What is read, what is kept, and what remains yours.

What we collect when you sign up

Your company name, your work email address, and — if you arrived from an ad — the ad-click reference (fbclid and UTM tags). We hash your IP address to rate-limit signups; we don't store it readable.

What we access if you approve the assessment

Security configuration from your Microsoft 365 tenant, read-only: sign-in policies, MFA status, mailbox rules, admin roles, email-authentication records. We cannot read the content of anyone's email, files or messages, and we cannot change any setting.

You approve this on Microsoft's own consent screen, and you can revoke it in your Microsoft admin centre in around 30 seconds — the steps are shown before you approve.

What we do with it

We produce your security report and monitor for suspicious changes when that service is active. Outbound client email is currently paused, so reports and alerts remain in the operator workspace. If delivery is enabled in future, service reports and optional marketing will remain separate; marketing requires its own unticked opt-in.

Who sees it

Kinervo (Ireland). Infrastructure providers process data on our behalf: Vercel (hosting), Supabase (database, EU region), Resend (email delivery), and Stripe only if you subscribe. Meta receives advertising-measurement events only after you choose to allow them, and only on public acquisition pages. Private report links, consent links and tenant pages are excluded. We never sell data.

How long we keep it

Report links expire after 30 days and monitoring stops when a free trial ends. Assessment history is retained so Kinervo can evidence what was seen and when; it is not currently erased automatically. You can ask us to review or delete data associated with your assessment at any time.

Your rights

Ask what we hold, have it corrected, or have it deleted — email hello@kinervo.com and it's handled personally, usually the same day. You can also complain to the Data Protection Commission (dataprotection.ie).

Change advertising measurement

This control affects only Meta measurement on public acquisition pages. It never enables access to a report, consent link or tenant page.