ConsoleSmith Privacy Policy

Privacy Policy

Effective Date: 10-05-2026 Last Updated: 10-05-2026

CONSOLESMITH L.L.C. (“Company,” “we,” “us,” or “our”) operates the ConsoleSmith service (“Service”). This Privacy Policy describes how we collect, use, store, and protect information about users (“you”) of our Service. By using ConsoleSmith, you agree to the practices described in this Policy.

1. Who We Are

CONSOLESMITH L.L.C. is an Indiana limited liability company. We operate ConsoleSmith, a software-as-a-service MCP server for Microsoft 365 and Intune management.

Data Controller (for GDPR purposes): ConsoleSmith L.L.C. Email: support@consolesmith.com Website: https://ConsoleSmith.com

The Service is offered to businesses and to managed service providers administering the tenants of their clients. It is not offered to consumers for personal, family, or household purposes.

We act as a controller of the limited account, billing, and request-log data described in Section 2, because we determine how that data is used to operate, secure, and bill for the Service. In relation to the contents of your Microsoft 365 tenant we act as a processor, and where you administer a tenant belonging to a third party, as a sub-processor, acting on your instructions, although as described in Section 2c the Service is architected so that tenant data passes through to your AI assistant and is not written to our systems.

The AI assistant you use with the Service is engaged by you and not by us. That provider's handling of information you submit to it is governed by your agreement with that provider, not by this Policy.

Key Terms

Personal data (also called “personal information”) means any information relating to an identified or identifiable individual. It does not include anonymous or aggregated information that cannot reasonably be linked to you.

Special category data (under the GDPR) and sensitive personal data or sensitive personal information (under U.S. state law) mean personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data, data concerning health, sex life or sexual orientation, precise geolocation, immigration or citizenship status, or government identification numbers. We do not intentionally collect data of this kind (see Section 2c).

Controller means the party that determines the purposes and means of processing personal data. Processor means a party that processes personal data on a controller's instructions. Sub-processor means a processor engaged by another processor.

Data subject (under the GDPR) and consumer (under U.S. state law) both mean the individual to whom personal data relates.

Processing means anything we do with personal data, including collecting, storing, using, disclosing, and deleting it.

2. What Data We Collect

We collect only the minimum data necessary to operate the Service

2a. Data You Provide Directly (the "Billing and Security Data")

Data Purpose Source
Email address License key delivery, billing receipts, support Stripe checkout
Payment information Subscription billing Stripe (we never see raw card data)

We do not collect your name, address, phone number, or any other personal identifying information unless you voluntarily provide it in a support communication. Stripe collects cardholder name, billing country, and zip code for payers. Pro users provide an email address at sign up; Free access does not require an email address or a paid License Key, so if you use the Service on a Free basis we do not collect your email address unless you voluntarily provide it, for example when you contact support.

2b. Data Collected Automatically (the "Hosted Logs")

Data Purpose Retention
License key validation request timestamps debugging, security, verification Ninety (90) days
Stripe IDs Verification Ninety (90) days

License Key validation and Local Logs. The Client Software sends your License Key to our licensing service to check and confirm access. Validation results may be cached, so the licensing service is not contacted for every tool call. The validation request sends your License Key only; it does not send your tool-call history or Microsoft tenant identifier. Logs of tool activity kept on your computer (the "Local Logs") are separate from the Hosted Logs, are not automatically uploaded or transmitted to us, and are not tied to your subscription.

How we limit what we collect. We collect only the personal data that is reasonably necessary and proportionate to provide and maintain the specific service you have asked us to provide, and to secure and bill for it. We do not collect personal data for any undisclosed purpose, and we will not use the personal data described in this Section for a materially different purpose without first giving you notice and, where required by law, obtaining your consent. We do not require your name, postal address, or telephone number in order to provide the Service, and we do not collect them from your use of it. We may hold contact details of that kind (e.g. your name, company name, or telephone number) where you volunteer them in a support communication, in correspondence about your plan, or in connection with billing. We do not purchase personal data and we do not obtain it from data brokers or advertising networks, nor do we sell such information.

2c. What We Do NOT Collect

We do not store Microsoft Graph API response data. ConsoleSmith operates as a pass-through service — when you query your Microsoft 365 tenant, the response data is returned directly to your AI assistant and is never written to ConsoleSmith’s servers or databases. This means we do not store:

2d. How We Collect Your Data

We collect personal data:

Directly from you: The Billing and Security Data when you complete checkout, contact support, or correspond with us in any manner.

