Digadop Privacy Policy

Effective Date: June 27, 2026

This Privacy Policy is published by Stony Point, Inc., a Florida corporation, doing business as (“d/b/a”) Digadop (“Digadop,” “we,” “us,” or “our”), with a principal business address at 8742 Peachtree Park Ct, Windermere, FL 34786, USA. “Digadop” is a trade name (DBA), not a separate legal entity; the contracting and responsible party is always Stony Point, Inc.

This policy explains how we collect, use, share, secure, and retain information across our products and websites, including the websites at digadop.ai, whoseeswhat.com, whoseeswhat.ai, and their subdomains.

For privacy questions and data-subject requests, contact our privacy point of contact and Data Protection Officer, Steve Wasula, at privacy@digadop.com. For legal notices, contact legal@digadop.com.

1. Scope

This policy applies to all Digadop-branded products (each a “Service”) and to the Digadop websites and marketing pages, including the websites at digadop.ai, whoseeswhat.com, whoseeswhat.ai, and their subdomains. It describes, at the company level, how we handle information across the product family.

Each product handles data differently. Product-specific data handling is summarized in Section 2 below and described in full in that product’s Product Schedule and, where published, its product privacy page. Where this policy and a Product Schedule or product privacy page differ on a product-specific point, the product-specific document governs for that product.

This policy does not by itself set the contractual terms under which we process Personal Data inside a Customer’s Connected Org. Those terms are in the Digadop Data Processing Addendum (the “DPA”); see Section 6.

2. The products

Who Sees What: a read-only Salesforce permission and access auditor. It reads access configuration, metadata, and the user directory from a Connected Org via OAuth (scopes api refresh_token offline_access openid), encrypts the stored refresh token with AWS Key Management Service (KMS), isolates tenants with organization-scoped access and PostgreSQL Row-Level Security, and applies deterministic analysis to your Connected Org data. The audit uses no AI or large language model processing of Customer Data. The Service also offers an optional in-product assistant (“Horton”) that uses a third-party AI model (Amazon Bedrock) to answer typed product questions from public documentation only; it does not process Customer Data. See the Who Sees What Product Schedule.
Digadop Help: an in-application help and content product that installs managed-package components into the Customer’s Salesforce org and writes login-tracking and usage data to those components to operate and meter the Service. See the Digadop Help Product Schedule.
Clionyx: an AI documentation product that uses large language models to generate Salesforce documentation. The AI Features Addendum applies. See the Clionyx Product Schedule.
Messigent: a messaging and marketing-automation platform that sends email and therefore implicates sending-practice laws such as CAN-SPAM and CASL. See the Messigent Product Schedule.

3. Information we collect

We collect the following categories of information, depending on the products and websites you use:

Account Data: data we hold about the Customer and Authorized Users for account, billing, security, and support purposes, such as login identifiers, organization identifiers, and contact details.
Consent records: when you connect a Salesforce org, we record your acceptance of our Terms of Service, Privacy Policy, and Data Scope (the organization identifier, user identifier, the document and version accepted, the timestamp, and your IP address and user-agent) to evidence your agreement.
Usage and telemetry data: information about how the Service is accessed and used, such as feature usage, audit-history snapshots, preferences, log and diagnostic data, device and browser information, and approximate location derived from IP address.
Marketing and waitlist sign-ups: information you provide when you join a waitlist, request a demo, or subscribe to updates, together with technical metadata captured at submission, including your IP address and user-agent string.
Feedback and support submissions: information you provide when you send feedback through an in-app assistant or support widget, including the message you type and contextual metadata captured with it, such as your organization and user identifiers, the identifiers (not the contents) of any object or record you were auditing, the application version, the last client-side error, your IP address, and your user-agent string. To triage and respond to your submission, we may create an issue containing this context in our third-party issue-tracking system (GitHub); see Section 8.
AI assistant questions: for products that offer an optional in-product AI assistant (such as the Who Sees What “Horton” assistant), the product questions you type are sent to a third-party AI model (Amazon Bedrock) to generate an answer from our public product documentation, and may be logged to improve the Service. Your Connected Org data is not sent to the AI model, and your data is not used to train any model.
Contact requests and human follow-up: if the assistant cannot answer your question and you ask to be contacted by a person, we collect the contact details you choose to provide (your name and email address, and optionally a phone number and postal address) together with the request you wanted help with, so a member of our team can follow up. Providing these details is voluntary and we use them only to respond to your request. You may submit a contact request whether or not you are signed in, including as an unauthenticated visitor.
Data read from connected services: where you connect a third-party platform organization (a “Connected Org,” such as a Salesforce production org or sandbox) to a Service via OAuth, we read data from that Connected Org to provide the Service. For products that audit access configuration (such as Who Sees What), this is primarily configuration, metadata, and access information (including the user directory: names, usernames, and profiles), rather than your underlying business records. The specific data each product reads is described in that product’s Product Schedule.

We do not intentionally collect special categories of Personal Data (such as health, biometric, or precise-location data) and do not seek them through the Service.

