polar customer portal.

9. Contacting us

When you email us, for example for support or a security report, we process your email address, your message and any details or files you include in order to answer you. Do not send access tokens, client secrets, passwords or unredacted tenant exports by email.

10. Service providers

• Vercel Inc. hosts the website and the licensing service and processes request data such as IP addresses on our behalf.
• Resend delivers waitlist confirmation emails, waitlist notifications and Community keys, stores the waitlist contacts and processes email content and metadata.
• Supabase Inc. hosts the database that holds Community key requests, consent records, rate-limit fingerprints and licenses shared with a tenant.
• Polar Software Inc. is the merchant of record for purchases and stores license keys and activations.
• GitHub delivers app updates that the app downloads directly.

We do not sell your personal data or share it with third parties for their own marketing. A data processing agreement is available on request.

11. Legal bases

• Consent (Art. 6(1)(a) GDPR): the private preview waitlist, which you give by confirming your address through the double opt-in. You can withdraw your consent at any time with the unsubscribe link or by email, without affecting the lawfulness of processing before the withdrawal.
• Performance of a contract (Art. 6(1)(b) GDPR): Community keys, license checks, organization licenses, purchases and answering your requests.
• Legitimate interests (Art. 6(1)(f) GDPR): hosting and securing the website and services, request rate limiting, update delivery, and sending the confirmation email so that only the owner of an address can add it to the waitlist and we can show that they did.
• Legal obligations (Art. 6(1)(c) GDPR): where we must keep records, for example under tax law.

12. Data retention

• Waitlist addresses and their consent records are kept until you unsubscribe or ask us to delete them, and no longer than needed for the private preview. Addresses that are never confirmed are not stored by us; the confirmation link stops working after 7 days.
• Community key records, the email address and consent record of the request, and the key’s activations are kept while the key is in use. You can ask us to delete them at any time.
• Activations of paid keys are stored with your license key in Polar for the lifetime of your subscription. You can remove an activation at any time by deactivating the installation in the app or in the Polar customer portal.
• A license shared with a tenant is stored until the license ends or you ask us to remove it.
• Microsoft ID tokens are not stored. Waitlist and license service rate limits are kept only in the memory of the server handling the request. Community key rate-limit fingerprints are deleted after up to three days.
• Request logs are retained within our hosting provider’s systems according to its log retention.
• Billing records are kept by Polar under its own privacy policy and applicable retention obligations.
• We do not retain your tenant data.

13. International transfers

Some of our service providers are based in the United States and may process data outside the European Economic Area. Where this happens, it is protected by appropriate safeguards such as the EU Standard Contractual Clauses.

14. Your rights

Under the GDPR you have the following rights regarding your personal data:

• Right to access: request a copy of the personal data we process about you.
• Right to rectification: request correction of inaccurate personal data.
• Right to deletion: request that we delete your personal data.
• Right to restriction: request that we restrict the processing of your personal data.
• Right to data portability: receive the data you provided to us in a structured, machine readable format.
• Right to object: object to processing based on our legitimate interests.
• Right to withdraw consent: withdraw consent you have given, with effect for the future.

If you are located in California, you may also have rights under the CCPA. We do not sell or share personal information. To exercise your rights, contact us at the email below.

15. Supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state of your habitual residence, your place of work or the place of the alleged infringement (Art. 77 GDPR).

The supervisory authority responsible for us is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Düsseldorf.

16. Children’s privacy

The Service is intended for professional and enterprise use and is not directed to children.

17. Changes

We may update this policy to reflect improvements or operational changes. If we make material changes, we will update the date above.

18. Contact

Questions about this policy or requests about your data? Contact us at support@ugurlabs.com. Report security issues to security@ugurlabs.com.

You can also reach us by post: Ugurlabs UG (haftungsbeschränkt), Fährstraße 217, 40221 Düsseldorf, Germany.