Automatically: The Hosted Log data, when the Client Software checks your License Key with our licensing service, our servers generate the log data described in Section 2b.

From our service providers: Stripe provides us with your email address and a customer identifier when you subscribe. We do not receive raw payment card data.

From your organization: Where your employer, or a managed service provider acting for your organization, subscribes on your behalf and provides your business contact details.

We do not collect personal data from publicly accessible sources, data brokers, credit reference agencies, social media, or advertising networks.

2e. What information do we receive and where is it stored?

The table below shows what information each party receives, where it is stored, and how long it is retained. The Local Logs kept on your computer are separate from the Hosted Logs described in Section 2b.

Location Data Retention and Deletion
Customer’s computer (Client Software) Local Logs of tool activity, including the date and time of each tool call, tool inputs (such as device identifiers and usernames), the Microsoft 365 tenant identifier, and the outcome of the call. Local Logs stay on the customer’s computer and are not automatically uploaded or transmitted to the Company. No automatic deletion schedule. Not tied to the subscription; ending a subscription or disabling a License Key does not delete them. Controlled and deleted by the customer.
Company licensing service (hosted on Microsoft Azure) The License Key, sent by the Client Software to check and confirm access. Validation results may be cached, so the licensing service is not contacted for every tool call. No tool-call history or tenant identifier is sent. Hosted Logs are retained for ninety (90) days and then deleted.
Stripe (billing) Billing and subscription records and License Key metadata, kept separate from tool-call history. Retained under Stripe’s retention practices.
Resend (email delivery) The email address and the message content needed to deliver the License Key email. Retained under Resend’s retention practices.
AI assistant (Claude Desktop) The AI application calls the Service’s tools and receives the tool results, so this data is not handled solely on the customer’s computer. Retained under the AI assistant’s retention practices.

3. How We Use Your Data

We use the Billing and Security Data and the Hosted Logs we collect for the following purposes:

  1. Service delivery — Validating license keys.
  2. Billing — Processing subscription payments through Stripe and sending receipts.
  3. Transactional email — Sending your license key and onboarding information via Resend.
  4. Security and abuse prevention — Detecting and preventing unauthorized use or misuse of the Service.
  5. Debugging and support — Diagnosing technical issues using server logs.
  6. Legal compliance — Complying with applicable laws and regulations, and responding to lawful requests from public authorities.
  7. If you are located in the United Kingdom, the European Economic Area, or Switzerland, we may only use your personal data where we have a lawful basis for doing so under Article 6 of the GDPR. Our bases are:
    1. Performance of a contract (Article 6(1)(b)). Service delivery, License Key validation and delivery, subscription billing, and transactional email relating to your subscription.
    2. Legitimate interests (Article 6(1)(f)). Security and abuse prevention, debugging, support, and the establishment, exercise, or defense of legal claims. Our legitimate interest is in operating a secure and reliable service and protecting it and our customers from misuse. We balance that interest against your rights and freedoms before relying on it, and will provide a summary of that assessment on request.
    3. Compliance with a legal obligation (Article 6(1)(c)). Retention of billing and tax records, and responding to lawful requests from public authorities.
    4. Consent (Article 6(1)(a)). You may withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.
  8. Where we rely on legitimate interests you have the right to object to the processing. If you object, we will stop unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or the processing is necessary to establish, exercise, or defend legal claims. See Section 8.
  9. We do not seek to collect special category data and do not rely on any Article 9 condition to process it. If you provide special category data voluntarily, for example in the body of a support message, we will process it only as necessary to respond to you and will delete it when it is no longer needed.
  10. What we will not do with your data. We do not sell or share your personal data, as those terms are defined under the CCPA and comparable U.S. state privacy laws, and we have not sold or shared personal data in the preceding twelve months. We do not sell sensitive personal data under any circumstances. We do not use your personal data for advertising, marketing profiling, or targeted advertising, and we do not use it to train or fine-tune any artificial intelligence or machine learning model.

We do not sell your personal data. We do not use your data for advertising or marketing profiling.

