Privacy Statement.

1. Scope and roles

This Privacy Statement explains how Qvert LLC, a Texas limited liability company (“Qvert,” “Provider,” “we,” or “us”), processes information through TurtleNet. Qvert LLC operates qvert.net and provides TurtleNet as a product within the shared Qvert software family.

For information collected from a customer-controlled Microsoft tenant or another connected environment (“Customer Data”), the customer generally determines why TurtleNet is used and which access is authorized. Provider generally processes that Customer Data on the customer’s behalf to deliver the service, subject to the applicable agreement and law. Provider may independently control limited account, security, billing, service-operation, and business-contact information required to operate its business and protect TurtleNet.

2. Information TurtleNet may process

• Identity and account data: name, username, email address, Microsoft tenant identifiers, account or workspace identifiers, roles, authorization status, session identifiers, and authentication metadata returned by Microsoft.
• Cloud environment data: subscription and resource-group identifiers; resource identifiers, types, names, regions, tags, configurations, relationships, status, activity, and other metadata available through customer-approved Microsoft permissions.
• Customer-provided data: settings, labels, diagrams, annotations, uploaded or entered information, support communications, instructions, approvals, and exported or imported artifacts.
• Operational and security data: request times, service events, diagnostic traces, error details, feature activity, audit evidence, IP address, browser and device metadata, and security signals reasonably needed to operate and protect the service.
• Commercial data: business-contact, subscription, order, support-entitlement, and billing-related information maintained through the applicable customer relationship.

The precise information available from Microsoft depends on the permissions displayed and approved in the Microsoft consent experience, the connected resources, and the TurtleNet features the customer chooses to use.

3. How information is used

Provider may process information to:

• authenticate users and maintain authorized sessions;
• connect customer tenants and subscriptions;
• build and persist architecture maps, topology, inventories, relationships, configuration evidence, reports, exports, and change history;
• perform customer-requested collection, monitoring, analysis, planning, configuration, deployment, restoration, or troubleshooting workflows;
• secure TurtleNet, detect misuse, investigate incidents, maintain audit evidence, and protect customers;
• provide support, communicate service information, administer subscriptions, and satisfy contractual obligations;
• measure reliability and improve TurtleNet using data reasonably minimized for that purpose; and
• comply with law, enforce agreements, and establish or defend legal claims.

4. Microsoft permissions and customer choice

Microsoft presents the permissions requested before consent. An authorized customer administrator decides whether to approve them. Customers can review or revoke application consent through Microsoft Entra and can stop using TurtleNet. Revocation may prevent TurtleNet from collecting new information or providing connected features, but it does not automatically delete information already retained under an applicable agreement, legal obligation, backup cycle, security requirement, or active customer instruction.

5. Credentials and secrets

TurtleNet may need tokens, application credentials, certificates, or secret references to operate an authorized connection. Provider will use such material only for authorized service functions and apply safeguards appropriate to its sensitivity. Customers must use approved credential workflows and must not transmit credentials through ordinary support messages, diagrams, exports, or source repositories. No system can guarantee absolute protection, and customers remain responsible for their own credential lifecycle and tenant controls.

6. Legal bases

Where applicable law requires a legal basis, Provider processes information as necessary to perform a contract or take requested pre-contract steps; pursue legitimate interests such as operating, securing, supporting, and improving TurtleNet; comply with legal obligations; protect vital interests; or act with consent where consent is the appropriate basis. A customer is responsible for establishing its own lawful basis for Customer Data it directs Provider to process.

7. Disclosure and service providers

Provider may disclose information:

• to personnel and contractors who need it to operate, secure, support, or improve TurtleNet and who are subject to appropriate confidentiality obligations;
• to Microsoft and infrastructure, hosting, monitoring, communications, support, or professional-service providers used to deliver TurtleNet;
• at the customer’s direction or to customer-authorized users and integrations;
• when reasonably necessary to investigate abuse, protect rights or safety, respond to an incident, enforce agreements, or comply with valid legal process; and
• in connection with a merger, financing, acquisition, reorganization, or transfer of the relevant business, subject to appropriate protections.

Provider does not sell Customer Data and does not share Customer Data for cross-context behavioral advertising.

8. Data location and transfers

Information may be processed in locations where Provider, Microsoft, or other authorized service providers operate. The applicable agreement and law govern required transfer protections. Customers should not use TurtleNet for data subject to location or transfer restrictions unless the applicable deployment and agreement satisfy those requirements.

9. Retention and deletion

Provider retains information only for as long as reasonably needed to provide and secure TurtleNet, maintain customer-requested state and history, meet contractual commitments, resolve disputes, enforce agreements, comply with law, and complete ordinary backup or disaster-recovery cycles. Retention periods vary by data type, customer instruction, feature, deployment, and applicable agreement.

When deletion is required, Provider will delete or de-identify information using commercially reasonable processes, subject to legal holds, security evidence, contractual requirements, technical backup cycles, and information the customer retains in its own tenant or exports.

10. Security

Provider uses reasonable administrative, technical, and organizational safeguards appropriate to TurtleNet’s nature and pre-release status. Safeguards may include access controls, encryption where appropriate, credential isolation, logging, monitoring, least-privilege design, environment separation, and vulnerability testing. TurtleNet is under active development, and no internet service can promise absolute security or uninterrupted availability.

11. Customer responsibilities

The customer is responsible for determining whether TurtleNet is appropriate for its information, configuring Microsoft and TurtleNet access, managing authorized users and administrators, applying least privilege, providing required notices, responding to individual requests concerning Customer Data, and maintaining independent backups and security controls. The customer should not connect regulated or highly sensitive data unless authorized by the applicable agreement and supported deployment.

12. Individual privacy rights

Depending on location and applicable law, individuals may have rights to request access, correction, deletion, restriction, objection, portability, or withdrawal of consent, and may have the right to complain to a regulator. These rights are not absolute and may be subject to verification and lawful exceptions.

Requests concerning Customer Data should ordinarily be directed to the organization that controls the connected tenant. Provider will reasonably assist customers with applicable requests as required by the applicable agreement and law. Requests concerning Provider-controlled business-contact or account information may be sent to jmarshall@qvert.net. Provider may verify identity and authority before fulfilling a request.

13. Cookies and similar technologies

TurtleNet may use cookies, browser storage, or comparable technologies that are necessary for authentication, session continuity, security, preferences, and service operation. If optional analytics or similar technologies are introduced, Provider will provide any notice or choice required by applicable law.

14. Children

TurtleNet is a business and professional technology service and is not directed to children. It should not be used to intentionally collect children’s personal information unless the customer has established a lawful, contractually supported use and all required protections.

15. Incident communications

If Provider confirms a security incident affecting Customer Data, Provider will communicate with the affected customer through its established security, support, or account channel as required by the applicable agreement and law. Customers are responsible for maintaining current contact information and for their own incident-response duties.

16. Changes to this statement

Provider may update this Privacy Statement as TurtleNet, its data practices, or legal obligations change. The effective date will be updated, and material changes will be communicated through the service or the customer’s established business channel when reasonably practicable.

17. Contact

Privacy questions and requests should be directed through the TurtleNet support or account contact identified in the customer’s agreement, or by email to jmarshall@qvert.net. Do not send passwords, tokens, private keys, or other credentials by email.