Privacy policy
Last updated October 12, 2026
This policy explains what information FlowInherit (“FlowInherit”, “we”) collects when an organisation uses FlowInherit with its Microsoft 365 tenant, and when people visit this website.
Two kinds of information
Your organisation's directory data. When your organisation connects its Microsoft 365 tenant, FlowInherit processes information from that tenant on your organisation's behalf and under its instructions. Your organisation controls that data; we act as its processor.
Account and billing information. For the people who sign in to FlowInherit and the person who buys a plan, we decide how the information is used, as described below.
What we collect
From your Microsoft 365 tenant
- Names, sign-in names, Microsoft object IDs and whether accounts are enabled, for people in the tenant.
- Names, addresses, IDs and owners of groups, Teams, app registrations, distribution lists and shared mailboxes, and who has Full Access or Send As on mailboxes.
- Licence names and assignments, and the count of enabled accounts (to choose a plan).
- The changes made by each handover, and when.
FlowInherit does not read the content of email, files, chats, calendars or meetings.
From people who sign in
- Name, sign-in name, Microsoft object ID, FlowInherit role and sign-in times.
- A Microsoft sign-in token, encrypted, so scans and handovers can finish after you close the page.
- A record of what each person did in FlowInherit (the audit log your organisation can see and export).
For billing
The organisation name, billing contact, billing address and plan. Card details are collected and stored by Stripe, not by FlowInherit.
On this website
Our servers keep standard request logs (IP address, browser, pages requested) for security and troubleshooting. We don't use advertising or analytics trackers.
Cookies
FlowInherit sets one cookie, which keeps you signed in for up to 8 hours. It is required for the product to work. There are no other cookies.
How we use it
- To provide FlowInherit: run scans, snapshots and handovers, show reports and keep the audit log.
- To bill for plans and keep financial records.
- To keep the service secure and fix problems.
- To answer you when you contact us.
We don't sell personal information, share it for advertising, or use your tenant's data to train AI models.
Who else handles it
| Provider | What for |
|---|---|
| Microsoft (Azure) | Hosting the application and database |
| Microsoft (Microsoft 365) | Our own email, for support conversations |
| Stripe | Payments, invoices and the billing portal |
We may disclose information if the law requires it, and we will tell your organisation first where we are allowed to.
Where it is stored and how it is protected
Data is stored in Microsoft Azure data centres in the United States. It is encrypted in transit, each organisation's data is kept separate in the database, and sign-in tokens are encrypted. See Trust and security for details.
How long we keep it
- Tenant data, reports and the audit log: while your organisation uses FlowInherit. If your organisation stops using FlowInherit, ask us and we will delete its data within 30 days.
- Billing records: as long as tax and accounting law requires.
- Server logs: up to 30 days.
Your choices and rights
If you work for an organisation that uses FlowInherit, please contact your IT department first; they control the tenant data and can export or remove it. Depending on where you live, you may have rights to access, correct, delete or move your personal information, or to object to how it is used. To use them, email [email protected]. We will answer within 30 days.
Children
FlowInherit is a business tool and isn't meant for anyone under 16.
Changes
If we change this policy in a way that matters, we will update the date above and tell customers by email before it takes effect.
Contact
FlowInherit, [email protected]