Privacy Notice

Effective Date

October 13, 2026

Last Updated

October 13, 2026

Contact

privacy@saltboxmgmt.com

Website

www.saltboxmgmt.com

End User Terms of Use

www.saltboxmgmt.com/terms

Introduction

Saltbox MGMT, Inc. ("Saltbox MGMT," "we," "us," or "our") provides SaltboxOne ("S1" or the "Service"), an AI-powered project delivery platform that helps business customers ("Customers") configure and manage their Salesforce environments and coordinate related work across the tools they connect to it. This Privacy Notice (“Notice”) describes how we collect, use, store, and protect personal information when Customers and their authorized end users ("Users") access or use the Service. By using the Service, you agree to the practices described in this Notice. Where a Customer has executed a Master Service Agreement ("MSA") or other written agreement with Saltbox MGMT, the terms of that agreement and any End User Terms of Use govern in the event of any conflict with this Notice.

The Service uses artificial intelligence and proprietary methodology to generate summaries, user stories, test cases, configuration recommendations, code, and other project outputs from the Customer’s Salesforce environment, the tools the Customer connects, and the User’s conversations with the Service. Conversation history, generated outputs, imported content, and derived memory are retained for the period the Customer’s administrator selects.

1. Scope and Applicability

This Notice solely applies to personal information Saltbox MGMT collects directly from authorized Users (such as account and contact information) using the Saltbox Service and visitors to our public website at www.saltboxmgmt.com.

The Service is a business-to-business (B2B) platform only and is not directed to consumers or individuals acting in a personal capacity. Saltbox MGMT processes Customer Data as a data processor on behalf of the Customer, and that processing is governed by the Customer’s agreement with Saltbox MGMT and the Data Processing Agreement (DPA) between Saltbox MGMT and the Customer.

By accessing or using the Service, you represent that you are at least 18 years of age and are authorized to act on behalf of the Customer organization.

2. Information We Collect

2.1 Account and User Information

When a Customer provisions accounts for Users, or when a User registers directly, we collect only the personal information necessary to provide the Service on behalf of the Customer:

• Full name and email address
• Job title
• Organization name, membership status, and assigned role within the organization

User authentication:

• Internal and administrative users: Google Single Sign-On (SSO) via Google OAuth
• All other Customer users: Direct email address and password registration

Session management is handled through a custom session management system. Session tokens do not contain Customer Data.

Sign-in records. Each time a User signs in, the Service records the User’s IP address, browser and device type, and approximate location (city, country, and time zone) in the Customer’s audit log, and we keep a copy in a security log for 800 days for security purposes. The security log also records the email address and IP address of anyone who attempts to sign in without an invitation. For Users who sign in with Google, the Service stores the User’s name and email address in the User’s account record and stores Google access and refresh tokens in encrypted form until the User is removed; the User’s Google profile photo and Google account ID are not stored on our servers and exist only in an encrypted sign-in cookie in the User’s browser.

2.2 Customer Data (Processor/Service Provider Role — Governed by the Data Processing Agreement [DPA])

Customer Data is any content a Customer or its Users submit to, connect to, or generate with the Service. The Customer decides what to connect and how long it is retained. The Service handles Customer Data in the following categories:

(a) Salesforce environment data

When a User connects a Salesforce environment and asks data-related questions, data from that environment is retrieved only as necessary to answer the question or generate the requested output. Salesforce records are processed in real time and are not stored by Saltbox MGMT. The User’s question and the Service’s response, which may quote retrieved records, are retained as part of conversation history under paragraph (d).

To reduce the risk of processing unnecessary personal information, the Service is designed to filter certain Salesforce field types, including fields of type email, address, and encrypted fields. However, standard text fields may contain personal information entered by the Customer’s own users, and Saltbox MGMT cannot fully control what data appears in such fields. Customers are solely responsible for ensuring that Salesforce data submitted to the Service complies with applicable privacy laws and the DPA.

