Privacy Policy

1. About This Privacy Policy

Addonblue Inc. (“Addonblue”, “we”, “our”, “us”) is a Salesforce consulting company based in Charlotte, North Carolina. This Privacy Policy explains how we collect, use, disclose and protect personal information when you:

• Visit our website, addonblue.com (the “Website”), fill in a form or book a call;
• Use our free Org Health Check;
• Work with us on Salesforce consulting, implementation or managed services (the “Services”); or
• Use our Salesforce AppExchange apps (the “Solutions”).

This Privacy Policy is a notice of our practices. Please read it to understand how we handle your information. If you have questions, see Section 15.

2. Our Role: Controller and Processor

How we handle data depends on the context:

• Addonblue as controller. We decide how and why to use personal information collected through the Website, our forms, the Org Health Check, call bookings, sales and marketing activities, and our business relationships (for example, contact details of customer and prospect contacts). This Privacy Policy covers that information.
• Addonblue as processor (service provider). When we provide the Solutions or the Services, we may process data that our clients store in their Salesforce orgs (“Customer Data”). For Customer Data, our client is the controller and we act on its instructions, under our client contract and, where applicable, a Data Processing Agreement (DPA). If your personal information is in a client’s Salesforce org, please contact that client about your privacy rights; we will help them respond as required.

3. Information We Collect

3.1 Information you give us

• Contact details: name, email address, phone number, company and job title.
• Messages and requests: what you write in contact, sales and support forms, and details you enter when booking a call.
• Org Health Check request details: the details you enter to request a scan.
• Account and purchase details: your Salesforce account or org ID, and billing information for paid Solutions.
• Communication preferences, including SMS/text-messaging consent where you give it.

3.2 Information collected automatically

When you use the Website or the Solutions, we may collect technical data such as:

• IP address and approximate location derived from it;
• Device type, browser type and version, and operating system;
• Usage information (for example, pages viewed, time on page, clicks, scrolling and referring page);
• Errors or issues encountered while using the Website or the Solutions.

See Section 5 for details on cookies and analytics.

3.3 Information from Salesforce and other sources

• Salesforce AppExchange: when you install or buy one of our Solutions, Salesforce may share installation and license details with us, such as org ID, company name, and administrator contact details.
• Org Health Check: settings, metadata and counts from the Salesforce org you connect (never record data). See Section 4.
• Cal.com: booking details you enter when scheduling a call.

3.4 Customer Data

When you use our Solutions or Services, you may provide us with business data or information about your Salesforce environment, including customer data stored in your Salesforce account. We process this Customer Data as a processor, as described in Section 2.

4. Website Visitors, Forms and the Org Health Check

This section describes how the Website handles your information.

• Contact, sales and support forms. The details you enter (such as name, email, phone, company and your message) are sent directly to Addonblue’s Salesforce account, where they become a lead or a support case. The Website itself does not store them.
• Spam protection. Our forms use Google reCAPTCHA, which collects hardware and software information and sends it to Google to check that you are not a bot. Google’s Privacy Policy and Terms of Service apply to that check.
• Booking a call. Calls are scheduled through Cal.com. The details you enter when booking are processed by Cal.com and shared with us so we can hold the call.
• Org Health Check. You sign in on Salesforce’s own login page; we never see your password. We receive a short-lived access token, use it only to read settings, metadata and counts (never record data), and revoke it as soon as the scan ends. Your request details are sent to our Salesforce account as a lead. The report is shown in your browser, where you can download it as a PDF. We do not email the report. The Website does not keep the access token or the report.

5. Cookies and Analytics

5.1 Strictly necessary cookies. The Website sets short-lived, strictly necessary cookies only while an Org Health Check connection is in progress. These are needed for the connection to work and do not require consent. A cookie may also be used to remember your cookie choices.

5.2 Analytics. To understand how the Website is used and improve it, we use:

• Vercel Web Analytics – aggregated visit statistics, collected without cookies;
• Google Analytics 4 – traffic and conversion measurement;
• Microsoft Clarity – heatmaps and session recordings that show how visitors interact with pages.

