Privacy Policy

1. Data controller

The controller of the personal data collected through InfraExplain is:

• Owner: María África Mba Nchama
• Spanish tax ID (NIF): 48408404M
• Registered address: Av. Maestro Rodrigo, 105, bloque 3, piso 11, puerta 51, 46015 Valencia, Spain
• Contact email: support@azureeasy.net
• InfraExplain and InfraExplain Wiki are trading names under which the service is provided.

2. Data we collect

We only collect the data needed to provide the service:

• Authenticated user identity: name, corporate email address, and user and organisation identifiers in Microsoft Entra ID.
• Technical metadata about your Azure environment: subscriptions, resource groups, resource types and configurations, role assignments and security alerts.
• Azure consumption and billing data: cost by service, monthly history and forecasts.
• Content you create: operational context for resources, InfraExplain Wiki documentation and notes.
• Conversations held with the Zure assistant.
• Application configuration preferences.
• Paid subscription data managed by Stripe: we never store card numbers.
• Aggregated usage data for analytics purposes, only if you give your consent.

InfraExplain accesses your Azure environment using delegated OAuth 2.0 tokens. We never request or store passwords: authentication takes place entirely on Microsoft's servers.

3. Purpose and legal basis

We process your data for the following purposes, on the following legal bases set out in Article 6 GDPR:

• Providing the contracted service — cost analysis, security, recommendations and documentation. Legal basis: performance of a contract (Art. 6(1)(b)).
• Managing sign-up, billing and payment for paid plans. Legal basis: performance of a contract and compliance with legal obligations (Art. 6(1)(b) and 6(1)(c)).
• Keeping the service secure, preventing fraud and auditing access. Legal basis: legitimate interest (Art. 6(1)(f)).
• Sending operational notifications and alerts about your environment. Legal basis: performance of a contract (Art. 6(1)(b)).
• Measuring application usage in order to improve it. Legal basis: consent (Art. 6(1)(a)), which you may withdraw at any time.

We never use your data for advertising and we never sell it to third parties.

4. Retention periods

• Your environment data and your content are kept for as long as the account remains active.
• After you request closure, they are permanently deleted within a maximum of 30 days.
• Billing records are kept for 6 years, in line with the commercial and tax obligations applicable in Spain.
• Audit and security logs are kept for a maximum of 12 months.

5. Storage and security

Data is stored in managed Microsoft Azure services, with the following safeguards:

• Encryption at rest and in transit using the platform's native mechanisms.
• Delegated authentication via OAuth 2.0 against Microsoft Entra ID, with no password handling on our side.
• Access control by organisation and by subscription: each user only reaches data from their own environment.
• Logging and auditing of actions performed on the platform.
• Database access restricted to the application's own services.

6. Data location and international transfers

• The application logic is hosted in the West Europe region of Microsoft Azure (Netherlands).
• The database is hosted in the Germany West Central region of Microsoft Azure (Germany).
• Artificial intelligence processing takes place in the West Europe region of Azure OpenAI Service (Netherlands).
• All of these regions are located within the European Economic Area.
• Certain ancillary providers — payments and analytics — may process data outside the EEA. Such transfers rely on the Standard Contractual Clauses approved by the European Commission and, where applicable, on the EU-US Data Privacy Framework.

7. Providers that process data on our behalf

We do not share your data with third parties for commercial purposes. We do rely on the following processors, strictly in order to provide the service:

• Microsoft Corporation — hosting infrastructure, database, authentication and artificial intelligence services.
• Stripe Payments Europe — payment processing and subscription management. Card details are handled directly by Stripe and never pass through our systems.
• Google Ireland Limited — usage analytics through Google Analytics 4, enabled only with your consent.
• Arsys Internet S.L.U. — outbound email delivery (service notifications). Processes the recipient address and the message content. Servers in Spain.

All of them act as processors under Article 28 GDPR. We may also disclose data to public authorities where a legal obligation requires us to do so.

8. Use of artificial intelligence

• InfraExplain uses Azure OpenAI Service to generate descriptions, recommendations and analysis of your environment.
• Only the data needed to handle each specific request is sent to the models.
• Microsoft does not use Azure OpenAI customer data to train third-party models.
• Conversations with Zure are stored to keep your session history and you can delete them whenever you want.
• AI-generated answers are indicative and should be reviewed before acting on production environments.

9. Your rights

You may exercise the following rights at any time:

• Access to your personal data.
• Rectification of inaccurate information.
• Erasure of your data and deletion of your account.
• Restriction of and objection to processing.
• Portability of your data in a structured format.
• Withdrawal of the consent you gave, without affecting the lawfulness of processing carried out beforehand.

To exercise them, write to support@azureeasy.net stating which right you wish to exercise. We will reply within one month at the latest.

If you believe the processing does not comply with the applicable rules, you may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es), the competent supervisory authority.

10. Cookies and similar technologies

We use two categories of cookies and local storage:

• Strictly necessary: essential for signing in, keeping your session and storing interface preferences. These do not require consent.
• Analytics: Google Analytics 4, used to understand how the application is used and to improve it. It is enabled only if you accept it in the consent banner.

We do not use advertising cookies and we do not share data with ad networks. You can change or withdraw your consent at any time from the cookie settings banner.

11. Changes to this policy

We may update this policy to reflect legal, technical or service changes. Where changes are significant, we will let you know through the application or by email with reasonable notice.