Privacy policy
Version 2026-11-01
Draft, not yet in force. This version is waiting for legal review and may change.
This policy explains how Spektra Systems LLC ("we") handles personal data in ACE (the Service): what we collect, why, how long we keep it, who else sees it, and how to use your rights.
Who we are
Spektra Systems LLC, 8201 164th Ave NE, Suite 200, Redmond, WA 98052, USA. Privacy questions and requests: privacy@spektrasystems.com.
Two kinds of data, two roles
Your account. When you sign in to the Service, we decide how your account data is used. For this data we are the controller.
Your organisation's cloud estate. The Service reads configuration, metadata and metrics from the Microsoft Azure and Microsoft 365 tenants your organisation connects. Your organisation decides what is connected and why, so it is the controller. We process that data only to run the Service on its instructions, as its processor. When your organisation uses the Service through a managed service provider, the provider is the processor and we act as its sub-processor. Questions about how your organisation uses estate data go to your organisation, or to its provider.
What we collect
| Data | Examples | Where it comes from |
|---|---|---|
| Account | Name, work email, organisation, role, a password hash or your Microsoft sign-in identifier, second-factor settings | You, or the colleague who invited you |
| Sign-in and security | IP address and browser user agent for each session, sign-in events, a keyed hash of the email used | Your browser |
| Acceptance records | Which version of which document you accepted, when, and the exact text shown | You |
| What you write | Comments, answers during onboarding, questions to the in-product assistant and its answers | You |
| Estate data | Resource names, tags, configuration and metrics; alerts; for Microsoft 365, mostly counts (users, guests, role members) | Your organisation's connected tenants |
| Partner billing contacts | Name and email of the person who receives invoices | The partner |
We do not collect special category data on purpose. Estate data can include names in resource tags or alert text; we keep it only as long as the table below says.
Why we use it, and on what basis
| Purpose | Data | Lawful basis (EU and UK GDPR) |
|---|---|---|
| Provide the Service and your account | Account, what you write | Contract with you or your organisation (Art. 6(1)(b)) |
| Keep accounts and the Service secure, detect abuse | Sign-in and security | Legitimate interests in security (Art. 6(1)(f)) |
| Keep evidence of what was agreed, invoice partners | Acceptance records, billing contacts | Legal obligation (Art. 6(1)(c)) and legitimate interests |
| Analyse your organisation's estate and recommend fixes | Estate data | On your organisation's instructions, as its processor |
| Send service email (invitations, sign-in links, notices you asked for) | Account | Contract |
We do not sell personal data, use it for advertising, or send marketing email from the Service.
AI in the Service
The Service uses AI models to summarise estate data, explain findings and answer questions. Prompts and tool results go to the model deployments listed on the sub-processors page, in the regions shown there. Before a model call, the Service replaces customer, environment, application and resource names with tokens and restores them in the answer. Credentials are never sent to a model. Spektra Systems LLC does not use your data to train AI models. AI output can be wrong; people review every recommendation before anything changes.
Who else sees it
- Your organisation and its provider. Administrators in your organisation, and staff of the managed service provider that serves it, see the estate data and activity in your organisation's workspace.
- Sub-processors. The companies that host the Service, run its AI models and send its email. They are listed, with what they process and where, at /legal/subprocessors. We give 30 days' notice before adding one.
- When the law requires it. We disclose data when a valid legal order requires it, and tell the affected organisation unless the law forbids it.
- If the business changes hands. In a merger or sale, data passes to the new owner under this policy.
Where it is stored and transfers
The Service stores data in the Azure region of the deployment that serves your organisation. Some processing happens outside that region: AI model calls run in the region of the model deployment, and email is sent through a provider in the United States. Transfers out of the EU, UK or Switzerland rely on the European Commission's standard contractual clauses or on the recipient's certification under the EU-US Data Privacy Framework, as named on the sub-processors page.
How long we keep it
| Data | Kept for |
|---|---|
| Sessions | 30 days after they end |
| Sign-in events | 90 days |
| Raw alert payloads | 30 days; the fields the Service parsed stay with the item |
| AI tool results within a run | 30 days; a summary stays with the run |
| Assistant conversations | 180 days after the last message |
| Notifications | 30 days |
| Reports | 2 years |
| Audit log | 1 year by default; your organisation's provider can set 1 day to 7 years |
| Acceptance and billing records | As long as the law requires us to keep them |
| Backups | 14 days, then they age out |
| Everything else in an organisation's workspace | Until the organisation leaves the Service, then 30 days for export before deletion |
When an organisation leaves, its data is deleted except records the law requires us to keep. When a person is erased, their name is removed from audit records, which then read "Former user".
Security
Data is encrypted in transit and at rest. Each organisation's data is separated in the database by row-level security, and every query runs as the requesting organisation. Cloud credentials are sealed so that only the background worker can open them. The Service reads your cloud with read-only permissions, except where your organisation separately grants the narrow write access described in the service terms.
Your rights
Depending on where you live, you can ask to see your data, get a copy, correct it, delete it, restrict or object to how we use it, and withdraw consent where we rely on it. You can complain to your data protection authority.
- From inside the Service. Account › Privacy lets you download your account data and ask for your account to be deleted.
- By email. Write to privacy@spektrasystems.com, or by post to 8201 164th Ave NE, Suite 200, Redmond, WA 98052, USA.
- For estate data, we pass your request to the organisation that controls it and help it answer.
We reply within 30 days. If a request is complex we may need up to two more months, and we tell you why within the first 30 days. We may ask you to confirm your identity first.
California. Residents have the right to know, delete and correct personal information, and to opt out of its sale or sharing. We do not sell or share personal information as the CCPA defines those terms. We do not treat anyone differently for using these rights.
India. Data principals under the Digital Personal Data Protection Act 2023 can reach our grievance contact at privacy@spektrasystems.com.
Cookies
The Service uses only cookies it needs to work, and a few that remember choices you make. Details: /legal/cookie-policy.
Children
The Service is for businesses. It is not meant for anyone under 18, and we do not knowingly collect their data.
Changes
We change this policy by publishing a new version here, with its date. If a change affects how we use data you have already given us, we tell you in the Service before it takes effect.
Version 2026-11-01.