4. Third-Party Service Providers

We share data with the following service providers solely to operate the Service:

Provider Purpose Data Shared Location
Stripe Payment processing Email address, billing and subscription records, License Key metadata United States
Resend Transactional email (license key delivery) Email address and the message content needed to deliver the License Key email United States
Microsoft Azure Cloud hosting and compute Hosted Logs United States (East US)
Cloudflare Email routing and web hosting Visitor metadata, sender's email address, and contents of messages United States
Google Mailbox Email address and the message content United States
Github Software download Request details to the extent necessary for download United States

Each of these providers maintains their own privacy practices. We encourage you to review their privacy policies: - Stripe: https://stripe.com/privacy - Resend: https://resend.com/privacy - Microsoft Azure: https://privacy.microsoft.com

We do not share your data with any other third parties except as required by law.

Other disclosures. Apart from the providers listed above, we disclose your personal data only: (a) to our professional advisors, auditors, attorneys, and insurers, who are bound by duties of confidentiality; (b) to law enforcement agencies, courts, tribunals, and regulators, where necessary to comply with a legal obligation or to establish, exercise, or defend legal claims; (c) in connection with a merger, acquisition, financing, asset sale, or insolvency, in which case the recipient will be bound by confidentiality obligations and by this Policy as it applies to the personal data transferred; or (d) with your consent or at your direction.

Sub-processors. We permit a third party to handle your personal data only where we are satisfied that it applies appropriate technical and organizational measures and is bound by written terms consistent with our obligations under this Policy and applicable data protection law. We will give affected customers at least 30 days' notice before adding or replacing a sub-processor, and a customer may object to a proposed sub-processor on reasonable data protection grounds. A current list of sub-processors is available on request, and you may request a list of the specific third parties to which we have disclosed your personal data as described in Section 9.

International Data Transfers

We are established in the United States, and our hosting and service providers are located in the United States. If you are located in the United Kingdom, the European Economic Area, or Switzerland, using the Service necessarily involves a transfer of your personal data to a country outside your own, which may not provide the same level of protection for personal data.

Where you use the Service to administer your own Microsoft 365 tenant, any transfer of tenant content is effected between you and Microsoft under your own agreement with Microsoft. We are not a party to that transfer and do not retain the data transferred.

5. Cookies and Tracking

ConsoleSmith does not use cookies or tracking technologies on our website or within the Service.

For the avoidance of doubt, we do not use pixels, software development kits, session-replay tools, or cookies of our own. Because we set no cookies and deploy no tracking technology, we do not display a cookie consent banner. If we introduce any cookie or similar technology that is not strictly necessary, we will obtain consent before setting it and will publish a cookie policy.

6. Data Retention

Data Type Retention Period
Email address Retained while needed to administer your subscription, provide support, and meet legal obligations. Not automatically deleted when a subscription ends or a License Key is disabled; deleted on request as described below. Copies held by Stripe and Resend are retained under their own retention practices.
License key Retained while needed to administer the subscription and for licensing and security records. Disabling a License Key stops it from being accepted but does not delete it; deleted on request as described below.
Hosted Logs (Stripe ID and License key validation timestamps) Ninety (90) days, then deleted. This applies only to Hosted Logs, not to Local Logs on your computer, Stripe records, or email.
Stripe billing records As required by Stripe’s policies and applicable tax law
Local Logs (kept on your computer) No automatic deletion schedule. Not tied to your subscription; Controlled and deleted by you.

Ending a subscription, disabling a License Key, and deleting records are separate actions. Ending a subscription means cancelling the subscription. Disabling a License Key means the key is no longer accepted by the licensing service. Deleting records means removing stored data. Ending a subscription or disabling a License Key automatically removes the license key from the User's record in Stripe. Stripe and Resend may keep their own record of license keys subject to each of their respective terms of service, and the User expressly agrees that they understand this and consent to both Stripe and Resends retention policies.

You may request deletion of your data (except where retention is required by law) by contacting support@consolesmith.com. We will process deletion requests within 30 days.

7. Data Security

We implement reasonable, industry standard technical and organizational measures to protect your data, including but not limited to:

No method of transmission over the internet is 100% secure. We take reasonable precautions by ensuring our service providers and other third parties handling your personal data implement appropriate technical and organizational security measures, limit access to your personal data to those with a genuine business need, and maintain procedures for detecting and responding to suspected personal data breaches which includes notifying you and any applicable supervisory authority or state regulator where we are legally required to do so and within the timeframes the law requires. We are not responsible for any security failure caused by the fault of our service providers or any other third party, and we make no guarantee or representation of absolute security.

