Privacy Policy

1. Who we are

Label Master ("Label Master", "we", "us") is the seller and data controller for the Label Master service. We provide a monitoring service for Microsoft 365 sensitivity label changes, external sharing, and related audit activity. This policy explains what data we collect, why, and how it is protected.

You can contact us at any time at contact@labelmaster.site.

2. Data we collect

Account data: your name, email address, and authentication credentials (passwords are stored only as hashes by our authentication provider).

Workspace configuration: your Microsoft Entra (Azure AD) app registration details — tenant ID, client ID, and client secret — which you provide so the service can read audit data from your own Microsoft 365 tenant. Client secrets are stored encrypted.

Monitoring data: Microsoft 365 audit records retrieved on your behalf, such as sensitivity label changes, file sharing events, guest activity, DLP matches, and related metadata (user principal names, file names and paths, timestamps, label identifiers).

Billing data: when you purchase a plan, payment details are collected and processed by our payment provider (Paddle). We do not store your full card number.

Usage and technical data: basic log and diagnostic information needed to operate and secure the service.

3. How we use data

To provide the monitoring, alerting, and reporting features of the service.

To authenticate you, secure your workspace, and enforce your plan limits.

To send transactional email (account verification, security notices, alerts and digests you configure).

To process payments and manage subscriptions.

We do not sell your data and we do not use your monitoring data for advertising.

4. Data isolation and access

Each customer's data is stored in an isolated workspace enforced by row-level security. Only members of your workspace, with the roles you assign, can access its monitoring data.

Platform staff access customer data only where necessary to operate, secure, or support the service, and such access is logged.

5. Data retention

Monitoring event history is retained according to your plan (for example 30 days, 90 days, or 1 year) and is automatically removed beyond that window.

Account and billing records are retained for as long as your account is active and as required by applicable law.

6. Subprocessors

We rely on a small number of subprocessors to deliver the service, including cloud hosting and database infrastructure, our payment provider (Paddle, acting as merchant of record), and transactional email delivery. Each processes data only as needed to provide its service to us.

7. Your rights

You may access, correct, export, or delete your account and workspace data. Workspace owners can delete a workspace from the settings area, which removes its monitoring data.

To exercise any privacy right, email contact@labelmaster.site. We respond within a reasonable timeframe.

8. Security

We use encryption in transit and at rest, row-level security, optional multi-factor authentication, and audit logging of administrative actions. No method of transmission or storage is perfectly secure, but we work to protect your data to a high standard.

9. Changes to this policy

We may update this policy from time to time. Material changes will be announced in the app or by email. The current version is always available at this page.