Cookie Policy
What we store on your device, why, for how long, and how to change your mind.
Summary
Without your consent we store only what the feature you use needs: sign-in, the free-tool scan sessions, the inputs you give a tool and your consent record. Vercel Web Analytics runs only if you accept it and sets no cookie; our own tool counters, which store nothing on your device, are described in section 04. There is no advertising and no cross-site tracking. Change your choice any time from Cookie preferences in the footer.
Summary
This Policy covers the cookies and similar storage (local storage and session storage) used on itsailor.io, including the client dashboard. The controller is Michal Jatczak, trading as ITSailor, a sole trader registered in Malta (Malta VAT MT32760411).
Storing or reading information on your device needs your consent unless it is strictly necessary for a service you asked for: Article 5(3) of the ePrivacy Directive (2002/58/EC), transposed in Malta by regulation 5 of the Processing of Personal Data (Electronic Communications Sector) Regulations (S.L. 586.01). Analytics, and any other storage that is not strictly necessary, is used only after you opt in, and refusing is as easy as accepting.
Categories
- Strictly necessary, always on. Needed to provide what you asked for, so exempt from consent under the second sentence of Article 5(3) and regulation 5(2) of S.L. 586.01. Any personal data in them is processed under Article 6(1)(b) or 6(1)(f) GDPR.
- Analytics, opt-in. Vercel Web Analytics, which sets no cookie (section 04).
- Nothing else. No functional, advertising or marketing cookies are in use, so the banner does not offer them. If we ever add one, we list it here and ask for your consent before it runs.
What we store
Every item below was traced to the code that sets or loads it. Each is set only when you use the feature it serves, for example when you sign in or start a scan.
Cookies
| Name | Purpose | Set by | Duration |
|---|---|---|---|
itsailor_consent_v1 | Records the choices you made in the cookie banner, the version of the consent form they apply to and a random consent ID, so you are not asked again on every page. | itsailor.io (first-party cookie, with the same value in local storage) | 12 months from your decision, then the banner asks again. The local-storage copy stays, only to preselect your earlier answers, until you decide again or clear your browser storage |
__Host-next-auth.csrf-token | Protects Microsoft sign-in against cross-site request forgery. Set when you start signing in, or open the dashboard. | itsailor.io (first-party, httpOnly, Secure) | Browser session |
__Secure-next-auth.callback-url | Remembers the page to return to after Microsoft sign-in. Set together with the cookie above. | itsailor.io (first-party, httpOnly, Secure) | Browser session |
__Secure-next-auth.state | Ties a Microsoft sign-in you started to the answer Microsoft sends back. | itsailor.io (first-party, httpOnly, Secure) | 15 minutes, only while you sign in |
__Secure-next-auth.session-token | Keeps you signed in to the client dashboard after you sign in with your Microsoft work account. | itsailor.io (first-party, httpOnly, Secure) | 8 hours after you last use the dashboard, or until you sign out |
portal_claim | Links a purchase to the Microsoft account you sign in with, when that account differs from the email you paid with. Set only when you continue to sign-in from a claim link we sent you. | itsailor.io (first-party, httpOnly) | 15 minutes |
panel_company_id | Remembers which of your companies the dashboard opens on. Set only when a signed-in user switches company, and only to a company the account belongs to. | itsailor.io (first-party, httpOnly) | 12 months, or until you sign out |
__Host-m365-scorecard-oauth, __Host-offboarding-oauth | Set when you start a Microsoft-verified scan in the Tenant Security Scorecard or the offboarding check. Holds a hash of the sign-in state, so the answer from Microsoft can be matched to your browser. | itsailor.io (first-party, httpOnly, Secure) | 5 minutes |
__Host-m365-scorecard-scan, __Host-offboarding-scan | Links your browser to the scan result while the page shows it. | itsailor.io (first-party, httpOnly, Secure) | 10 minutes |
__Host-directus_session_token, __Host-directus_refresh_token | Keep the site operator signed in to the administration dashboard. Customers never receive them: client accounts sign in with Microsoft. | itsailor.io (first-party, httpOnly, Secure) | Session token: the lifetime the identity service returns. Refresh token: 7 days. Both 30 days when the operator chooses to stay signed in |
Local and session storage
| Key | Purpose | Kept in | Duration |
|---|---|---|---|
m365-scorecard-v3 | Your answers in the Tenant Security Scorecard, saved as you answer so a reload does not lose them. | Session storage | Until you close the tab |
m365-scorecard-token, m365-scorecard-remember | Only if you tick "Remember this result": a random key that lets this browser reopen your saved score history. | Local storage | Until you untick it or clear your browser storage |
its-marketplace-cart-v1 | The licences in your marketplace basket. Written when you add a licence. | Local storage | Until you empty the basket, which removes it, or clear your browser storage |
lead_email_session | The email address you leave with a Tenant Security Scorecard result, so a free tool that sends you its result does not ask again. | Session storage | 8 hours, and never beyond the browser session |
Each storage key holds what you entered or chose in the feature that writes it and is used only to run that feature, so we treat it as strictly necessary for that feature. No functional or marketing cookie is set, and analytics sets none.