(b) Connected tools

Users may connect the following third-party tools. Every connection is authorized in advance by the User and scoped to the files, projects, or channels the User configures. Content from some tools is used only during the session in which it is retrieved; content from others is indexed and stored so it can be searched and referenced in later work.

A User may also choose to send generated code or designs to v0 by Vercel. That transfer happens only when the User initiates it and is governed by Vercel’s terms.

(c) Meeting transcripts and participants

Meeting transcripts imported from Google Meet, Microsoft Teams, Fireflies, or Fathom and other similar services include speaker attribution, timestamps, and participant names and email addresses. Participants may include individuals who are not Users of the Service. The Customer, through the User who connects the integration, is responsible for having appropriate authorization to record, transcribe, and import those meetings; Saltbox MGMT processes transcript content solely on the Customer’s behalf.

(d) Conversations and generated outputs

Each User’s conversations with the Service, including prompts and responses, and the outputs the Service generates (documents, code files, chats, artifacts, to-do items, summaries, and draft work items) are stored in our database and retained for the period the Customer’s administrator selects. Users can delete individual conversations and outputs at any time from within the Service. The Customer’s administrators can view conversations and outputs within the Customer’s organization.

(e) Derived memory

To provide continuity across sessions, the Service extracts long-horizon context from a User’s conversations (for example, project goals, preferences, and decisions) and stores it as derived memory scoped to that User or to a project. Derived memory is stored in our database, is visible to the User in the Service, can be deleted by the User at any time, and is included in data exports and in the deletion that occurs at account closure.

(f) Sensitive Data

Saltbox MGMT does not intentionally process sensitive personal information categories. Customers should not submit or connect data constituting sensitive personal information, data from regulated industries such as healthcare or financial services, or data subject to heightened legal protection, without first contacting privacy@saltboxmgmt.com.

2.3 Usage and Technical Data

We collect data generated through use of the Service only as necessary for service reliability and improvement, including log data, timestamps, feature usage patterns, error reports, IP addresses, and browser and device information. Within the Service application we use Vercel Analytics, which measures page performance and usage without setting cookies and without sharing data with any party other than Vercel as our hosting provider. On our public website we use Google Analytics; see Section 6.

2.4 Marketing and Communications Data

If you interact with our marketing activities, we collect only the information necessary for that purpose: name, business email address, job title, and company name. Marketing communications are managed through Salesforce CRM. You may opt out at any time as described in Section 7.

2.5 Google Workspace Data (Google Meet and Google Drive)

When you voluntarily connect a Google account to the Service, we request limited access to your Google Workspace data. This connection is optional and User-initiated. Our Google API data practices, described here and in Section 5.5, comply with the Google API Services User Data Policy, including the Limited Use requirements.

(a) OAuth scopes requested

We request the following Google OAuth scopes and no others:

• https://www.googleapis.com/auth/meetings.space.readonly — read-only access to Google Meet conference records, participant lists, and transcripts for meetings you have hosted or participated in.
• https://www.googleapis.com/auth/drive.file — access only to the specific Google Drive files you select and open through the Service. We cannot see or list any other files in your Drive.

We do not request access to Gmail, Google Calendar, Google Contacts, or any other Google service.

(b) Data we access and how it is handled

• Google Meet: meeting titles, start and end times, conference IDs, participant names and email addresses, and transcript content with speaker attribution and timestamps. We import only meetings you explicitly associate with a project. Imported Meet data is indexed and stored as described in paragraph (d).
• Google Drive: the contents of files you select, used during the session to generate the response you requested. Drive file contents are not stored after the session; the Service’s response is retained as part of conversation history.

(c) How we use Google data

Imported Google data is used solely to provide user-facing features of the Service: generating meeting summaries, action items, and project context; answering your questions with relevant historical context; and displaying meeting metadata in your project overview. We do not use Google data to build user profiles, serve advertising, or for any purpose unrelated to providing the Service to you, and Google data is excluded from the aggregated and synthetic data described in Section 3.2. We do not allow humans to read your Google data unless: (i) you have explicitly requested support and consented to a specific review; (ii) it is necessary to investigate a security incident or abuse; or (iii) we are required to do so by law.

