In plain words
We collect what we need to run LimberOps and talk to you. We never sell personal data or use it to train AI models. Data in your clients' tenants belongs to you and them; we process it only on your instructions. Email hello@limberops.com to see, fix or delete your data.
1. Who we are and what this covers
LimberOps LLC ("LimberOps", "we", "us") provides LimberOps, a service that helps managed service providers (MSPs) and IT teams manage Microsoft 365 and other environments as code. This policy explains how we handle personal data on limberops.com, in the LimberOps application, and when you contact us.
We handle personal data in two roles:
- As a controller for data about our website visitors, prospective customers, and the people who use LimberOps accounts (for example, your name, email and how you use the app). This policy covers that data.
- As a processor for personal data inside the client tenants our customers connect (for example, the names, email addresses and group memberships of their users). We process that data only on our customer's instructions, under our Data Processing Agreement. If you are a user in a tenant managed through LimberOps, your organization or its MSP is responsible for that data; please contact them first.
2. Personal data we collect
Data you give us
- Founding partner applications and contact: name, work email, company, number of client tenants, tools you use, and anything you write to us.
- Account data: name, email address, organization, role, and sign-in details, handled through our authentication provider.
- Billing data: billing contact and address. Card details go directly to our payment processor, Stripe; we never see or store full card numbers.
Data collected automatically
- In the app: usage events (pages viewed, features used), device and browser type, IP address, and timestamps, used for product analytics and security.
- Audit records: who requested, approved and applied each change, kept because the audit trail is part of the product.
- Logs: server and security logs, including IP addresses and request details.
The marketing website, limberops.com, does not use analytics or advertising cookies, and serves its own fonts rather than loading them from a third party.
3. How we use it and our legal bases
- To provide the Service: create accounts, sign you in, run Plans, send notifications. Legal basis: performance of our contract with you or your organization.
- To review applications and reply to you. Legal basis: our legitimate interest in responding to business enquiries, or steps you ask us to take before entering a contract.
- To bill you. Legal basis: contract, and legal obligations such as tax and accounting.
- To secure the Service: detect abuse, investigate incidents, keep audit records. Legal basis: legitimate interests in protecting our customers and systems, and legal obligations.
- To improve the Service using product analytics and feedback. Legal basis: legitimate interests in understanding how the product is used.
- To send product and service updates to customers. You can opt out of non-essential email at any time.
We do not sell personal data, share it for cross-context behavioral advertising, or use it for automated decisions that have legal or similarly significant effects on you.
4. AI features
When you use AI features in LimberOps, your prompt and the parts of your tenant inventory needed to answer it are sent to AI models hosted through Microsoft Azure AI Foundry, from the providers listed on our Subprocessors page. We do not use your data, or your clients' data, to train AI models, and under these providers' commercial terms they do not train their models on it.
7. Where your data is stored
LimberOps is hosted in the United States (Azure East US 2), and our service providers are based in the United States. If you are in the European Economic Area, the United Kingdom or Switzerland, we transfer your data to the United States under the European Commission's Standard Contractual Clauses (with the UK Addendum where relevant) or another lawful transfer mechanism, and require our providers to protect it accordingly.
8. How long we keep it
- Account data: while your account is active.
- Customer data, including client tenant data: for the life of your subscription, then deleted within 30 days after the 30-day export window, as set out in the DPA.
- Audit records: for the life of your subscription, so you can show what changed and who approved it.
- Applications and enquiries that do not lead to a subscription: up to 24 months, unless you ask us to delete them sooner.
- Billing records: as long as tax and accounting law requires.
- Security and application logs: up to 90 days.
9. How we protect it
We encrypt data in transit and at rest, isolate each customer's data, limit staff access to what is needed, and record changes in an audit trail. More detail is on our Security page. No system is perfectly secure; if a breach affects your personal data, we will notify you as the law requires.
10. Your rights
Depending on where you live, including the European Economic Area, the United Kingdom, California and other US states with privacy laws, you may have the right to:
- access the personal data we hold about you and get a copy;
- correct inaccurate data;
- delete your data;
- object to or restrict certain processing;
- receive your data in a portable format;
- withdraw consent where we rely on it;
- opt out of sale, sharing or targeted advertising (we do none of these);
- not be treated differently for exercising these rights.
To exercise a right, email hello@limberops.com. We will verify your request and reply within the time the law requires, usually 30 or 45 days. If we decline, you can appeal by replying to our answer. You may also complain to your local data protection authority. An authorized agent may make a request for you with your signed permission.
For data in a client tenant managed through LimberOps, we will pass your request to the organization responsible for it and help it respond.
11. Do Not Track and Global Privacy Control
We do not track you across other websites and do not allow third parties to do so on our websites or in the app, so there is no tracking for a Do Not Track signal to turn off. We treat a Global Privacy Control signal as a request to opt out of the sale or sharing of your personal data; we do neither in any case.
12. Children
LimberOps is a business service and is not directed to children under 16. We do not knowingly collect their personal data.
13. Changes to this policy
We will post any changes on this page with a new effective date. If a change is material, we will also tell customers by email or in the app before it takes effect.
14. Contact
LimberOps LLC, a Wyoming limited liability company. Questions and requests: hello@limberops.com.