Legal & Compliance

# Privacy Policy

ComputerGuru — AI Remediation Application • Effective April 20, 2026

This Privacy Policy describes how Arizona Computer Guru LLC ("ACG," "we," "us") accesses and handles Microsoft 365 tenant data through our internal security tool, the ComputerGuru — AI Remediation application (Microsoft Entra App ID: `fabb3421-8b34-484b-bc17-e46de9703418`). This application is a multi-tenant Microsoft Graph API application used exclusively by authorized ACG technicians.

01

## What This Application Is

The ComputerGuru AI Remediation application is an internal MSP security tool used by Arizona Computer Guru LLC technicians to perform point-in-time security investigations on client Microsoft 365 tenants. It is not a commercial software product and is not available to the general public.

The application accesses client tenants exclusively through Microsoft admin consent, granted by the client organization's global administrator. Access is never obtained without explicit, verified authorization from the client organization.

02

## What Data Is Accessed

When performing a security investigation, the application may read the following data from the client Microsoft 365 tenant via Microsoft Graph API and Exchange REST API:

- Sign-in logs and authentication history (interactive sign-ins, 30-day window)
- Mailbox inbox rules, including rules not visible through standard Outlook interfaces
- Mailbox forwarding configuration (ForwardingAddress, ForwardingSmtpAddress)
- Mailbox delegate permissions and SendAs grants
- OAuth2 permission grants and application role assignments for individual users
- Registered authentication methods (MFA methods, creation dates)
- Directory audit logs (30-day window, scoped to the investigated user)
- Identity Protection risky user signals and risk detections
- Recent sent items and deleted items (read for anomaly detection; limited to 25 items)
- Basic user profile attributes (display name, UPN, account status, password change dates)

03

## How Data Is Used

Data accessed through this application is used solely for the following purposes:

- Identifying indicators of account compromise, unauthorized access, or credential theft
- Detecting malicious inbox rules, unauthorized forwarding, or suspicious OAuth grants
- Producing a written security investigation report delivered to the client organization
- Performing authorized remediation actions (session revocation, forwarding removal, etc.) at the client's explicit request

Data is not stored. All data accessed through this application remains within the technician's active work session. Raw API responses are written to temporary local storage (`/tmp/remediation-tool/`) and are not transmitted to any external server, database, or third-party service. Temporary files are not retained beyond the work session.

04

## Data Retention & Storage

Arizona Computer Guru LLC does not maintain a persistent database of client Microsoft 365 data obtained through this application. Specifically:

- No client mailbox content is retained after the investigation session
- No sign-in log data is stored in ACG systems beyond the session
- Investigation reports are retained in ACG's secure, encrypted internal systems as part of the client service record, consistent with standard MSP documentation practices
- Client data is never sold, licensed, or shared with any third party

05

## Authorization & Access Control

This application operates exclusively under the following access controls:

- Admin consent required: The application cannot access any tenant without a global administrator explicitly approving access through Microsoft's admin consent flow
- Authorized technicians only: Only credentialed Arizona Computer Guru LLC staff members have access to the application credentials and tooling
- On-demand only: The application does not run continuously or on a schedule. It is invoked only when an authorized investigation is in progress
- Consent revocable: Client organizations may revoke access at any time through their Microsoft Entra admin center (Enterprise Applications → ComputerGuru AI Remediation → Delete)

06

## Contact & Consent Revocation

For questions about this privacy policy, to request information about what data was accessed during an investigation, or to revoke consent:

Arizona Computer Guru LLC

Email: mike@azcomputerguru.com

Phone: (520) 526-9974

Website: azcomputerguru.com

To revoke application access directly: Microsoft Entra admin center → Enterprise Applications → ComputerGuru AI Remediation → Properties → Delete

07

## Changes to This Policy

Arizona Computer Guru LLC may update this privacy policy as the application's capabilities or our data practices change. The effective date at the top of this page reflects the most recent revision. Material changes will be communicated to active clients.