(d) Storage, security, and retention

Google Meet metadata and transcript content are stored in our encrypted PostgreSQL database and search index, hosted in the United States on Heroku and Elastic Cloud respectively, with encryption at rest and TLS in transit, consistent with Section 4.3. Access is restricted to members of your organization who are authorized to view the associated project. Imported Google Meet data is retained for the period your Customer administrator selects or until you delete the associated meeting or project, revoke Google access and request deletion, or your account is closed, whichever is earlier.

(e) How we share Google data

To generate AI-powered insights, transcript content and meeting metadata are transmitted to the AI providers described in Section 5.1, and we do not retain these. We do not sell, rent, license, or otherwise share Google data with any other third party, except as required by law or in connection with a merger or acquisition as described in Section 8.

(f) Your controls

• Revoke access: at any time from Settings > Integrations in the Service or from your Google Account permissions page at myaccount.google.com. Revoking access immediately stops further imports; previously imported content remains in your project until you delete it or request deletion.
• Delete imported data: remove the associated meeting or project within the Service, or email privacy@saltboxmgmt.com.
• Export your data: under the data portability rights described in Section 7.4.

3. How We Use Your Information

We use the personal information we collect only as necessary for the following purposes:

3.1 Maintaining this Website

To identify how visitors located our website

To determine which product marketing techniques have connected us with potential customers

To identify key trends in visitor search terms and referring websites to adjust marketing approaches

3.2 Providing and Operating the Service

• To authenticate Users and manage account access
• To process Customer Data to generate AI-assisted summaries, work items, configuration outputs, and code on behalf of the Customer, and to write approved changes into the Customer’s Salesforce environment
• To retain conversations, outputs, imported content, and derived memory for the Customer-selected period so that Users can return to prior work
• To send transactional notifications related to your account (via SendGrid)
• To surface relevant project context and configuration guidance within the Service

3.2 Service Improvement and Operations

• To monitor service performance, diagnose errors, and maintain platform reliability
• To analyze aggregated, de-identified usage patterns to improve the Service
• To create synthetic data for the purpose of testing and improving the Service

We do not use Customer Data or personal information to train, fine-tune, or benchmark any machine-learning model, and our AI providers are contractually prohibited from doing so. De-identified data is maintained in accordance with Cal. Civ. Code §1798.140(m). We publicly commit to maintain and use de-identified data in de-identified form and not to attempt to re-identify it, and we contractually prohibit recipients from doing so. Google data is excluded from these programs as described in Section 2.5(c).

3.3 Marketing Communications

• To send product updates or other marketing communications to Users who have not opted out — managed through Salesforce CRM; opt out at any time as described in Section 7

3.4 Legal and Compliance

• To comply with applicable legal obligations, enforce our End User Terms of Use and DPA, and respond to lawful government requests

We do not process Customer or User information for advertising, profiling for decisions with legal or significant effects, or any purpose beyond those described in this Notice.

4. How We Store and Protect Your Information

4.1 AI Providers and Model Training

Customer Data, including conversations, connected content, and meeting transcripts, is transmitted to large language model providers to generate responses. All AI requests are routed through the Vercel AI Gateway, which routes requests only to providers that have contractually agreed not to retain prompts or outputs after the request completes and not to use them for model training, or “Zero Data Retention.” The Vercel AI Gateway itself retains no prompts or outputs. Code-generation and deployment tasks run in isolated Vercel Sandbox environments that are discarded when the task completes. Customers may request a list of current providers as described in Section 5.

