This policy describes what &License collects, why, on what lawful basis, and how to get it deleted. Last updated October 27, 2026.
Who is the controller
&License is the controller for your account data — your name, email and how you use the product. For the tenant data we read on your instruction, you are the controller and we are the processor.
If you are an MSP, you are the controller for your clients' tenant data and we process it on your instruction. Our data processing addendum is available on request and is signed as standard for MSP accounts.
What we collect
We collect three categories of data, and nothing else. Every field below has a direct purpose in producing your waste report.
Account data — your name, work email, job title, time zone and password hash, collected when you sign up.
Directory metadata — user accounts, license assignments, SKUs, group membership, account status and interactive sign-in timestamps, read from your identity provider.
Spend metadata — vendor names, amounts, dates and descriptions from the card or accounting platform you connect, used to price findings and detect apps IT never bought.
Product analytics — which pages you open and which actions you take in &License. Never sold, never shared with advertisers.
What we never collect
We do not request, receive or store the contents of anything. No mailbox contents, no files, no chat messages, no documents, no calendar bodies, no call recordings. The scopes we request are read-only and are listed in plain language on our scopes page.
We also do not use your data to train models, and we do not sell or rent it to anyone under any circumstance. If a connector ever required a content scope to work, we would not ship that connector.
Why we process it, and on what basis
Account data is processed to authenticate you, support you and bill you — necessary for performance of our contract with you. Directory and spend metadata are processed to identify unused and over-tiered licenses, which is the service you asked us to perform, again under contract. Product analytics are processed under legitimate interest in improving the product, and you can object at any time.
How long we keep it
Thirteen months of history, so trend lines and renewal comparisons work. Older snapshots are deleted on a rolling nightly basis. Delete your workspace from company settings and everything we hold about that tenant is removed within seven days, backups included, and we confirm in writing.
Who we share it with
Only the subprocessors listed on our security page, each of which is contractually bound and processes data solely on our instruction. We give 30 days' notice before adding one, and you can object.
Your rights
You can access, correct, export or delete your data at any time. Export is self-serve from any table in the product; deletion is self-serve from company settings. For anything else, write to us and we will respond within 30 days.
International transfers
All data is held in United States infrastructure. Where data originates in the EEA or UK, transfers rely on standard contractual clauses, and an EU representative has been appointed.
Contact
Write to privacy@andlicense.com. A person reads it.
&License
See what you're paying for that nobody uses. Read-only, connected in minutes, priced per user.