Privacy Policy

1 Scope and responsibility

Portwood LLC is responsible for the business information it handles when you visit portwood.dev, contact us, book a call, request procurement materials or purchase services. This policy distinguishes that information from records processed by the Portwood application inside your own Salesforce environment. When we process personal data on a customer’s behalf during an engagement, the applicable services agreement and any required DPA govern that processing.

2 Application data and authorized access

Ordinary document generation reads Salesforce records, merges templates and stores output in the customer’s Salesforce environment. Portwood does not obtain a copy of those records merely because the package is installed. Customer administrators control Salesforce permissions, access, storage, backups and retention.

The absence of automatic access does not mean we can never see customer information. You may authorize a named support or implementation account, share a screen, or send a sample template, document or screenshot. That access and those materials are limited to the agreed purpose. Use fictional or masked data and grant the least access needed. Any required data-processing terms must be completed before relevant access.

Optional signing creates recipient, document, consent and audit records in the customer’s configured environment. External image sources, optional AI features and other customer-selected integrations have their own data flows and requirements. Review the relevant setup instructions and provider terms before enabling them.

3 Information Portwood receives

Salesforce provides managed-package publishers with subscriber and licensing information such as organization identifier, organization name and type, installed package version, installation or license status, and instance information. AppExchange installation leads may include installer business contact and country information. We use this information to understand adoption, manage the publisher relationship and support customers; public install figures are aggregated.

We receive the name, business contact details, organization and message content you provide by email, a meeting booking, community participation, or procurement correspondence. During a commercial relationship we also handle order details, covered organizations and quantities, invoices, payment status and agreement-acceptance evidence. Payment credentials should be submitted only through the agreed payment provider, never in a public issue or procurement request.

Legal and procurement documents are available as public downloads without registration. Downloading a review form does not submit an order, collect a signature, or authorize payment.

4 Website hosting cookies and providers

The public marketing site is served from static hosting. Our hosting and communication providers may handle routine connection and security information, such as IP addresses and request details, needed to deliver and secure their services. Salesforce Sites serves signing and legacy application pages, which may use Salesforce session cookies. We do not use Google Analytics, Facebook Pixel or advertising tracking cookies on the public marketing website.

Appointment links open Google Calendar, where Google handles the information you submit under its terms. We receive booking details needed to arrange and attend the meeting. Slack hosts community and support conversations; GitHub hosts public source code, issues and discussions. Those providers handle information under their own terms. Do not put credentials, production records, live signing links or sensitive personal information in public posts.

Business service providers support our hosting, email, customer administration, billing and document handling. Contracted implementation personnel may access customer environments only under the applicable engagement and access authorization. Provider roles and applicable data-processing arrangements depend on the activity; the engagement-specific DPA and subcontractor information should be reviewed before authorized access.

5 Purposes and legal bases

We use business information to respond to requests, perform agreements, administer subscriptions and support, arrange meetings, manage billing, maintain records, secure our operations and comply with law. If we send optional marketing communications, we provide a way to opt out and obtain consent where required. We do not sell customer personal information or use customer records for unrelated advertising or general-purpose AI model training.

Where a law requires a legal basis, the basis depends on the activity: performance of an agreement, our legitimate interests in operating and securing a business relationship, legal obligations, or consent where required. You may withdraw consent for future processing based on it, subject to any other lawful basis and retention duties.

6 Disclosure and international handling

We disclose information as needed to authorized personnel and service providers for the stated purposes, with appropriate confidentiality and contractual protections. We may also disclose information where law requires it or to protect legal rights, limiting the disclosure as appropriate. Detailed customer documents and completed procurement forms are shared through agreed private channels.

Customer application-data residency is determined by the customer’s Salesforce configuration and contract. Portwood’s business systems, support providers or authorized personnel may handle information in other countries. Where required, appropriate processing and international-transfer arrangements must be in place. Data staying in a Salesforce region does not by itself resolve the effect of authorized access from another country.

7 Retention and security

Customer-controlled Salesforce records follow the customer’s retention and backup arrangements. Portwood keeps business, agreement, billing and support records for as long as reasonably needed for the stated purposes and applicable legal, tax, audit or dispute obligations. Retention depends on the record and relationship. Support samples should be minimized and removed when no longer needed, subject to agreed terms, lawful retention and restricted backup cycles.

We use safeguards appropriate to the information and access involved. The Security page describes the application architecture and review evidence. No security statement is a guarantee that every risk is eliminated. An applicable signed agreement or DPA defines contractual security, incident-assistance and deletion obligations.

8 Requests choices and contact

Depending on applicable law, you may have rights to request access, correction, deletion, restriction, portability or objection to processing, or to complain to a relevant regulator. Email hello@portwood.dev with your request. We may need to verify your identity and will respond under the applicable law, including any permitted exceptions. Requests about records controlled by one of our customers should normally be directed to that customer; we assist it under the applicable agreement.

Portwood is a business product and is not directed at children under thirteen. We do not knowingly seek information from children. If you believe information was supplied inappropriately, contact us so it can be assessed.

Portwood LLC, 6044 Portwood Ct, Indianapolis, Indiana 46254, United States. Privacy and procurement: hello@portwood.dev. Security reports: security@portwood.dev.

9 Policy versions

This policy was updated November 2, 2026. Historical published copies are retained in our policy records. Material changes are communicated as required by applicable law. A policy update does not itself change a signed commercial agreement, authorize payment, or revoke applicable open-source rights.