4.2 Data We Retain

We retain the following categories of data only for the periods necessary to fulfill the purposes for which they were collected, then dispose of them on a regular schedule:

• Conversations, generated outputs, imported content, and derived memory: for the period the Customer’s administrator selects; Users may delete items earlier
• Audit logs (who did what in the Service): adjustable by the Customer’s administrator
• Security logs (sign-in IP address, browser and device type, approximate location, and refused sign-in attempts): 800 days, for security purposes
• User account data (name, email, job title, organization name, membership status, and role): retained while the account is active and deleted within 30 days of account closure or upon written request
• Service logs and usage data: retained for 90 days for operational and debugging purposes
• Marketing and CRM data: retained while the Customer relationship is active or until opt-out is received
• Anonymized and aggregated usage statistics: may be retained indefinitely as they do not constitute personal information

Account closure. Within 30 days after a Customer’s account is closed, we delete the Customer’s data from every system in which it is held: the primary database, the search index, the cache and queue layer, cloud file storage, derived memory, and any sandbox environments, subject only to legal retention obligations and the security log retention described above. Customers may export their data before closure as described in the DPA.

4.3 Security Measures

Saltbox MGMT implements and maintains appropriate technical and organizational security measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. These measures are appropriate to the nature of the personal data processed and include, at a minimum, the controls listed below.

Access controls. Saltbox MGMT restricts access to personal data to those personnel who require access to perform their job functions, and all such personnel are subject to confidentiality obligations. Saltbox MGMT personnel do not access Customer Data except to provide support the Customer has requested, to investigate a security incident or abuse, or as required by law.

Security updates. Saltbox MGMT regularly reviews and, where necessary, updates its security measures in response to changes in technology, the nature of processing, and known security threats.

Customer responsibilities. Customers are responsible for implementing appropriate security measures within their own systems, Salesforce environments, and connected systems, including managing User credentials, access controls, and security configurations. Saltbox MGMT is not responsible for security incidents arising from a Customer’s failure to maintain adequate security within its own environment.

Technical controls

Organizational controls

5. Third-Party Service Providers (Sub-Processors)

We engage third-party service providers (sub-processors) to operate the Service. Our service is hosted in the United States. Each provider receives only the data necessary to perform its specific function and is contractually bound to data protection obligations no less protective than those in our DPA. Customers may access a list of our sub-processors by contacting privacy@saltboxmgmt.com.

5.1 AI Processing Providers

Customer Data sent to AI providers is used solely to generate the requested output. Under the Zero Data Retention configuration described in Section 4.1, providers do not retain prompts or outputs after the request completes and are contractually obligated not to use them to train their models.

5.2 Infrastructure and Operations

Data may be transmitted to providers that provide infrastructure or provide operations. These providers are contractually obligated not to use these data for their own purposes.

5.3 Authentication

Data will be transmitted to providers for the purpose of providing single sign-on for internal and administrative users, as well as authorization for specific integrations.

5.4 Marketing and CRM

Data will be transmitted to providers for the purpose of customer records management, marketing commiunications, and email delivery.

5.5 Google API Services — Limited Use Disclosure

Saltbox MGMT’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Consistent with the Limited Use requirements, Saltbox MGMT:

• Uses Google user data only to provide or improve user-facing features that are prominent in the Service’s user interface, as described in Section 2.5.
• Does not use Google user data for advertising, interest-based targeting, credit determination, model training, or any purpose unrelated to providing the Service.
• Does not transfer Google user data to third parties except: (i) to the AI providers in Section 5.1 to generate the features described in Section 2.5, under zero-data-retention terms; (ii) for security purposes; (iii) to comply with applicable law; or (iv) in connection with a merger or acquisition after obtaining user consent.
• Does not allow humans to read Google user data except as described in Section 2.5(c).
• Does not sell or share Google user data with advertising platforms, data brokers, or information resellers.

The Google API Services User Data Policy is available at https://developers.google.com/terms/api-services-user-data-policy.

6. Cookies and Tracking Technologies

6.1 Types of Cookies We Use

• Analytics Cookies (public website only). We use Google Analytics on www.saltboxmgmt.com to understand how visitors interact with our website. Google Analytics may collect IP addresses, device information, and behavioral data You have the right to opt out — see Section 7.5.
• Strictly Necessary Cookies (Service application). We use session management cookies required for authentication and core platform functionality. These cannot be disabled without impairing the Service. The Service application sets no analytics or advertising cookies; Vercel Analytics operates without cookies.

