Privacy Policy

This Privacy Policy explains how TenuVault ("we", "our", or "the Service") handles personal data when you visit tenuvault.com, use the TenuVault Desktop app, buy a subscription or use the TenuVault web portal. We designed the Service to minimize data collection and focus on privacy by default: the desktop app works with your Intune tenant from your own computer, and your tenant data and Microsoft access tokens never reach our servers.

Data controller

The controller responsible for data processing in connection with the Service is:

Ugurlabs UG (haftungsbeschränkt)
Fährstraße 217
40221 Düsseldorf
Germany

Managing Director: Ugur Koc
Email: support@ugurlabs.com

Desktop app and web portal

TenuVault comes as a desktop app and as an older web portal. They handle your data differently. They share only the hosting of this website: the desktop app calls nothing but the license service, never the web portal's server functions, and the license service does not access web portal data.

Website and analytics

We use privacy friendly analytics (Plausible) on tenuvault.com to understand aggregate website usage without cookies or personal identifiers.

• Plausible Analytics is cookieless and does not track personal data or use browser fingerprinting.
• Plausible collects aggregated metrics such as page views, referrers, and device types.
• We do not use cookies for analytics or tracking.

The website is hosted on Vercel. When you visit it, our hosting provider processes request data such as your IP address, the requested page, the time of the request and your browser's user agent in order to deliver the site and keep it secure.

Desktop app

TenuVault Desktop for Windows and macOS backs up, compares and restores your Intune configuration on your own computer. It signs in with an Entra app registration in your own tenant and calls Microsoft Graph and Azure directly from your machine. There is no TenuVault proxy or relay in between.

• Your tenant configuration, backups, Microsoft access and refresh tokens and your backup recovery key never reach our infrastructure.
• Backups are encrypted on your computer and stored on your local disk or in your own Azure Storage account. We cannot access them.
• The app contains no telemetry, analytics or crash reporting.
• On your device: the app keeps its token cache, tenant profiles, backup encryption keys, license key and license activations in an encrypted store protected by the operating system (DPAPI on Windows, Keychain on macOS).

The only TenuVault server the app contacts is our licensing service, described in the next section.

License checks

To check your plan, the app contacts our licensing service at tenuvault.com the first time you use a tenant, every six hours while it runs, and when you enter a key, change license sharing, remove a tenant or deactivate the machine. Depending on the request, the licensing service receives:

• your license key, or no key on Community and when your organization shares its license with your tenant;
• a random installation ID generated by the app, which identifies the installation and not you or your device hardware;
• the Microsoft Entra tenant ID being licensed;
• the client ID of the Entra app registration you signed in with, so a license shared with your tenant is limited to that app registration;
• a short lived Microsoft sign-in token (ID token) as proof of the tenant and app registration you signed in to. It contains identity claims such as your name and user principal name. We verify it with Microsoft's public signing keys and use only its tenant ID and the ID of the app registration it was issued to. The token is not stored;
• your operating system and the app version;
• for refresh and release requests, the ID of the activation and, for an organization license, the ID of the license;
• your IP address, which is processed at the request level by our hosting provider and used transiently to limit request rates.

What we store: each activation (installation ID, tenant ID, operating system and app version) is recorded with your license key in Polar, our merchant of record. When a key holder shares a license with their tenant, we store the tenant ID, the client ID of the app registration they signed in with, the Polar IDs of the license key, its plan and the sharing activation (never the key itself) and the time of the last change in our own database. We do not store other license check data in a database of our own.

Purpose: we use this data only to validate your license, to enforce the tenant limits of your plan and the limit of 5 installations per tenant, and to let other administrators who sign in to a tenant through the shared app registration use a license that its key holder shares with the tenant. The service answers with a signed entitlement that lets the app keep working offline for up to 14 days.

Updates and baselines

The app downloads updates and OpenIntuneBaseline content directly from GitHub:

• Update checks: unless you turn off automatic updates in the app's settings or by policy, the app reads the public release feed of the TenuVault Desktop repository 15 seconds after it starts and every six hours, and downloads installer files from GitHub.
• OpenIntuneBaseline: when you load a pack in Quick Start or Framework coverage, the app downloads public policy files from the OpenIntuneBaseline repository.

These requests contain no tenant data and no tokens. GitHub receives standard request data such as your IP address and processes it under its own privacy policy.

Purchases through Polar

Polar Software Inc. acts as merchant of record for TenuVault subscriptions. Polar processes payments, invoices, taxes, and license keys, and receives your billing details directly when you purchase, under its own privacy policy. You manage your subscription, invoices and installations in the Polar customer portal.

Web portal

The TenuVault web portal at tenuvault.com/portal remains available for existing users. Unlike the desktop app, it is a hosted web application: its interface and server functions run on our hosting provider Vercel, while your backups, audit log, tenant metadata and backup jobs are kept in your own Azure subscription (your Azure Storage account and Azure Automation account).

