Privacy Policy
Effective October 16, 2026
Ebbwater, LLC ("WantNot", "we") operates the licence analysis service at wantnot.ebbwater.net. This policy explains what we handle, why, and for how long.
Two different roles
This distinction determines who is responsible for what, so it comes first.
When you use the Instant Audit, we are neither a controller nor a processor of your directory data, because we never receive it. The audit runs entirely in your browser: it authenticates you against Microsoft directly, calls Microsoft Graph directly, and analyses the result on your own device. No directory data reaches our servers, and there is nothing for us to store, disclose or lose.
When you use the continuous service, you are the controller of your directory data and we are your processor. We act only on your instructions, set out in the Data Processing Agreement.
For our own website and account records we are the controller.
What we handle
Directory data (continuous service only)
Retrieved from Microsoft Graph under permissions your administrator explicitly granted. Every permission is read-only.
| Data | Why we need it |
|---|---|
| User principal name, display name | to tell you *which* person holds an unused licence |
| Account enabled / disabled | a disabled account holding a paid licence is waste |
| Account creation date | so new starters are not flagged as never having signed in |
| Last sign-in timestamps | dormancy detection |
| Licence assignments | to identify what is held and by whom |
| Per-service usage dates | to identify people paying for a bundle they do not use |
| Subscription counts and renewal dates | to identify unassigned seats |
We do not access mailbox contents, files, chats, calendars, passwords, authentication secrets, or any customer data inside your Microsoft 365 services. The permissions we hold cannot reach them.
Data minimisation. The full list of who holds which licence — potentially thousands of records — is stored as keyed cryptographic hashes rather than readable identifiers. Our analysis only needs to test whether a licence is still held, never to read the name back. Readable identifiers are retained only for the specific findings you are being asked to act on.
Account data
Name, email address and organisation for the people who sign in to the dashboard, plus a log of privileged actions taken.
Website data
The marketing site sets no analytics or advertising cookies and does not track visitors across sites. Standard server logs may record IP address and user agent, retained no longer than 30 days.
Legal basis
Where UK or EU GDPR applies: for directory data we process on your instructions as processor, and your organisation determines its own lawful basis. For account and website data our basis is legitimate interest in operating and securing the service, and performance of a contract.
Retention
| Data | Retained |
|---|---|
| Full scan records | 90 days, then automatically deleted |
| Derived comparisons | aggregates for the life of the account, so your trend survives; line-item identities (names, UPNs) removed after 90 days |
| Instant Audit lead captures | 90 days for follow-up, then automatically deleted |
| Telemetry and route logs | 90 days; logs carry hashed references only, never plaintext addresses, UPNs, or prompt bodies |
| Audit log | for the life of the account, plus 12 months |
| Account records | while your account is active, plus 90 days |
| Instant Audit results | never stored |
| Wanda prompts / outputs (external LLM) | P0: not applicable — production sends nothing to external models. If re-enabled, prompts (aggregates only) and outputs are not retained by us; provider retention is governed by the provider's terms (contractually required to be no-training, deleted within documented window — see SUBPROCESSORS.md). Audit log retains only provider name, model, prompt hash, output hash, and grounding result. |
Comparisons are kept when the underlying scans are deleted because they are what makes "what did we recover since March" answerable. They contain identifiers only for line items from the last 90 days; older comparisons keep aggregates (counts, sums) only.
Deletion
You can ask us to delete a connected tenant's data at any time. We remove every scan, comparison and record for it and give you a written receipt of exactly what was deleted.
We keep the audit log entry recording that the deletion happened and who requested it. It contains no directory data from the deleted tenant.
You can also revoke our access yourself, immediately and without involving us, by removing the enterprise application in your own Microsoft 365 tenant. We detect the revocation and stop scanning.
Sub-processors
See sub-processors. We will give notice before adding a new one, so you have the opportunity to object.
QBR Copilot / Wanda: In production the service is deterministic-only — no customer data is sent to any external AI provider. Narratives are generated from data already in storage (shared/agent.py:_fallback_narrate) and are grounding-checked. Any future use of an external model (NVIDIA Integrate API or Azure OpenAI) would send only anonymized aggregates (tenant display names, annualWasteUsd / annualSpendUsd / byKind totals, skuSummary counts, warnings) as assembled by shared/agent.py:build_context — never raw directory data, UPNs, or the HMAC-tokenised assignment roster. That change requires 30 days' notice, per-tenant opt-in, provider-specific labeling in the UI, and contractual retention / no-training terms; see SUBPROCESSORS.md for the full re-enablement checklist.
Where data is held
Currently the United States (Azure West US 2). If your organisation requires data to remain in a specific region, tell us before you connect a tenant — we would rather decline than misrepresent this.
Security
Encrypted in transit (TLS 1.2 minimum) and at rest. Per-person authentication with explicit access grants, revocable individually. Secrets held in a managed key vault. Append-only audit logging of privileged actions.
We have not completed a SOC 2 audit or an independent penetration test. We would rather say so than imply otherwise.
Your rights
Where GDPR or similar law applies you may request access, correction, deletion, restriction, portability, or object to processing. If your employer connected the tenant, they are the controller and you should approach them first; we will support them in responding.
Contact kyler@ebbwater.net. We aim to respond within 30 days.
Changes
Material changes will be notified by email to account holders at least 30 days before taking effect. The effective date at the top always reflects the current version.
Contact
- General: kyler@ebbwater.net
- Privacy and data subject requests: kyler@ebbwater.net
- Security and vulnerability reports: kyler@ebbwater.net
- Postal: 5162 SW Slavin Rd, 66, Portland, OR 97239