8. Your Rights (GDPR / EU Users)

If you are located in the European Union or European Economic Area, you have the following rights under the General Data Protection Regulation (GDPR):

To exercise any of these rights, contact us at support@consolesmith.com.

To exercise any of the aforementioned rights if you are located in the European Union or European Economic Area, you must: (i) inform us which right you wish to exercise and (ii) give us enough information to identify you: if you are a Pro user, either the email address associated with your License Key or your License Key; or, if you use the Service on a Free basis, the email address from which you contact us and your License Key (if any). We may ask for additional information reasonably necessary to verify your identity, which we will use only for that purpose. We will respond without undue delay and in any event within one (1) month of receiving your request, and we will tell you if we need to extend that period by up to two further months because your request is complex or because you have made a number of requests. We do not charge a fee for responding unless applicable law permits it.

For complaints, please contact us first. We would appreciate the opportunity to address your concerns. You may also complain to your supervisory authority. If you are in the United Kingdom, that is the Information Commissioner's Office (Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF; helpline 0303 123 1113; https://ico.org.uk/make-a-complaint). If you are in the European Economic Area, you may complain to the supervisory authority of the Member State of your habitual residence, place of work, or the place of the alleged infringement.

9. Your Rights (Indiana / U.S. Users)

If you are an Indiana resident, you may have rights under the Indiana Consumer Data Protection Act (ICDPA) regarding your personal data. To exercise these rights, contact us at support@consolesmith.com.

This Section applies if you are a resident of a U.S. state that has enacted a comprehensive consumer privacy law. We have drafted it to the standard of the California Consumer Privacy Act, as amended by the California Privacy Rights Act (the "CCPA"), and have extended it wherever another state regulates a matter more strictly. Except as noted, we extend the rights below to residents of every U.S. state, whether or not the law of your state requires it. The rights described here meet or exceed those available under the Indiana Consumer Data Protection Act.

Most U.S. state privacy laws exclude individuals acting in a commercial or employment capacity from the definition of "consumer," and many of those laws may therefore not apply to our relationship with you, because the Service is sold to businesses and administered by IT professionals acting for their employers or clients. California is the exception: the CCPA covers personal information about individuals acting in a business-to-business capacity. We do not rely on that distinction to refuse a request.

9a. Categories of Personal Information We Collect

In the preceding twelve months we have collected the following categories of personal information, using the CCPA's categories:

(i) Identifiers. Email address; License key validation timestamps and ;

(ii) Commercial information. Subscription plan, transaction and billing records, and a Stripe customer identifier;

(iv) Professional or employment-related information — company name and role, where you provide them.

We collect this information from the sources described in Section 2(d), for the purposes described in Section 3, and we disclose it to the categories of recipients described in Section 4. We do not collect the categories listed in Section 2(c), and we do not collect sensitive personal information. We do not use or disclose sensitive personal information for any purpose beyond those permitted without a right to limit under the CCPA.

9b. Your Rights and How to Exercise Them

Subject to verification, you have the right to:

(i) Obtain confirmation of whether we process your personal information and a copy of it, together with the categories collected, the sources, the purposes, and the categories of third parties to which it was disclosed.

(ii) Request correction of inaccurate personal information.

(iii) Request deletion of your personal information, subject to the exceptions in applicable law.

(iv) Receive your personal information in a portable and, where technically feasible, readily usable format.

(v) Opt out of sale, sharing, and targeted advertising. Note we do not sell or share personal information and we do not engage in targeted advertising, so there is nothing to opt out of. If that changes, we will provide a clear opt-out mechanism and update this Policy before doing so.

(vi) Limit the use of sensitive personal information. Note we do not collect sensitive personal information or use it for any purpose that triggers this right.

(vii) Opt out of profiling (see Section 9(e)).

(viii) We will not deny you goods or services, charge you a different price, provide a different level or quality of service, or retaliate against you because you exercised a privacy right.