6.2 Managing Your Cookie Preferences

• Browser settings: You may configure your browser to block or delete cookies at any time.
• Google Analytics Opt-Out: Install the Google Analytics Opt-Out Browser Add-on at https://tools.google.com/dlpage/gaoptout.
• Global Privacy Control (GPC): We honor GPC browser signals as opt-out requests from the sale or sharing of personal information, as required by applicable law.
• Direct request: Email privacy@saltboxmgmt.com with the subject line “Opt-Out of Sharing.”

7. Your Privacy Rights

The rights in this Section apply to the personal information Saltbox MGMT collects from Website users. Requests concerning User registration information for Customers or requests regarding Customer Data should be directed to your organization, which controls that data; we will assist your organization as described our agreements with them.

We will acknowledge receipt of all verifiable rights requests within 10 business days and respond within 45 days. Where necessary due to complexity or volume, we may extend this period by an additional 45 days and will notify you within the initial 45-day period. We will not charge a fee for responding unless requests are manifestly unfounded or excessive.

How to Submit a Request. Contact us at privacy@saltboxmgmt.com with the subject line “Privacy Rights Request.” We may need to verify your identity before processing your request. We will not require you to create an account solely to submit a request. Please Note: in the event your information has been de-identified or anonymized, we may not be able to process your rights request.

7.1 Right to Know and Access

You may request disclosure of the categories of personal information we have collected about you, the specific pieces of personal information we hold, the purposes for which it was collected, and the categories of third parties with whom we have shared it.

7.2 Right to Deletion

You may request deletion of your personal information. Upon a verified request, we will delete your personal information and direct our sub-processors to do the same, subject to exceptions permitted by law. We will also process deletion requests for data obtained about you or third-party sourced data. We will process deletion requests within 45 days. Users may also delete their own conversations, outputs, and derived memory directly within the Service.

7.3 Right to Correction

You may request correction of inaccurate personal information. You may also update your account information directly within the Service at any time.

7.4 Right to Data Portability

You may request a copy of your personal information in a structured, machine-readable format by using the export function within the Service or by contacting privacy@saltboxmgmt.com.

7.5 Right to Opt Out of Sale or Sharing

We do not sell your personal information. You have the right to opt out by using the Google Analytics Opt-Out Browser Add-on, enabling a GPC signal in your browser, or emailing privacy@saltboxmgmt.com with the subject line “Opt-Out of Sharing.” We will act on opt-out requests within 15 business days of receipt.

7.6 Right to Limit Use of Sensitive Personal Information

We do not intentionally collect or process sensitive personal information as defined under applicable state privacy laws. If you believe we have inadvertently received sensitive personal information, please contact privacy@saltboxmgmt.com immediately.

7.7 Right to Opt Out of Automated Profiling

We do not use personal information for automated profiling and decision-making that produces legal or similarly significant effects on individuals.

7.8 Right to Non-Discrimination

We will not discriminate against you for exercising any privacy right. Exercising your rights will not result in denial of the Service, different pricing, or reduced quality of service.

7.9 Right to Appeal

If we decline to act on a request, we will explain why and how to appeal. You may appeal by replying to our decision or emailing privacy@saltboxmgmt.com with the subject line “Privacy Appeal” within 45 days of receiving our decision. We will respond in writing within 45 days of receiving the appeal, and if we deny the appeal we will provide a method to contact the Attorney General of your state to submit a complaint.

7.10 Opt Out of Marketing Communications

You may opt out of marketing communications at any time by clicking the “Unsubscribe” link in any marketing email, or by emailing privacy@saltboxmgmt.com with the subject line “Marketing Opt-Out.” Opting out of marketing does not affect transactional account notifications.

7.11 Supplemental Notice for California Residents

This supplemental notice applies to California residents and supplements the rights described in Sections 7.1 through 7.10 above.