5.3 Consent first. Google Analytics and Microsoft Clarity (including session recordings) run only after you accept them in our cookie consent banner. If you decline, they are not loaded. You can change your choice at any time using the “Cookie settings” link in the Website footer.

5.4 Masking in Clarity. Microsoft Clarity is configured to mask form inputs and sensitive text, so what you type into forms is not captured in session recordings.

5.5 No advertising cookies. The Website does not use advertising cookies, and we do not use analytics data for targeted advertising.

5.6 More information. See the privacy policies of Google, Microsoft and Vercel for how they handle data. You can also control or delete cookies through your browser settings.

6. How We Use Your Information

We use personal information to:

• Provide our Website, Solutions and Services: deliver and operate the Solutions (including updates and new features), run the Org Health Check, hold calls, and respond to your inquiries and support requests.
• Manage our business relationship: manage leads, accounts, contracts, payments and billing.
• Improve what we do: analyze usage to improve the Website and Solutions, and fix technical issues.
• Communicate with you: send updates, promotional materials or information about new features and products that may interest you (with your consent where required by law), and ask for feedback or run surveys. You can unsubscribe from marketing emails at any time using the link in the email, or reply STOP to text messages.
• Protect and comply: detect, prevent and investigate security incidents, spam, fraud or other illegal activity, enforce our terms, and comply with applicable laws, regulations and legal obligations.

7. How We Share Your Information

We do not sell personal information. We share it only as described below.

7.1 Salesforce. We use Salesforce as our own CRM, so form submissions, Org Health Check leads and support cases are stored in our Salesforce account. Our Solutions run on the Salesforce platform, so some data is processed through Salesforce’s infrastructure. Salesforce’s privacy practices apply to data stored in your Salesforce account; please review Salesforce’s Privacy Policy.

7.2 Service providers. We share information with service providers who help us run our business, under contracts that require them to protect it and use it only to provide services to us. They include:

We may also use providers for email, payment processing, and customer support tools, under similar obligations.

7.3 Legal compliance and protection. We may disclose information if required by law, regulation or legal process, or if we believe in good faith that disclosure is necessary to protect the rights, property or safety of Addonblue, our clients, users or the public.

7.4 Business transfers. If Addonblue is involved in a merger, acquisition, financing or sale of all or part of its business or assets, personal information may be transferred as part of that transaction. Where required by law, we will provide notice before your personal information is transferred and becomes subject to a different privacy policy.

7.5 Mobile information and SMS opt-in data. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. All the above categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

7.6 With your consent. We may share information for other purposes with your consent or at your direction.

8. Data Security

We use reasonable administrative, technical and physical safeguards designed to protect personal information, such as encryption in transit and access controls. However, no method of transmission over the internet or electronic storage is completely secure, and we cannot guarantee absolute security.

9. Data Retention

We keep personal information only as long as needed for the purposes in this Privacy Policy, or as required by law. In particular:

• Leads and contact records (including form submissions, Org Health Check requests and call bookings): kept while we have an active business relationship with you, or for up to 3 years after our last contact with you.
• Org Health Check access token: revoked and deleted immediately when the scan ends.
• Org Health Check report: not stored by us; it exists only in your browser and in any PDF you download.
• Customer and contract records (such as billing and support history): kept for as long as needed to provide the Solutions or Services and to meet legal, tax and accounting obligations.
• Analytics data: kept according to the retention settings of each analytics tool.
• Customer Data we process as a processor: kept and deleted as set out in our client contract or DPA.

When information is no longer needed, we securely delete or anonymize it.

10. Your Rights in the EEA, UK and Switzerland

10.1 Legal bases. If you are in the European Economic Area, the United Kingdom or Switzerland, we process your personal information on these legal bases:

• Contract: to provide the Solutions, Services or support you request.
• Legitimate interests: to respond to inquiries, manage leads and business relationships, run and secure the Website, and improve our offerings, where those interests are not overridden by your rights.
• Consent: for Google Analytics and Microsoft Clarity, and for marketing where required by law. You can withdraw consent at any time.
• Legal obligation: to comply with the law.

