Privacy

This website

This site sets no cookies, embeds no fonts or analytics from anyone else's servers, and has no advertising or tracking pixels. Everything it needs is served from this domain, with one exception described next. There is consequently no cookie banner, because there is nothing to ask you about.

The exception is the forms. To keep automated abuse out, the contact form on the pricing page and the request for preview access can run Cloudflare Turnstile, a check that you are a person. On those pages only, your browser loads Turnstile's script from Cloudflare, and Cloudflare sees what it needs to run that check, such as your browser's address and signals about the browser. Cloudflare's own privacy policy covers what it does with them. We receive only whether the check passed. No other page loads anything from Cloudflare.

Our web server records ordinary request logs — the requested address, the response code, an abbreviated client address, the user agent and the time — which exist to keep the site running and to notice abuse. They are retained for a short operational period and are not combined with anything else or used to build a profile.

If you submit the contact form on the pricing page or a request for preview access, what you type is delivered to our own mailbox as email, and may also be recorded in our own customer records so that a person can follow it up. It is kept under the same retention as our ordinary correspondence. We do not add you to a mailing list.

The OA6 product

The full technical account is on the security page. In privacy terms:

Who is who

For the tenant data OA6 reads on your behalf, you are the controller and we are a processor acting on your instructions. For your own account and subscription records, we are the controller.

What we process, and why

Your tenant's configuration and posture

Read from Microsoft Graph, under the consent your organization granted, to show you the answer you asked for. We do not retain it.

A masked snapshot, only if you turn on Ask OA6 and ask a question

Ask OA6 is off until an administrator turns it on. When it is on and you ask, a snapshot of what you have open is sent from your browser straight to the model you chose, to generate the answer: Claude under your organization's own Anthropic key, or your own model at an OpenAI-compatible endpoint. It does not pass through our servers and we never receive it, so your agreement with that provider governs it. Names, email addresses, your domains, object IDs and other identifiers are replaced with placeholders in your browser before it is sent; the Security page lists exactly what is masked and what is not.

Your tenant identifier, subscription and entitlements

Retained so that we know who has access to what. This is metadata about your tenant, not data from it.

A record of administrative actions taken through OA6

Retained so that you can see what was changed, by whom and when. The same actions also appear in your own Microsoft 365 audit log, attributed to the administrator who approved them.

What we never do

• We do not sell personal data, and we have no advertising business to sell it to.
• We do not hold your credentials. Sign-in happens at Microsoft and we never see a password or a second factor.
• We do not take payment card details. Where OA6 is sold, the billing relationship and the card data sit with Microsoft, not with us.
• We do not read one customer's records from another customer's session. Every stored record is partitioned on the tenant identifier Microsoft signs into the token, and that identifier is taken from the signed token rather than from anything a browser can set.

Where it is processed

Our services run on Microsoft Azure. Storage is regional, so records stay in the region assigned to your tenant; the only global record is the one that says which region that is. Sovereign and government clouds are not currently supported.

Your rights

You can revoke OA6's access to your tenant in Microsoft Entra ID at any time, without asking us, which stops all further reading immediately. To ask what we hold, to have it corrected, or to have it deleted, write to sales@oa6.cloud and we will respond within 24 hours. Deleting a subscription's records is irreversible and removes your action history along with it.

Changes

If this notice changes in a way that affects what we process or who we send it to, we will say so on this page and, for existing customers, by email to the administrator on the account rather than only by updating the page.