Intune Documentation
Intune Documentation

Privacy Policy

Effective: September 28, 2026

This Privacy Policy explains how Intune Documentation Generator ("we", "our", or "the Service") handles information when you use the app to generate documentation from Microsoft Intune. We designed the Service to minimize data collection and focus on privacy by default.

Data Controller

The controller responsible for data processing in connection with the Service is:

Ugurlabs UG (haftungsbeschränkt)
Fährstraße 217
40221 Düsseldorf, Germany
Managing Director: Ugur Koc
Email: support@ugurlabs.com

What We Access

  • Authentication via Microsoft OAuth 2.0 (Azure AD). We request read-only Microsoft Graph permissions necessary to list Intune configurations and related assignments.
  • Intune configuration metadata and settings required to render your documentation (policies, profiles, script and remediation resources, assignments, and related details), read-only.
  • For service-usage measurement, we process your tenant ID and user principal name. The monthly-active-user tracker stores SHA-256 hashes of those identifiers, not their raw values.

How We Process Data

  • Our application server uses your delegated access token to retrieve Microsoft Graph responses during the active request. It processes those responses transiently to collect, normalize, and redact them; it does not persist your token or Intune configuration data.
  • Sensitive values, including script bodies, passwords, tokens, pre-shared keys, QR-code payloads, and encoded configuration-file contents, are replaced with [Redacted] before data is displayed in the dashboard or included in an export.
  • PDF and DOCX generation happens in your browser. We do not upload or persist your generated documents.
  • The dashboard saves a compressed configuration snapshot and resolved assignment group names in your browser tab's sessionStorage so a page reload can restore your work. Stored snapshots expire one hour after collection and are checked before restoration and when a tab resumes. Expiry removes the stored copy; an already open report remains usable. Signing out signals other open app tabs to clear their sessions without sending tenant data. This snapshot is scoped to your signed-in account, tenant, and collection options. Signing out clears it; closing the tab normally ends its browser session. Browsers may restore session storage when restoring tabs, so expired snapshots are rejected even after a browser restart. It is not stored on our server, in localStorage, or in IndexedDB. If session storage is unavailable or full, the dashboard works without saving a snapshot.
  • Access tokens are managed in your browser session by MSAL and presented to our application server only for the active Graph collection request; we do not persist them server-side.

Analytics & Cookies

We use privacy-friendly analytics (Plausible) on the public site only to understand aggregate website usage without cookies or personal identifiers. We also maintain service-level usage counters to understand active organizations and document exports.

  • Plausible Analytics is 100% cookieless and does not track personal data or use browser fingerprinting.
  • Plausible collects aggregated metrics such as page views, referrers, and device types.
  • When the dashboard is opened, our monthly-active-user tracker stores pseudonymous SHA-256 hashes of the user principal name and tenant ID. Operational logs may also contain the tenant ID, a hashed user identifier, the request context, and timestamp.
  • We increment an aggregate export counter when a document is generated. That counter does not contain Intune configuration data or a user identifier.
  • Your consent preference for analytics is stored in localStorage (not a cookie) and remains on your device only.
  • You can change your analytics preference at any time by clearing your browser's local storage or declining via the consent banner.

Support Chat

The hosted Service uses Crisp IM SAS ("Crisp") to provide support chat on the public site and throughout the app. App chat opens in an isolated panel served from intunedocumentation.com. Chat scripts cannot access the app’s session storage or authentication tokens. We do not pass account details or tenant configurations to the panel. The app does not run analytics scripts. Self-hosted deployments require a separate public origin to enable chat.

  • When you use the support chat, Crisp may process your IP address, browser and device information, the page where you opened the chat, message content, and any contact details or attachments you voluntarily provide.
  • Crisp uses functional session cookies to maintain the conversation and restore message history. With Total Privacy Mode enabled, Crisp initializes the session only after you open the chat widget.
  • We do not automatically send Microsoft access tokens, Intune configuration responses, generated documents, tenant IDs, or user principal names to Crisp.
  • Do not submit access tokens, passwords, unredacted tenant exports, or other secrets through the support chat.

Support form

When you use the contact support form, we send your name, email address, subject, and message to our support mailbox through Resend. Your email address is included as Reply-To so we can respond directly. The application does not store or log form submissions. The email is processed by Resend and our mailbox provider.

The form uses Cloudflare Turnstile to prevent automated spam. Cloudflare processes browser and network information for this verification. The form does not attach Microsoft account details, access tokens, or tenant configurations to your message.

Desktop App

The paid Intune Documentation desktop app for macOS and Windows collects your Intune configuration on your own computer. It signs in with an Entra app registration in your own tenant and calls Microsoft Graph directly from your machine. Your tenant configuration, Microsoft access and refresh tokens, and exported documents never reach our infrastructure.

To check your subscription, the app contacts our licensing service when you activate a license and periodically afterwards. The licensing service receives:

  • your license key and a short-lived Microsoft sign-in token (ID token), or only the token when your organization shares its license with your tenant. We verify the token and use only its tenant ID and the ID of the app registration it was issued to. The token is not stored;
  • a random installation ID generated by the app, which does not identify you or your device hardware;
  • the Microsoft Entra tenant ID you signed in to;
  • when you use a license key, the client ID of the Entra app registration you signed in with, so a shared license is limited to that app registration;
  • your operating system (Windows, macOS, or Linux);
  • the app version;
  • your IP address, which is processed at the request level by our hosting provider and used transiently to limit request rates.

Purpose and legal basis: we use this data only to validate your subscription, to enforce the tenant and installation limits of your plan, and to let other administrators who sign in to that tenant's Intune Documentation app registration use a license that its key holder shares with the tenant. The processing is necessary to perform our contract with you (Art. 6(1)(b) GDPR).

Retention: each activation (installation ID, tenant ID, operating system, and app version) is stored with your license key in Polar for the lifetime of your subscription. You can remove an activation at any time by deactivating the license in the app or in the Polar customer portal. When a key holder shares a license with their tenant, we store the tenant ID, the client ID of the app registration they signed in with, and the Polar ID of the license key (never the key itself) in our own database until sharing is turned off or the license ends. We do not store other activation data in a database of our own.

Processors: Polar Software Inc. acts as merchant of record. Polar processes payments, invoices, taxes, and license keys, and receives your billing details directly when you purchase, under its own privacy policy. The licensing service is hosted on Vercel Inc., which processes request data such as IP addresses on our behalf. Supabase Inc. hosts the database that holds shared tenant licenses. These providers may process data outside the European Economic Area under appropriate safeguards such as the EU Standard Contractual Clauses.

Update checks: unless you turn off automatic update checks in the app's settings, the app asks our update service for the latest version shortly after launch and every four hours. The request contains no tenant or account data. It includes a random identifier that the update component creates on your device for staged rollouts, and our hosting provider processes your IP address at the request level. Installer files are downloaded from GitHub, which receives standard request data such as your IP address.

On your device: the app stores the signed license token and, if you entered one, your license key encrypted with the operating system keychain (Keychain on macOS, DPAPI on Windows). The token does not contain your license key.

Data Sharing

We do not sell or share your configuration data with third parties. Data accessed from Microsoft Graph is used solely to generate your documentation. Crisp processes only the support information described above on our behalf when you use the chat.

Security

  • Authentication is handled via Microsoft OAuth 2.0 (Azure AD).
  • Only read-only Graph permissions are requested for Intune data.
  • Sensitive configuration values are redacted before dashboard display or export.
  • We do not persist tenant configuration data; documents are generated on demand in your browser.

Data Retention

We do not retain your Intune configuration data or generated documents. Pseudonymous monthly-active-user records and aggregate export counts are retained for service measurement and administration. Operational logs may exist within hosting-provider systems, but the Service does not intentionally write Microsoft Graph response bodies or access tokens to those logs. Support conversations and voluntarily submitted attachments are retained in Crisp until they are deleted under our support-data retention practices or in response to an applicable deletion request.

Your Choices

  • You can disconnect at any time by signing out of the app.
  • You can revoke the app's permissions from your Microsoft account/tenant to prevent future access.

Your Rights (GDPR & CCPA)

If you are located in the European Economic Area (EEA), United Kingdom, or California, you may have additional rights under the GDPR or CCPA, including:

  • Right to access: Request a copy of any personal data we process about you.
  • Right to deletion: Request that we delete your personal data.
  • Right to opt-out: Opt out of any data processing that constitutes a sale or sharing of personal information (we do not sell or share personal data).
  • Right to rectification: Request correction of inaccurate personal data.

We do not persist your Intune configuration data, but the pseudonymous usage records described above may be stored. To ask about, access, or delete applicable personal data, contact us at the email below.

Children's Privacy

The Service is intended for professional/enterprise use and is not directed to children.

Changes

We may update this policy to reflect improvements or operational changes. If we make material changes, we will update the effective date above.

Contact

Questions about this policy? Contact us at support@ugurlabs.com or via LinkedIn: @ugurkocde.

You can also reach us by post: Ugurlabs UG (haftungsbeschränkt), Fährstraße 217, 40221 Düsseldorf, Germany.

Privacy Policy | Intune Documentation