In short
- We read client tenants with read-only access and never store sign-in tokens.
- We never sell data, use it for advertising, or use it to train AI.
- Reports are kept for 90 days, or longer if the MSP chooses, and can be deleted at any time with "Delete now".
1. Who we are
This policy is issued by Inputiv LLP, a limited liability partnership registered in India (LLPIN ACG-0686), with its registered office at 106, Rajat Sankul, Wing No. 5, S T Stand, Ganeshpeth, Nagpur, Maharashtra 440018, India ("we", "us"). It explains what personal data we handle through mspsnaps.com and the MSPSnaps app, and why.
We act in two roles. As a Data Fiduciary, we decide how we use data about our own users and website visitors, such as the name and work email of someone at a managed service provider ("MSP") who creates an account. As a Data Processor, we handle data read from a client's Microsoft 365 tenant, and from the MSP's Autotask and NinjaOne, only on the instructions of the MSP that ran the check. Questions about that data should go first to the MSP.
This policy is written to meet India's Digital Personal Data Protection Act, 2023, the DPDP Rules, 2025 and, until they are replaced, the Information Technology Act, 2000 and its rules on sensitive personal data.
2. What we collect
From MSP users: name, work email, company name and role, given at sign-up; and the logo and brand colour uploaded for reports.
From website forms: name, work email, company and message.
From a client's Microsoft 365 tenant, after a Global Administrator approves read-only access: names and sign-in names of accounts, admin roles, the types of MFA method registered (never phone numbers or secrets), licences, last sign-in or activity dates, mailbox types, policy names, tenant settings such as external sharing, domain names, the names and permissions of apps that hold access, device names and operating system versions, and Microsoft Secure Score. From the MSP's own Autotask and NinjaOne, through read-only API credentials the MSP provides: client company names, tickets, time entries, billing items, projects and technician names, and client organizations and devices with their operating systems, patch and backup status. Those API credentials are stored encrypted and deleted as soon as the MSP revokes them.
From visitors: technical data such as the request method, page path, time and browser type, recorded by our servers.
We never collect email contents, files, chat messages, passwords, or the sign-in tokens used to read a tenant. Tokens stay in the MSP's browser. Our server logs never include query strings, tokens or tenant data.
3. How we use it
To run checks and build reports for the MSP, on its instructions as its processor.
To create and secure accounts and send sign-in and notification emails, with the consent given at sign-up.
To reply to enquiries and demo requests, with the consent given when you contact us. You can withdraw that consent at any time.
To keep the service secure, prevent misuse and meet legal duties, as the law permits.
We do not sell personal data, use it for advertising, or use it to train artificial intelligence. The check itself uses no AI: every finding is calculated directly from the tenant's settings and data.
4. Who we share it with
We share personal data only with these service providers, under written contracts that let them use it only to serve us: Render, which hosts the app and its database in the United States (Oregon); Resend, which sends our emails from the United States (North Virginia); Webflow, which hosts the website and its forms in the United States; and Microsoft, whose sign-in and Microsoft Graph are called from the MSP's browser.
The MSP decides who can see a report. Anyone with the share link can open it until the link expires or is deleted.
We may disclose personal data when Indian law requires it, for example to a court or a government agency with legal authority to ask.
We are based in India and store data in the United States. The DPDP Act allows this unless the Government of India restricts transfers to a specific country, and we will follow any such restriction. We will tell you before adding a new provider.
5. How long we keep it
Reports: 90 days by default, or longer if the MSP chooses to keep a report, until the MSP selects "Delete now". Share links: stop working after 30 days. MSP account data: while the account is open, then deleted within 30 days of closure. Form details: until you ask us to delete them, and at most 24 months after our last contact. Security logs: at least one year, as the DPDP Rules require, then deleted.
We protect data with HTTPS for all traffic, encryption at rest in our database, read-only access to client tenants, and access to production systems limited to the staff who need it.
If a personal data breach happens, we will tell the Data Protection Board of India and the people affected, as the DPDP Rules require. For check results, we will also tell the MSP straight away so it can inform its client.
6. Your rights
Under the DPDP Act you can ask for a summary of the personal data we hold about you and who we shared it with; correct, complete or update it; have it erased when we no longer need it, unless the law requires us to keep it; withdraw consent at any time, as easily as you gave it; nominate someone to use these rights for you if you die or become unable to; and raise a grievance, which we will resolve within 90 days. If you are not satisfied, you can complain to the Data Protection Board of India.
To use any right, email hello@mspsnaps.com or use the link in your account settings. We may ask you to confirm your identity first.
If you work for an MSP's client and your details appear in a report, the MSP that ran the check controls that data. Please contact them first; we will help them answer you.
If you are outside India, for example in the United States, you can use the same rights by contacting us, and we will honour any further rights your local law gives you.
7. Cookies, children and changes
The app uses only the cookies it needs to keep you signed in and secure. The website uses no analytics or advertising cookies. If we add analytics, we will update this policy before it goes live.
MSPSnaps is a service for businesses. It is not meant for anyone under 18, and we do not knowingly collect data about children.
When we change this policy, we will update the date at the top. If a change affects how we use your data, we will email account holders at least 30 days before it takes effect.
8. Contact and grievance officer
Grievance Officer: Pratik Shende, Director.
Email: hello@mspsnaps.com. Post: Inputiv LLP, 106, Rajat Sankul, Wing No. 5, S T Stand, Ganeshpeth, Nagpur, Maharashtra 440018, India.
We acknowledge every request within 7 days and resolve grievances within 90 days.