To exercise a right, email support@consolesmith.com. If you are a Pro user, send your request from the email address associated with your License Key. If you use the Service on a Free basis, you may send your request from the email address you use to contact us. We verify requests using information already in our possession, ordinarily for Pro users the email address associated with your License Key and for Free users the email address from which you contact us, and we do not collect additional identifying information for verification unless we cannot otherwise verify you. An authorized agent may submit a request on your behalf if the agent provides written authority signed by you, and we may contact you to confirm it. We will respond within forty five (45) days, extendable once by a further forty five (45) days where reasonably necessary in our discretion, and we will tell you if we need the extension and why. We do not charge a fee to respond.

We honor opt-out preference signals sent by a browser or device, including the Global Privacy Control, as a valid request from the individual using that browser or device.

9c. Sensitive Data, Minimization, and Consent

We do not sell sensitive personal data under any circumstances, regardless of consent. We limit our collection of personal data to what is reasonably necessary and proportionate to provide and maintain the specific service you have asked us to provide. If we ever need to process sensitive personal data, we will first obtain your opt-in consent, which is the standard imposed by most U.S. state privacy laws other than California. We apply each of these standards to all users, not only to residents of the states that require them.

9d. List of Specific Third Parties

In addition to the categories of recipients disclosed in Section 4, you may request a list of the specific third parties to which we have disclosed your personal data. This right is granted by Oregon and Minnesota law and we extend it to all users. If we do not hold that information in a form specific to you, we will provide a list of the specific third parties to which we have disclosed personal data of the same category.

9e. Profiling and Automated Decision-Making

We do not engage in profiling in furtherance of decisions that produce legal or similarly significant effects concerning you, we do not make decisions about you based solely on automated processing, and we do not use personal data to evaluate, analyze, or predict your characteristics, behavior, or performance.

The Service operates alongside an AI assistant that you engage and control. That assistant may propose actions in your Microsoft 365 tenant, but under our Terms of Service no action executes unless you review and permit it, and the Service performs no evaluation or scoring of you. If we were ever to engage in profiling of the kind described above, you would have the right to opt out, to question the result of any such decision, to be informed of the rationale for it, and, where feasible, to be told what you might do to obtain a different result.

9f. Appeals

If we refuse to act on your request, we will tell you why and how to appeal. You may appeal by replying to our response or by emailing support@consolesmith.com with "Appeal" in the subject line. We will review the appeal and inform you in writing of our decision, with a written explanation of the reasons, within sixty (60) days of receipt. If we deny the appeal, we will give you a method to contact your state Attorney General to submit a complaint.

9g. Other State-Specific Disclosures

California "Shine the Light." We do not disclose personal information to third parties for their own direct marketing purposes, so no disclosure is required under California Civil Code section 1798.83.

Do Not Track. We do not track users across third-party websites and we serve no targeted advertising, so we do not respond differently to "Do Not Track" browser signals. We do honor the Global Privacy Control as described in Section 9b.

Consumer health data. We do not collect, process, or sell consumer health data as defined by the Washington My Health My Data Act, the Nevada consumer health data law, or comparable laws, and we therefore maintain no separate consumer health data privacy notice.

Biometric and genetic data. We do not collect, capture, store, or use biometric identifiers or biometric information within the meaning of the Illinois Biometric Information Privacy Act, the Texas Capture or Use of Biometric Identifier Act, or comparable laws, and we do not collect genetic data.

Nevada. We do not sell "covered information" within the meaning of Nevada Revised Statutes chapter 603A.

Texas. We do not sell sensitive personal data or biometric personal data, so no notice is required under the Texas Data Privacy and Security Act.

Financial incentives. We do not offer any financial incentive, or any price or service difference, in exchange for the retention or sale of personal information.

ConsoleSmith

10. Children’s Privacy

The Service is not directed to individuals under the age of 18. We do not knowingly collect personal data from minors. If we become aware that we have collected personal data from a minor, we will delete it promptly.

11. Changes to This Privacy Policy

We reserve the right to update this Privacy Policy at any time. If you are a Pro user, we will notify you of material changes via email to the address associated with your License Key at least fourteen (14) days before the changes take effect. Continued use of the Service after changes take effect constitutes acceptance of the updated Policy. If you use the Service on a Free basis, we do not require or collect an email address, so we will instead post notice of the changes on our website.

12. Contact Us

For questions, requests, or concerns about this Privacy Policy, contact:

ConsoleSmith L.L.C. Email: support@consolesmith.com Website: https://Consolesmith.com