(a) Your Rights Under the CCPA/CPRA

California residents have the right to know, access, delete, correct, and transfer their personal information; to opt out of the sale or sharing of personal information; to limit use of sensitive personal information; and to non-discrimination for exercising these rights. The rights described in Section 7 of this Notice encompass and satisfy all rights afforded under the CCPA as amended by the CPRA.

(b) Categories of Personal Information Collected

The following table summarizes the categories of personal information we collect as a business, consistent with the categories defined under the CCPA:

Customer Data processed on a Customer’s behalf as a service provider — including conversation history, connected content, meeting transcripts (audio/visual and similar information), generated outputs, and derived memory — is governed by the DPA. We do not collect sensitive personal information as defined under the CPRA, and we do not sell personal information.

(c) Authorized Agent Requests

California residents may designate an authorized agent to submit privacy rights requests on their behalf. We will require written proof of the agent’s authority to act on your behalf and may verify your identity directly before processing the request. Authorized agent requests should be submitted to privacy@saltboxmgmt.com with the subject line “Authorized Agent Request.”

(d) Shine the Light Disclosure

Under California Civil Code Section 1798.83, California residents may request, once per calendar year and free of charge, a list of the categories of personal information (if any) that Saltbox MGMT disclosed to third parties for their direct marketing purposes during the preceding calendar year. We do not currently disclose personal information to third parties for their own direct marketing purposes. To submit a Shine the Light request, contact privacy@saltboxmgmt.com with the subject line “Shine the Light Request.”

7.12 Supplemental Notice for Nevada Residents

Nevada residents have the right under Nevada Revised Statutes Chapter 603A to opt out of the sale of certain personal information to third parties who intend to license or sell that personal information. Saltbox MGMT does not currently sell personal information as defined under Nevada law. Nevada residents may submit an opt-out request by emailing privacy@saltboxmgmt.com with the subject line “Nevada Do Not Sell Request” along with their name and account email address.

7.13 Residents of Other States

Residents of Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, Virginia, and any other state with a comprehensive consumer privacy law have the rights described in Section 7, to the extent those laws apply to Saltbox MGMT. Oregon residents may also request a list of the specific third parties, other than natural persons, to which we have disclosed their personal data or, at our option, any personal data. Most of these laws exempt data processed in an employment or business-to-business context; we honor requests from Users regardless.

8. Data Sharing and Disclosure

We do not sell your personal information. The table below summarizes the categories of information we share, with whom, and for what purpose:

We do not share personal information with sub-processors, service providers, or third parties for their own marketing, advertising, or purposes unrelated to providing the Service, and we contractually limit their use of such data.

9. Data Retention

At account closure, all Customer Data is deleted within 30 days from every system listed in Section 4.2. To request early deletion of your data, contact privacy@saltboxmgmt.com.

10. International Data Transfers

Saltbox MGMT is based in the United States, hosts the Service in the United States, and offers the Service to Customers in the United States only. If you access the Service from outside the United States, your data will be transferred to and processed in the United States, and by using the Service you acknowledge and consent to that transfer. One sub-processor, which receives only the search queries described in Section 8, may process those queries outside the United States. Saltbox MGMT does not actively market or direct the Service to users outside the United States.

11. Children’s Privacy

The Service is a business-to-business platform not directed to individuals under the age of 18. We do not knowingly collect personal information from minors. If you believe we have inadvertently collected information from a minor, please contact privacy@saltboxmgmt.com and we will delete such information promptly.

12. Changes to This Privacy Notice

We may update this Privacy Notice periodically to reflect changes in our practices, technology, legal requirements, or sub-processors. We will notify Customers of material changes by posting the revised Notice with an updated Last Updated date and by sending an email notification to the address associated with your account. Your continued use of the Service after the effective date of any update constitutes acceptance of the revised Notice. Prior versions are available upon request by contacting privacy@saltboxmgmt.com.

13. Contact Us

If you have questions, concerns, or requests regarding this Privacy Notice or our data practices, please contact us: