Privacy Policy
Last updated: November 14, 2026
The short version. Vartostack reads information about the apps connected to your Microsoft 365 so we can show you what you use, what it costs and who has access. We never see your passwords and we never store the content of your email or files. Your data is used only to provide the service, stays in Canada, and is deleted when you leave.
Who we are
Vartostack ("we", "us") provides software that helps organizations find and manage the SaaS and AI apps connected to their Microsoft 365. Vartostack is currently in a pilot stage. For any privacy question, contact [email protected].
What we collect
| Information | Where it comes from | Why we need it |
|---|---|---|
| Your name, work email and company name | You, when you request access or contact us | To set up your account and talk to you |
| Your Microsoft 365 tenant ID | Microsoft, when your administrator grants consent | To connect to the right organization |
| Names and publishers of connected apps, the permissions they hold and when they were granted | Microsoft Graph, read-only | To build your app inventory and assess risk |
| Names, email addresses and sign-in dates of people who connected apps | Microsoft Graph, read-only | To show who uses what, find unused licences and support offboarding |
| Subscription details you enter or confirm, such as seats and renewal dates | You | To calculate spend and remind you of renewals |
| Basic technical logs, such as IP address and browser type | Your browser, when you use our website or dashboard | To keep the service secure and working |
What we never collect
- Passwords or authentication secrets of your users.
- The content of email messages, chats, documents or files.
- Payment card numbers. If we charge for the service later, payments will be handled by a dedicated payment processor.
How we use information
We use the information only to provide and improve Vartostack for your organization: showing your app inventory, risk and spend, generating recommendations and reports, and carrying out offboarding steps that your administrators start. We do not sell personal information, we do not use it for advertising, and we do not use your organization's data to train AI models.
Consent and your administrator
Vartostack only reads data after an administrator of your organization grants consent in Microsoft Entra ID. Your organization decides whether to use Vartostack and controls the connection. Write permissions, which are needed for automated offboarding, are requested separately and only if your organization turns that feature on.
Where your data is stored
Customer data is stored in data centres located in Canada and encrypted in transit and at rest. Our website is delivered through Cloudflare's global network.
Service providers
We use a small number of providers to run the service, such as cloud hosting, website delivery (Cloudflare) and email. They process data only on our instructions and only to provide their service to us. We will list our current providers on request and update this policy when they change.
How long we keep data
We keep your data while your organization uses Vartostack. If your organization disconnects Vartostack or asks us to delete its data, we delete it within 30 days, except where the law requires us to keep certain records for longer.
Security
We limit access to customer data to people who need it to run the service, use least-privilege permissions in Microsoft 365, require multi-factor authentication on our own systems, and keep administrative access to our servers off the public internet.
Your rights
Under Canadian privacy law, including PIPEDA and, for Quebec, Law 25, you can ask to access the personal information we hold about you, correct it, or have it deleted, and you can withdraw consent. Because we usually process data on behalf of your employer, we may refer your request to your organization's administrator. Email [email protected] and we will respond within 30 days. You can also contact the Office of the Privacy Commissioner of Canada.
Changes to this policy
If we make important changes, we will update the date at the top and tell customers by email before the changes take effect.