82 Total
37 High severity
44 Medium severity
1 Low severity

Key Facts

Does Salesforce limit its use of artificial intelligence to contexts where it is legally permissible, in compliance with the Privacy Statement, and consistent with Salesforce's commitments and values?
Salesforce limits its use of artificial intelligence to contexts where it is legally permissible, in compliance with the Privacy Statement, and consistent with Salesforce's commitments and values.
How does Salesforce ensure that recipients of Personal Data in international transfers provide an adequate level of protection and security?
Salesforce ensures that recipients of Personal Data in international transfers provide an adequate level of protection and security by entering into appropriate agreements, including, where required, standard contractual clauses or an alternative mechanism.
Does Salesforce collect Personal Data for tailored advertising purposes from third-party providers of business contact information?
Salesforce collects Personal Data for tailored advertising purposes from third-party providers of business contact information, where that data includes personal identifiers and professional or employment-related information.
When a reader opts in to have their badge scanned by an event sponsor, to whom are they providing their Personal Data?
When a reader opts in to have their badge scanned by an event sponsor, they are providing their Personal Data directly to the sponsor—not to Salesforce—and that data's processing is governed by the event sponsor's privacy policy.
Do individuals located in the EEA or the UK have the right to lodge a complaint with the competent supervisory authority?
Salesforce acknowledges that individuals located in the EEA or the UK have the right to lodge a complaint with the competent supervisory authority if they believe Salesforce has not been able to assist with their complaint or concern.
Where does Salesforce transfer and store Personal Data?
Salesforce transfers and stores Personal Data in the United States, and that data may also be processed and stored outside a reader's country or jurisdiction by Salesforce's affiliates and third parties.
May Personal Data be processed and stored outside a reader's country or jurisdiction?
Salesforce transfers and stores Personal Data in the United States, and that data may also be processed and stored outside a reader's country or jurisdiction by Salesforce's affiliates and third parties.
May Salesforce share a reader's Personal Data with sponsors of an event, webinar, or website resource?
Salesforce may share a reader's Personal Data with sponsors of an event, webinar, or website resource when the reader attends, downloads, or accesses that content.
Does Salesforce's Privacy Statement apply when Salesforce processes Personal Data as a processor or service provider on behalf of its customers?
Salesforce's Privacy Statement does not apply to the extent Salesforce processes Personal Data as a processor or service provider on behalf of its customers.
Does Salesforce recognize a right for individuals to erase or delete their Personal Data?
Salesforce recognizes a right for individuals to erase or delete their Personal Data.
Stay ahead of the changes
Track Salesforce and get the diff the day its terms change.
Summary

This document explains how Salesforce collects, uses, and shares your personal information when you interact with Salesforce directly—though it does not cover data Salesforce handles on behalf of its business customers. Salesforce may share your information with contracted vendors, event sponsors, and international affiliates, and it collects data from third-party sources for targeted advertising. You have the right to request that Salesforce delete your personal data, and Salesforce states it does not sell personal data.

Analysis

This Privacy Statement establishes Salesforce, Inc. and its affiliates as data controllers responsible for Personal Data processing, while explicitly carving out data Salesforce processes as a processor or service provider on behalf of customers. It sets out the categories of Personal Data Salesforce collects—including data acquired from third-party business contact providers for tailored advertising—and the parties with whom Salesforce shares that data, including contracted service providers, event sponsors, and international affiliates and third parties. Cross-border transfers are governed by appropriate agreements, including standard contractual clauses where required, to ensure adequate protection. Individuals are recognized as holding a right to erasure, and EEA and UK individuals are acknowledged as having the right to escalate unresolved complaints to a competent supervisory authority. Salesforce expressly limits its use of artificial intelligence to contexts that are legally permissible, consistent with the Privacy Statement, and aligned with its stated commitments and values.

What this means for you

As an individual, your Personal Data may be collected not only directly from you but also from third-party business contact providers for tailored advertising purposes. Attending a Salesforce event, webinar, or accessing a sponsored resource may result in your Personal Data being shared with the relevant sponsors; and if you opt in to a badge scan by an event sponsor, your data goes directly to that sponsor and is governed by the sponsor's own privacy policy—not Salesforce's. Your Personal Data may be transferred to and stored in the United States, and may also be processed by affiliates and third parties outside your home jurisdiction. You have a recognized right to request erasure of your Personal Data, and if you are located in the EEA or the UK and Salesforce has not resolved your complaint, you can lodge a complaint directly with the competent supervisory authority.

Institutional Analysis
Stay ahead of the changes

Institutional analysis available with Insight

Which mapped governance frameworks each document engages, tied to the specific provisions that engage them.

1 important change detected

3 versions captured · Last updated: May 2026

What changed Salesforce removed the direct contact method (email and form link) from the main contact section of its Privacy Statement and replaced it with a new 'Transparency Reports' section. The updated policy now links to Salesforce's annual Transparency Reports (2020-2025) that describe how the company handles government requests for customer data. The change shifts focus from immediate contact channels to published disclosure of government data request practices.
Why this matters This change removes the direct email and web form contact method from the main Privacy Statement but preserves the contact information itself (it remains in the 'Contact Information' section at the end). Users seeking to exercise privacy rights or ask questions can still use the existing form and email, but Salesforce now emphasizes published Transparency Reports as the primary disclosure mechanism for how it handles government data requests. The practical impact on individual consumers is minimal, as the contact channels remain functional; the change primarily shifts documentation toward aggregate disclosure rather than individual inquiry.
View full change record →
Featured, High severity
Featured, Medium severity

Complete Provision Index

Every distinct legal provision identified in this document. Featured provisions appear above with analysis.

82 provisions
12 featured
16 clause types
37 high severity
Restricted or Prohibited Content/Industries 1 1 high
Acceptable Use Restrictions 1
Disclosure and Transparency Requirements 1
Stay ahead of the changes

Monitoring

Salesforce has updated this document before. Monitor includes same-day alerts, structured change summaries, and monitoring for up to 20 platforms.

Stay ahead of the changes

Governance Intelligence

Need provision-level monitoring and regulatory mapping? Insight includes governance timelines, drift analysis, and full provision tracking.

Cross-platform context

See how other platforms handle Adequate protection required for international transfers and similar clauses.

Compare across platforms →
Archival ProvenanceSource & Archival Record
Last Captured May 1, 2026 06:15 UTC
Capture Method Automated scheduled archival capture
Document ID CA-D-000202
Version ID CA-V-002057
SHA-256 906367235ff8fca154a96b8875671b5ce81f50e21d644d966ef899d5c1e5e037
✓ Snapshot stored ✓ Text extracted ✓ Change verified ✓ Hash verified

Governance Monitoring

Monitor governance changes across the platforms you rely on.

Structured alerts for policy changes, governance events, and provision updates across 352+ platforms.

Start monitoring → Compare plans