Privacy Policy

Ombré (“Ombré”, “we”, “us”) provides a security platform that helps organizations discover and govern the third‑party SaaS and AI applications connected to their Google Workspace and Microsoft 365 environments. This Privacy Policy explains what information we collect, how we use it, and the choices you have. It applies to ombre.app and the Ombré application (the “Service”).

Information we collect

We collect the following categories of information:

• Account information. When you sign in with Google or Microsoft, we receive your name, email address, and profile picture to create and secure your account.
• Workspace security data. With your authorization, we use the Google Workspace Admin SDK and Microsoft Graph APIs to read metadata about your organization: the third‑party applications connected to your tenant, the OAuth scopes and permissions they hold, the users who granted them, and related directory information (users, groups, and, where enabled, managed devices). We use this data solely to power discovery, risk scoring, and remediation.
• Usage and technical data. We log limited technical information such as IP address, browser type, and actions taken in the Service, to keep it secure and reliable.

We do not request access to the content of your emails, files, or documents. We read application and permission metadata — not your users’ content.

How we use information

• Provide and operate the Service — discover connected apps, score their risk, generate triage recommendations, and let you revoke or block access.
• Secure the Service, prevent abuse, and troubleshoot problems.
• Communicate with you about your account, security alerts, and support requests.
• Comply with legal obligations.

We do not sell your data, and we do not use Google Workspace or Microsoft 365 data for advertising.

Google API Services — Limited Use

Ombré’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically, we only use Google Workspace data to provide and improve user‑facing features of the Service; we do not transfer or sell it; we do not use it for advertising or to train generalized AI/ML models; and no humans read it except as necessary for security, to comply with the law, or with your explicit consent.

Microsoft 365 data

When you connect a Microsoft 365 tenant, we access application and directory metadata through Microsoft Graph under the permissions you grant, and use it only to provide the Service. You can revoke Ombré’s access at any time from the Microsoft Entra admin center.

AI processing

Some features — for example, risk explanations and triage recommendations — send limited metadata such as application names, publisher information, and requested permission scopes to our AI processors to generate the analysis. This metadata is processed under the providers’ API terms and is not used to train their models. We do not send your users’ email, files, or document content to any AI provider.

How we share information

We share information only with service providers that help us run the Service, under contracts that require them to protect it:

• Cloud hosting and infrastructure (Google Cloud Platform).
• Transactional email delivery.
• AI processing providers, as described above.

We may also disclose information if required by law or to protect the rights, property, or safety of Ombré, our customers, or others. If Ombré is involved in a merger or acquisition, information may be transferred subject to this Policy.

Data retention

We retain your information for as long as your account is active or as needed to provide the Service. You may request deletion of your data at any time; we will delete it within a reasonable period, except where retention is required by law.

Security

We protect your data with encryption in transit (TLS) and at rest, envelope encryption for sensitive stored data, strict access controls, and support for multi‑factor authentication. No method of transmission or storage is completely secure, but we work hard to protect your information.

Your rights and choices

• Access, correct, or delete your personal information.
• Export your data.
• Disconnect a workspace at any time, which stops further data collection for that workspace.
• Revoke Ombré’s access from the Google or Microsoft admin console.

To exercise any of these rights, contact us at privacy@ombre.app.

International data transfers

We may process and store information in countries other than your own. Where we do, we take steps to ensure appropriate safeguards are in place.

Children’s privacy

The Service is intended for organizations and their authorized administrators. It is not directed to children, and we do not knowingly collect personal information from anyone under 16.

Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date above and, for material changes, provide additional notice.

Contact us

If you have questions about this Privacy Policy or our data practices, contact us at privacy@ombre.app.