Analytics and counters
Vercel Web Analytics loads only after you accept analytics, and it sets no cookie. It sends page views and a few conversion events, such as a checkout started, through a path on itsailor.io to Vercel, our hosting provider. Before an event leaves your browser, the query string is cut to campaign tags, the fragment is dropped, report identifiers in the address are replaced by a placeholder, and the address you came from is cut to its domain. Dashboard and checkout pages send no page view.
Vercel states that it recognises a visitor by a hash of the request that resets every day rather than by a cookie, and that the records it stores are not tied to an IP address; it derives country and city from the IP address. The data is processed mainly in the United States, under the transfer basis in the Subprocessor Register. Vercel discards the visitor code after 24 hours. We can see 12 months of page views; Vercel may keep them longer, at the latest until our agreement with it ends, when its terms require it to delete them. For the usage data its service generates, Vercel is a controller in its own right. The script reads one local-storage entry, __va_attribution, which only features we do not use write, so it stays empty. See Vercel's Web Analytics privacy page.
Our own counters run whatever you choose in the banner, on the basis of our legitimate interest in knowing whether the free tools work (Article 6(1)(f) GDPR). Our server counts when a free tool is started, completed or fails, when the SaaS Auditor completes a scan, and when someone arrives from a tagged campaign link. Each count stores the event, the tool or campaign label, the domain of the referring site and a timestamp. The counters store nothing on your device and do not store your IP address or any identifier. You may object by writing to privacy@itsailor.io (section 08).
Your choices
On your first visit a banner offers Accept all, Reject all and Customise, each one click away. Rejecting costs nothing and the site works in full.
- Change or withdraw your choice at any time with Cookie preferences in the site footer, which also offers a button to withdraw all consent. Analytics stops from the next event, on the page you are reading too. Withdrawing does not affect processing that was lawful before it (Article 7(3) GDPR).
- 12 months. After that the banner asks again, with your previous answers preselected. It also asks again if we add a category or change a purpose.
- Browser signals. If your browser sends Global Privacy Control or Do Not Track, we record Reject all for you and the banner does not ask. If you then turn analytics on in Cookie preferences while the signal is on, that choice stands until it expires after 12 months or you change it. A choice you made before switching the signal on is replaced by Reject all. The check runs in your browser.
- Record of your choice. Each choice is also logged on our server: the event (accept, reject, save or withdraw), the categories, the consent form version, the random consent ID that is also in your cookie, your browser's user agent, a timestamp and, when the hashing key is configured, a salted hash of your IP address. The address itself is not stored. The Privacy Policy sets how long it is kept.
Third parties
No advertising pixels, social widgets or video embeds are loaded. These third parties receive a request from your browser only on the pages or features that use them:
- Stripe. Purchases and the billing portal open on Stripe's own pages, where Stripe's cookie policy applies.
- Microsoft. Signing in to the dashboard, and granting a free tool access to a tenant, happen on Microsoft's pages under Microsoft's cookie policy.
- Google Workspace. The SaaS Auditor connector sends an administrator to Google's consent screen, under Google's policy.
- Cal.com. Booking links open Cal.com in a new tab, under its own policy.
- Vercel Web Analytics, only if you accept analytics (section 04).
Changes to this Policy
We update this Policy whenever the inventory changes, with a revised date. A material change (a new provider, category or purpose) is announced by email to active customers where we can, and in every case the banner asks you again before anything new that needs consent runs. Corrections that change nothing your browser stores are made with a revised date.
24 October 2026. The banner and Cookie preferences no longer offer Functional and Marketing, because none is in use; nothing ever ran under them. The banner asks you once more so your recorded choice matches the form. Requests and objections now go to privacy@itsailor.io.
20 October 2026. The contact form no longer uses Google reCAPTCHA: it sets no cookie and loads no third-party script. Our own server stops abuse with a rate limit, a hidden field and a minimum fill time. The Tenant Security Scorecard keeps your answers for the tab only, and a choice you make in Cookie preferences while your browser sends a privacy signal now stands (section 05).
19 October 2026. This Policy now lists browser storage and the first-party counters that run without consent. An earlier version said that no analytics request is sent if you decline analytics; the counters in section 04 are sent. The site also stopped setting the sign-in cookies before you start signing in, stores the marketplace basket only once it holds a licence, and now removes every sign-in cookie when you sign out; before this change a browser could keep the secure ones after sign-out.
Contact and complaints
- Privacy questions and data subject requests, including withdrawing consent in writing: privacy@itsailor.io
- Legal: legal@itsailor.io
Postal: Michal Jatczak, trading as ITSailor, Level 1, Unit 60, Door No 63, Connecticlub Business Center, Triq Il-Ballut (Zona Industrijali, Mosta), MST 4001, Mosta, Malta.