Privacy Policy

1. Data controller

GraphLens is operated by BK Automatisering B.V., registered at the Dutch Chamber of Commerce (KvK: 60911522), VAT number NL854116357B01, Maneschijn 48, 6846 DW Arnhem, Netherlands.

Contact: info@graphlens.nl

2. What data GraphLens processes

GraphLens reads Microsoft Intune and Azure Active Directory data from your own Azure tenant via the Microsoft Graph API with read-only permissions. Specifically:

• Device names, compliance states, and categories
• Azure AD group names and memberships
• Compliance policy and configuration profile names and assignments
• App names and assignments
• Policy set compositions

GraphLens stores none of this data on its own servers. All data is fetched live on each request and discarded after rendering. The only data retained beyond the session is an encrypted OAuth access token, cached for a maximum of 55 minutes to reduce API calls.

3. Account data

To use GraphLens, an account is required. We store the following account data:

• Name and email address
• Role within your organisation (admin, reseller, customer, employee)
• Encrypted Azure tenant credentials (Tenant ID, Client ID, encrypted Client Secret or Device Code token)

This data is stored solely to facilitate login and Azure connectivity. It is never shared with third parties.

4. Legal basis

Processing is based on contract performance (Article 6(1)(b) GDPR) — providing the GraphLens service requires processing the above data.

5. Data retention

Account data is retained for as long as your account is active. You may request deletion at any time by emailing info@graphlens.nl.

6. Your rights (GDPR)

You have the right to access, correct, delete, or restrict the processing of your personal data. Contact info@graphlens.nl to exercise these rights. You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

7. Cookies

GraphLens uses a session cookie for authentication only. No tracking cookies or third-party analytics are used.