Privacy
Last updated 24 October 2026
The parts about the app are a draft, not in force yet. The app is invite-only and opens to teams later. What this page says about the website and the early-access list applies now. Words in square brackets are still to be filled in.
This page covers gildyard.com, its early-access list and the Gildyard app. What the app reads from your Azure subscriptions is your organization's data: we handle it on your organization's behalf, under the data processing agreement. This page covers the data about you that we decide how to use.
Who we are
Mário Henrique Toste Sousa, tax number (NIF) 273284207, is responsible for the data on this page. Write to [email protected] about anything on it.
What we collect
When you request early access
- your email address,
- the role you chose,
- your answer to how many Azure subscriptions you look after,
- the date and time you asked,
- if we invite you, the email address we sent the invitation to: kept with the invitation and, once you use it, with your early-access permission.
When you sign in to the app
You sign in with your Microsoft work account. We ask Microsoft for your profile only and keep your name, your username (usually your work email) and two identifiers Microsoft gives every account: your directory's tenant id and your object id. We never see your password.
When you use the app
- the organizations you belong to, your role in each (Owner, Admin, Member or Viewer) and the yards you may see;
- the subscriptions you connect, each with your name as the person who connected it; and, when you open Connect Azure, a link the Azure portal uses for a day to fetch the access template, whose record holds your account's ids;
- the activity log: who did what and when. That is creating the organization; connecting, adopting or disconnecting a subscription; giving access with Do it for me; sending or revoking an invitation; joining, leaving, being removed or having your role changed; making or revoking a TV link. Each line names the person and, for a subscription, its name and id. Your organization's owners and admins see it;
- invitations you send or accept: single-use links that work for 14 days. The record of each (who sent it, any note, who used it) stays with the organization;
- if you use Do it for me to give Gildyard access: the Azure token you grant at that moment. It is used to list the subscriptions you can see and to create the two read-only role assignments on the ones you pick. It sits in its own record, never in your session, and can be used for ten minutes. The list of subscriptions it found stays in your session until you finish, the ten minutes pass, or you sign out;
- service logs: the time, the address and outcome of each request, collection results, error details, subscription, tenant and object ids, and an approximate location (country and city) worked out from IP addresses. Never passwords, session cookies or TV link tokens. A few short-lived codes can appear in request addresses: Microsoft's one-time sign-in code, the one-day Azure portal link and old-style invitation links.
What we don't collect
No analytics, advertising or tracking, and no fonts or scripts from other companies. The app sets one cookie, __Host-cp_session, which keeps you signed in for eight hours; it is strictly necessary and holds no data about you. The app and the demo yard also remember two display preferences in your browser's storage: whether the sidebar is folded, and whether you have seen the yard's tour. They never leave your browser. On the website, Cloudflare's bot protection may set cf_clearance, a strictly necessary security cookie, and a small Cloudflare script hides our email address from spam scrapers. None of these is used to track you.
Why, and on what basis
| What | Why | Basis (GDPR article 6) |
|---|---|---|
| The early-access list | To invite you and tell you about Gildyard; your answers help us decide who to invite first and how to price it | Your consent, 6(1)(a); you can withdraw it at any time |
| Your account, organizations, roles, connections, invitations and session | To give you and your organization the service you asked for | Our contract with you or your organization, 6(1)(b) |
| The activity log and service logs | To keep the service secure, show your organization who changed what, and find faults | Our legitimate interest in a secure, accountable service, 6(1)(f) |
| The Do it for me token | To do the one thing you asked, at the moment you asked | Our contract with you or your organization, 6(1)(b) |
We don't sell your data, and we share it only with the providers listed below.
Where it is kept
| Provider | What for | Where |
|---|---|---|
| Microsoft (Azure) | Hosts the app and everything it stores; its logs | Azure's Spain Central region, in the EU |
| Cloudflare | Hosts gildyard.com and stores the early-access list; like any web host, it handles technical data such as IP addresses to deliver the site and protect it from abuse | Worldwide network; it may process data outside the EU under the EU–US Data Privacy Framework and standard contractual clauses |
| [invitation mailbox provider] | The mailbox we send early-access invitations from | [where] |
Signing in goes through Microsoft's own sign-in for your work account, under your organization's agreement with Microsoft.
How long
| What | Kept |
|---|---|
| The early-access list | Until Gildyard is open to everyone and twelve months after that, or until you ask us to remove you |
| Your session | Eight hours; what is left is removed within two days |
| An invitation | The link works until it is used, or for 14 days; its record is deleted 30 days after that |
| A connect link | Works for a day; the hourly clean-up deletes its record after it expires, a daily storage rule two days after it was made at the latest |
| A Do it for me token | Deleted when it is used or you sign out; otherwise usable for ten minutes and deleted within a minute after, with a daily storage rule as a backstop |
| Your memberships | Until you leave, or an owner or admin removes you |
| Your account record and early-access permission | Until you ask us to delete them. Even then your two Microsoft ids stay, with the organizations you left, so that only a new invitation can bring you back into them; your name and email address go |
| The activity log | 12 months for each entry |
| Service logs | 30 days |
| A connection and your organization's cloud data | Until the subscription is disconnected, which deletes them at once; the activity log's lines about it follow the activity log (see the data processing agreement) |
How it is protected
Gildyard holds only read-only roles on your subscriptions and never changes your resources. The one thing it ever writes is the two role assignments you ask for with Do it for me, with your own Azure sign-in. The app signs in to Azure with a managed identity, so no client secret exists in any deployed environment. Storage keys are switched off, and the data sits in one private container that only the app and, for support, the operator's own Azure account can reach. Who may see a yard is checked on every request. The data processing agreement lists every measure.
Your rights
You can ask to see, correct, export or delete your data, to limit how we use it, or to object to it; and you can stop hearing from us at any time. Email [email protected] from the address you use with Gildyard and we'll answer within 30 days. For your organization's cloud data, ask your organization's owner or admin: they decide, and we help them. You can also complain to the Portuguese data protection authority, the CNPD, or the authority where you live.
Changes
When this page changes, the date at the top changes too. If a change matters for what we do with your data, we'll say so in the app or by email before it takes effect.