Privacy Notice

1. Crucial Architectural Distinction: Website vs. Product Data

At SysClaw, we believe that privacy begins with software architecture. To understand how your data is handled, please note the fundamental separation between our marketing website and the SysClaw application:

2. Information We Collect on This Website

We collect information you explicitly provide to us through our web forms:

• Demo Request Details: Your full name, work email address, company name, professional role, managed tenant range, and evaluation use case.
• Inquiry Content: Any questions, technical requirements, or feedback you submit via our contact forms.
• Technical Request Logs: Standard HTTP request logs (IP address, user agent, requested URL, timestamp) retained temporarily by our CDN and hosting infrastructure for security and DDoS mitigation purposes.

Important: Our website forms will never request, and you should never provide, Microsoft 365 tenant administrative credentials, client secrets, access tokens, or sensitive production export files.

3. What the SysClaw Application Sends — and Does Not Send

The SysClaw desktop application is local-first. It is deliberately built so that the data that matters most — your tenant data — never reaches us:

• No product telemetry: The application has no telemetry endpoint, no analytics beacon, no usage-metrics reporting, and no crash-reporting service. There is nothing to opt out of because nothing is sent.
• No licence phone-home: Licence activation is validated locally on your machine. An activated installation continues to work with no outbound connection to SysClaw at all.
• Tenant data stays with you: Directory objects, sign-in and audit logs, compliance records, configurations, and exports are ingested from Microsoft 365 directly to your machine over your own connection and stored locally under your control. SysClaw never acts as a processor or sub-processor of tenant data.
• Direct-to-Microsoft calls: Connections to Microsoft Graph, the Office 365 Management APIs, and Exchange Online go from your machine to Microsoft under your credentials. Microsoft — not SysClaw — processes that traffic under its own terms and privacy policies.
• Optional operator-initiated lookups: Certain features you choose to use send the specific queried item directly to a third party — for example GeoIP database downloads and lookups, breach-exposure checks, Tor exit-node lists, and expiring secure links. These calls never transit SysClaw infrastructure, each sends only what the lookup requires, and the complete, enforced list of destinations is published on our network access & egress page.
• Support materials you volunteer: If you contact support and choose to attach logs, screenshots, or exports, that material may contain tenant data. Please sanitise it before sending; we handle whatever you send under this Notice and delete it when the matter is resolved.

4. How We Use Your Information

We process personal data gathered from the website for the following specific purposes:

• To respond to your inquiries and schedule requested product demonstrations (Lawful basis: Legitimate interest / Pre-contractual steps).
• To provide you with technical evaluation materials and release updates where you have consented (Lawful basis: Consent).
• To maintain website security, prevent spam, and protect our infrastructure from malicious activity (Lawful basis: Legitimate interest).

5. Data Retention

We retain lead and demonstration contact details only as long as necessary to facilitate your technical evaluation and maintain our business relationship. If an evaluation does not proceed to a commercial agreement, contact records are purged within 18 months, or immediately upon your request.

6. Your Data Subject Rights

Depending on your jurisdiction (including the European Economic Area under GDPR and California under CCPA/CPRA), you have the following rights regarding your personal information:

• Right to Access: Request a copy of the personal information we hold about you.
• Right to Rectification: Request correction of inaccurate or incomplete contact data.
• Right to Erasure (Right to be Forgotten): Request deletion of your contact records.
• Right to Object or Restrict Processing: Object to our use of your data for direct communications.

To exercise any of these rights, please email us at [email protected]. We verify and respond to all requests within 30 days.

7. Security & Infrastructure

Our website is hosted on hardened infrastructure protected by Cloudflare edge security, HTTPS encryption with TLS 1.3, strict Content Security Policy headers, and automated rate limiting.

8. Contact the Data Controller

If you have questions, concerns, or requests regarding this Privacy Notice, please contact: