Privacy Policy

This Privacy Policy describes how IntuneAutomation.com (the "Service") handles your data. The Service is designed with a privacy-first approach: it stores no prompts, no generated output, and no personally identifiable information on its own servers.

Data Access

The Service does not use OAuth, does not authenticate against Microsoft Graph on your behalf, and does not access your Microsoft tenant, Intune environment, or any data within them. The AI Script Generator is fully read-only at the source level — it takes a natural-language description from you and returns a PowerShell script your browser can copy or download.

Data Processing

The Service minimizes data persistence. When you submit a prompt to the Script Generator:

• The prompt is transmitted from your browser to a serverless function on Vercel
• Before being sent to the language-model provider, the prompt is scrubbed by a server-side regex pass that redacts GUIDs (tenant / app / object IDs), JWT tokens, bearer tokens, common API key prefixes, email addresses, and long encoded blobs. The redaction summary is shown to you so you can verify
• The scrubbed prompt is forwarded to Anthropic PBC for processing by the Claude Haiku 4.5 language model. The streaming response is sent back through our function to your browser
• The full prompt content and generated output are never stored on our servers. Vercel function logs are not retained with request body content
• For rate limiting only, we store an SHA-256 hash of your IP address (truncated to 128 bits) and a counter of how many generations you have run in the last 24 hours. The hash is not reversible to your real IP
• For the daily spend cap, we store an aggregate counter of total tokens used per UTC day, with no prompt or user association

Analytics

The website uses Plausible Analytics, which is 100% cookieless and does not track personal data. Only aggregate metrics such as page views, referrers, and device types are collected anonymously. The Service also stores anonymous, aggregate counters of script views and downloads from the script library in Supabase; these counters contain no personally identifiable information.

Third-Party Processors

The Service relies on the following sub-processors:

• Anthropic PBC (United States) — processes Script Generator prompts via the Claude API. Anthropic does not use API inputs to train its models. Anthropic retains API content for up to 30 days for trust-and-safety review and may retain content flagged by their automated systems for up to 24 months. See Anthropic's Privacy Policy
• Vercel (United States) — hosting and serverless function execution
• Cloudflare — Turnstile bot verification on the Script Generator form. Turnstile may set short-lived cookies for verification only
• Upstash — Redis cache used to store the hashed-IP rate-limit counter and the daily token cap counter
• Supabase — stores anonymous, aggregate script-library counters (views, downloads). No personal data
• Plausible Analytics (European Union) — privacy-friendly website analytics

Data Sharing

We do not sell or share your prompts, generated output, or any other data with parties other than the sub-processors listed above, which are used strictly to operate the Service. We do not share data for advertising purposes.

Cookies

The Service does not use tracking cookies. Your theme preference (light / dark mode) is stored in your browser's local storage. Cloudflare Turnstile may set short-lived cookies as part of bot verification only.

Your Rights (GDPR / EEA)

If you are located in the European Economic Area, the United Kingdom, or another region with comparable data-protection law, you have rights including access, rectification, erasure, and objection to processing. Because the Service stores no prompts, no output, and no personally identifiable information, most requests have nothing to act on. If you have questions or wish to exercise a right, contact us at the address below.

Children

The Service is intended for IT professionals and is not directed to children under 16. We do not knowingly collect data from children.

Security

The Service is served over HTTPS. The Anthropic API key and other secrets are server-side environment variables and are never exposed to the browser. The generation endpoint is protected by Cloudflare Turnstile, per-IP rate limiting, and a daily spend cap to prevent abuse.

Changes

We may modify this Privacy Policy from time to time. Material changes will be reflected on this page with an updated effective date.

Contact

Privacy questions: support@ugurlabs.com