10.2 Your rights. Depending on your location, you may have the right to:

• Access the personal information we hold about you;
• Correct inaccurate information;
• Delete your information, subject to legal and contractual obligations;
• Restrict our processing of your information;
• Data portability – receive a copy in a structured, commonly used, machine-readable format;
• Object to processing based on legitimate interests, and to direct marketing at any time;
• Withdraw consent at any time, without affecting processing that took place before. Withdrawing consent may limit some features.

To exercise these rights, contact us (Section 15). You also have the right to complain to your local data protection authority.

11. Your US State Privacy Rights

This section applies to residents of California (under the CCPA, as amended by the CPRA) and of other US states with comprehensive privacy laws. It supplements the rest of this Privacy Policy.

11.1 Personal information we collect. In the past 12 months, we have collected the following categories of personal information:

11.2 Purposes. We use and disclose these categories for the business purposes described in Section 6 and disclose them to the recipients described in Section 7 (Salesforce and our service providers, and as required by law). We keep each category for the periods described in Section 9.

11.3 No sale or sharing. Addonblue does not sell personal information and does not share it for cross-context behavioral advertising or use it for targeted advertising, and has not done so in the past 12 months. We have no actual knowledge of selling or sharing personal information of anyone under 16.

11.4 Global Privacy Control. We honor Global Privacy Control (GPC) signals. If your browser sends a GPC signal, we treat it as a valid request to opt out of sale, sharing and targeted advertising for that browser, and our cookie banner will not enable optional analytics cookies while the signal is on.

11.5 Sensitive personal information. We do not use or disclose sensitive personal information for purposes other than those permitted by law (such as providing the services you request), and we do not use it to infer characteristics about you. We never receive your Salesforce password.

11.6 Your rights. Depending on your state, you have the right to:

• Know and access the categories and specific pieces of personal information we have collected about you, the sources, the purposes, and the categories of third parties we disclose it to;
• Delete personal information we collected from you, subject to legal exceptions;
• Correct inaccurate personal information;
• Opt out of the sale or sharing of personal information and of targeted advertising (we do not do these, but you may still submit a request);
• Limit the use of sensitive personal information (we only use it for permitted purposes);
• Data portability – receive your information in a portable format;
• Non-discrimination – we will not deny you services, charge different prices or provide a different quality of service because you exercised your rights.

11.7 How to submit a request. Use our contact form, or write to the mailing address in Section 15.

11.8 Verification. To protect your information, we will verify your identity before responding, usually by matching information you provide (such as your name and email address) with what we hold, and we may ask for more details where needed. We will use the information you provide only for verification and to respond to your request.

11.9 Authorized agents. You may use an authorized agent to make a request for you. We may ask the agent for proof of your signed permission and may ask you to verify your identity directly with us, unless the agent holds a valid power of attorney.

11.10 Response time. We will respond within 45 days, or as otherwise required by law. If we need more time, we will tell you why and may extend this period as permitted by law.

11.11 Appeals. If we decline to act on your request, you may appeal by replying to our decision or through our contact form with the subject line “Privacy Request Appeal”. We will respond in writing within the time required by your state’s law, explaining our decision. If your appeal is denied, you may contact your state Attorney General.

12. International Data Transfers

We are based in the United States, and our service providers may process information in the United States and other countries. These countries may have data protection laws different from those where you live. When we transfer personal information from the EEA, UK or Switzerland, we use appropriate safeguards, such as the European Commission’s Standard Contractual Clauses (and the UK Addendum or Swiss equivalents) where applicable, or rely on other lawful transfer mechanisms. Contact us for more information.

13. Children’s Privacy

Our Website, Solutions and Services are not intended for individuals under 16. We do not knowingly collect or solicit personal information from children under 16. If we learn that we have collected personal information from a child under 16, we will take steps to delete it.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will update the “Last updated” date above and, for material changes, we will provide notice by posting a notice on the Website or through other communication channels.

15. Contact Us

If you have questions or concerns about this Privacy Policy, contact us by any of these methods:

• Web form: our contact form

We answer requests within 45 days, or as otherwise required by law.

Acknowledgement: By using our Solutions and Services, you acknowledge that you have read, understood, and agree to this Privacy Policy.