• To connect a tenant, you enter the tenant ID, application (client) ID and client secret of an app registration in your own tenant, and the names of your Azure resources. The portal keeps them in your browser's session storage. The deployment template generated during onboarding contains the client secret; it is held only in the open page and is not saved in your browser.
• When you use the portal, your browser sends these details with each request to our server functions. They use them to obtain a token from Microsoft for your app registration and to call Microsoft Graph, Azure Resource Manager, your Azure Storage account and Azure Automation. Intune configuration and backup content pass through these functions while a request is processed, for example when you restore, compare or download a backup.
• We do not store your client secret, tokens or tenant data in a database of our own. Audit entries are written to the audit log container in your own storage account.
• Our hosting provider's runtime logs may contain operational details such as tenant IDs, backup file paths, policy names and error messages returned by Azure. They do not contain your client secret.

Contacting us

When you email us, for example for support or a security report, we process your email address, your message and any details you include in order to answer you. Do not send access tokens, client secrets, passwords or unredacted tenant exports by email.

Nonprofit applications

When you apply for free Pro, we process your organization’s name, country, optional website, registration number or recognition link, your name and email address, your authorization confirmation, and any explanation you provide. We use these details to verify eligibility, prevent duplicate or abusive requests, and answer your application.

The website sends the application through Resend to our support mailbox. Your email address is used as Reply-To so we can respond. Applications are handled as support correspondence; they are not stored in a separate application database or used for marketing. We may request additional recognition evidence by email. Do not submit tokens, passwords, personal identification documents, or tenant exports.

Our service uses transient, hashed request-address counters to limit attempts. Email content is processed by Resend and retained in support correspondence as described under data retention below. Submitting an application does not automatically create or activate a license.

Service providers

• Resend delivers nonprofit application emails to our support mailbox and processes the application content and email metadata. See Resend’s privacy policy.
• Polar Software Inc. is the merchant of record for purchases and stores license keys and activations.
• Vercel Inc. hosts the website, the licensing service and the web portal, and processes request data such as IP addresses on our behalf.
• Supabase Inc. hosts the database that holds licenses shared with a tenant. The database is located in the EU (AWS region eu-west-1, Ireland).
• Plausible Analytics provides cookieless, aggregated website statistics.
• GitHub delivers app updates and OpenIntuneBaseline content that the app downloads directly.

We do not sell your personal data or share it with third parties for their own marketing. A data processing agreement is available on request.

Legal bases

• Performance of a contract (Art. 6(1)(b) GDPR): license checks, organization licenses, purchases, the web portal and answering your requests.
• Legitimate interests (Art. 6(1)(f) GDPR): hosting and securing the website and services, request rate limiting, aggregated website statistics without personal identifiers, and update delivery.
• Legal obligations (Art. 6(1)(c) GDPR): where we must keep records, for example under tax law.

Data retention

• Activations are stored with your license key in Polar for the lifetime of your subscription. You can remove an activation at any time by removing the tenant or deactivating the machine in the app, or in the Polar customer portal.
• A license shared with a tenant is stored until sharing is turned off or the license ends.
• Microsoft ID tokens are not stored. IP addresses used for rate limiting are kept only in the memory of the server handling the request.
• Request logs are retained within our hosting provider's systems according to its log retention.
• Billing records are kept by Polar under its own privacy policy and applicable retention obligations.
• We do not retain your Intune configuration data or backups.

International transfers

Some of our service providers are based in the United States and may process data outside the European Economic Area. Where this happens, it is protected by appropriate safeguards such as the EU Standard Contractual Clauses.

Your rights

Under the GDPR you have the following rights regarding your personal data:

• Right to access: request a copy of the personal data we process about you.
• Right to rectification: request correction of inaccurate personal data.
• Right to deletion: request that we delete your personal data.
• Right to restriction: request that we restrict the processing of your personal data.
• Right to data portability: receive the data you provided to us in a structured, machine readable format.
• Right to object: object to processing based on our legitimate interests.

If you are located in California, you may also have rights under the CCPA. We do not sell or share personal information. To exercise your rights, contact us at the email below.

Supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state of your habitual residence, your place of work or the place of the alleged infringement (Art. 77 GDPR).

The supervisory authority responsible for us is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Düsseldorf.

Children's privacy

The Service is intended for professional and enterprise use and is not directed to children.

Changes

We may update this policy to reflect improvements or operational changes. If we make material changes, we will update the date above.

Contact

Questions about this policy or requests about your data? Contact us at support@ugurlabs.com. Report security issues to security@ugurlabs.com. The Trust Center lists every connection the desktop app makes.

You can also reach us by post: Ugurlabs UG (haftungsbeschränkt), Fährstraße 217, 40221 Düsseldorf, Germany.