Effective 6 October 2026
Privacy Policy
How IAMCastle handles account information, Microsoft Entra evidence, website analytics and data-protection rights.
Effective date
Effective 6 October 2026. This policy applies to IAMCastle Auditor customer accounts and the public IAMCastle website.
1. Who we are
IAM CASTLE LIMITED, company number 17263388, registered office 4 Cobden Terrace, John Street, Rochester, United Kingdom, ME1 1TF, is the controller for the account, website, billing, security and business processing described in this policy. Privacy and data-protection enquiries can be sent to hello@iamcastle.io. IAM CASTLE LIMITED is not VAT registered.
2. Our data protection roles
When IAMCastle processes Microsoft Entra evidence solely to provide IAMCastle Auditor for a customer, the customer normally acts as controller and IAMCastle acts as processor under the Data Processing Agreement. IAMCastle acts as controller for its own account administration, billing, fraud prevention, platform security, legal compliance, website analytics and business records. Questions about an employer's or organisation's use of Entra data should normally be directed to that organisation.
3. Information we process
IAMCastle may process names, work email addresses, roles, organisation and Microsoft tenant identifiers; account roles, invitations, sessions, IP addresses and browser metadata; Stripe customer and subscription identifiers, plan and payment status; support, demo and communications content; consent choices; security and administration logs; and consent-based public website analytics. Stripe, rather than IAMCastle, holds full payment-card details.
4. Microsoft Entra evidence
On customer instruction, IAMCastle may process actor and object identities, timestamps, event types, change summaries, previous and new values, account and employment-related directory attributes, group and role relationships, device and application relationships, protected-account sign-in outcomes, Microsoft request and correlation identifiers, verification state, hashes and previous-hash values.
5. Where information comes from
Information may come directly from account users and contacts; from the customer organisation; from Microsoft Entra ID and Microsoft Graph after authorised connection; from Stripe about subscription status; from service, security and communications systems; and from Google Analytics only after public-site consent. Customer organisations are responsible for giving required privacy information to people represented in their tenant unless an exception applies.
6. Purposes and lawful bases
IAMCastle uses personal data to create and administer business accounts, authenticate users, protect tenants, prevent fraud, provide support, administer subscriptions, meet tax and legal obligations, respond to rights requests and complaints, establish or defend legal claims, and send essential service communications. Depending on the activity, IAMCastle relies on contract, legal obligation, legitimate interests in operating and securing a B2B SaaS service, or consent for non-essential public website analytics. Customer Entra evidence is processed on the customer controller's documented instructions.
7. Required and optional information
Business contact and authentication information is required to create and secure an account, and billing information is required for paid plans. Without it, IAMCastle may be unable to provide the relevant service. Public website analytics is optional and refusing it does not prevent use of the website or service.
8. Sharing and processors
IAMCastle shares information only as needed with the customer and its authorised users; verified IAMCastle personnel and contractors; hosting, database, authentication, email, billing, analytics, monitoring, support and backup providers; professional advisers, auditors and insurers; and authorities or other parties where instructed, authorised or legally required. Key providers include Microsoft Azure, Microsoft Entra ID and Graph, Azure Communication Services, Stripe and, for consented public pages only, Google Analytics. IAMCastle does not sell customer evidence or personal data.
9. International transfers
The standard production deployment uses Microsoft Azure UK South for primary application and database hosting. Some provider support, email, billing or analytics operations may process information outside the UK. Where a restricted transfer occurs, IAMCastle uses an applicable UK adequacy regulation or an approved safeguard such as the UK International Data Transfer Agreement or UK Addendum, together with the required data protection test and supplementary measures where needed. Further information is available through hello@iamcastle.io.
10. Security
IAMCastle uses measures appropriate to the risk, including tenant isolation, role-based access, MFA for platform administrators, read-only Microsoft Graph permissions, encryption in transit, provider-managed encryption at rest, tenant-scoped storage and queries, service authentication, audit logging, private temporary exports and evidence hash chaining. No system can guarantee absolute security.
11. Retention
Customer evidence may be retained for up to seven years from collection. It may be deleted earlier following account expiry or closure, an authorised deletion instruction, or an agreed special request, subject to identity and authority checks, technical processing time, legal obligations, dispute holds and backup ageing. Temporary export links expire after 24 hours and the associated private Blob object is scheduled for deletion after two days. Account, security, support, billing and tax records are retained only for as long as needed for their purpose and applicable law.
12. Account closure and deletion requests
A customer Admin may request account closure, an export in a standardised machine-readable format, or deletion through hello@iamcastle.io. IAMCastle verifies the requester and customer authority before acting. Access may be disabled promptly while export, deletion, backup ageing, billing and legal retention steps complete. IAMCastle may retain limited records where it acts as controller and has a legal obligation or other lawful reason, including tax, fraud prevention, security, dispute and compliance records.
13. Individual rights
Depending on the processing and applicable exemptions, individuals may have rights to be informed, access personal data, correct inaccurate data, erase data, restrict processing, receive portable data, object to processing and withdraw consent. The right to object to processing based on legitimate interests is specifically brought to your attention. Contact hello@iamcastle.io to exercise a right. IAMCastle may verify identity and authority and, where it acts as processor, will normally refer the request to the relevant customer controller and assist it.
14. Analytics and cookies
IAMCastle uses Google Analytics on public website pages only after a visitor provides consent. Analytics is not loaded on customer workspaces, onboarding, evidence or administration pages. IAMCastle does not send customer tenant identifiers, evidence identifiers or URL query strings in analytics events. Visitors can reject analytics or withdraw consent at any time.
15. Automated decisions
IAMCastle may assign operational risk labels or highlight changes for review. It does not currently make decisions based solely on automated processing that produce legal or similarly significant effects on individuals. Customers remain responsible for investigations and decisions made using the service.
16. Data protection complaints
Send a data-protection complaint to hello@iamcastle.io with enough information to identify the issue, relevant organisation and dates; never send passwords, MFA codes or access tokens. IAMCastle will acknowledge the complaint within 30 days, investigate it, keep the complainant appropriately informed and communicate the outcome without undue delay. If dissatisfied, a person may complain to the UK data-protection regulator through ico.org.uk/make-a-complaint or its successor.
17. Security incidents
IAMCastle investigates suspected personal data breaches. Where IAMCastle acts as processor, it notifies the affected customer controller without undue delay as required by the Data Processing Agreement. Where IAMCastle acts as controller, it notifies the regulator and affected individuals where applicable data protection law requires it.
18. Changes and contact
IAMCastle may update this policy when processing, providers, law or services change. The effective date will be displayed, material changes will be communicated appropriately, and earlier versions will be retained for audit history. Privacy enquiries, rights requests, complaints and requests for transfer-safeguard information should be sent to hello@iamcastle.io or by post to the registered office above.