4. How we use information

We use the information we collect to:

provide, operate, maintain, and secure the Service and our websites;
authenticate Authorized Users and manage Connected Org connections;
perform the audits, scans, documentation, or other processing the Customer directs the Service to perform;
communicate with you about your account, security, support, and Service changes;
send marketing communications where permitted, and operate waitlists and sign-up flows;
monitor, troubleshoot, analyze, benchmark, and improve the Service;
detect, prevent, and respond to fraud, abuse, and security incidents; and
comply with our legal obligations and enforce our agreements.

4.1 Customer Data, Usage Data, and how we use data we derive from yours

Customer Data is the data and content that a Customer or its Authorized Users provide to, or that the Service reads from a Connected Org on the Customer’s behalf, in order for us to provide the Service.

Usage Data is data Digadop collects or generates about the operation, performance, and use of the Service (for example, counts of users, logins, audits or cases created, feature usage, and performance telemetry), excluding the content of Customer Data. As between the parties, Digadop owns Usage Data and may use it for any lawful business purpose, including to operate, secure, analyze, benchmark, and improve the Service and to develop and train models, provided that any Usage Data Digadop discloses externally or uses to train models that benefit other customers is in aggregated or de-identified form that does not identify the Customer or any individual.

Aggregated/De-identified Data is data that has been aggregated or de-identified so that it no longer identifies, and cannot reasonably be used to identify, any individual or Customer. We may create and use Aggregated/De-identified Data for any lawful business purpose.

We use your Customer Data, and the memories, summaries, embeddings, and other data we derive from it, to provide and improve the Service for you, including through retrieval-augmented generation, stored memory, summarization, and, where offered, models or model adaptations dedicated to your organization. We do not use your Customer Data, or anything derived from it, to train, fine-tune, or improve any model, index, or output that is made available to or used for the benefit of any other customer, or that becomes part of Digadop’s general or shared models, except that we may use Usage Data and Aggregated/De-identified Data as described above. We do not use the content of Customer records (for example, the body or subject of a case) to train models that benefit other customers, even in de-identified form. Because we keep your Customer Data and the artifacts derived from it in a form we control and can delete, your deletion and retention rights apply to them, and on deletion or account closure we delete your Customer Data and the tenant-scoped memories, embeddings, summaries, and any per-organization model derived from it. We do not incorporate your Customer Data into shared models from which it cannot be deleted.

Where the GDPR or UK GDPR applies, we rely on the following legal bases:

Processing purpose	Legal basis
Providing the Service and performing our contract with the Customer	Performance of a contract (Art. 6(1)(b))
Account, billing, security, and support	Performance of a contract; legitimate interests (Art. 6(1)(f))
Usage and telemetry, troubleshooting, and product improvement	Legitimate interests in operating and improving the Service (Art. 6(1)(f))
Marketing communications and waitlist sign-ups	Consent (Art. 6(1)(a)) where required, otherwise legitimate interests (Art. 6(1)(f))
Responding to contact requests / human follow-up you submit (including as an unauthenticated visitor)	Consent (Art. 6(1)(a)) and steps taken at your request / legitimate interests in responding to your inquiry (Art. 6(1)(b) and (f)); we act as Controller for this contact data
Detecting and preventing fraud, abuse, and security incidents	Legitimate interests; legal obligation (Art. 6(1)(c))
Complying with legal obligations	Legal obligation (Art. 6(1)(c))

For Personal Data within a Connected Org that we process on a Customer’s behalf, the Customer (as Controller) is responsible for establishing the legal basis; we process it as a Processor on the Customer’s documented instructions (see Section 6).

6. Controller and processor roles

For most data we collect directly about the Customer and Authorized Users (Account Data, usage and telemetry, marketing and waitlist data), Digadop acts as a Controller: we determine the purposes and means of that processing.

For Personal Data within a Customer’s Connected Org that a Service reads and processes to perform an audit, scan, documentation, or similar task at the Customer’s direction, the Customer is the Controller and Digadop is the Processor (a “service provider” under the CCPA/CPRA). We process that Personal Data only on the Customer’s documented instructions, as set out in the Digadop Data Processing Addendum (the “DPA”). Customers whose Connected Orgs contain Personal Data subject to the GDPR, UK GDPR, or CCPA/CPRA should review and, where applicable, execute the DPA.

7. Cookies and similar technologies

Our Services and websites use cookies and similar technologies. We do not set analytics, advertising, or third-party tracking cookies; our service-improvement analytics are first-party and server-side. For a description of the cookies we use, including the strictly-functional session and sign-in security cookies, and how to control them, see the Digadop Cookie Policy.

We do not sell your Personal Data, and we do not “share” it for cross-context behavioral advertising as those terms are used under the CCPA/CPRA. We do not use analytics, advertising, or session-replay vendors.

We engage a limited set of trusted third parties (“Sub-processors”) to process Personal Data in connection with providing the Service. We require each Sub-processor to protect Personal Data under terms consistent with this policy and the DPA. Our current Sub-processors are:

Amazon Web Services, Inc. (United States, us-east-1): compute (Elastic Beanstalk), database (RDS PostgreSQL), key management (KMS), storage and content delivery (S3 and CloudFront), transactional email (SES), and, for our AI products only, AI model inference via AWS Bedrock.
GitHub, Inc. (United States): in-product feedback and issue logging. When you send feedback through an in-app assistant or support widget, the feedback context described in Section 3 may be transmitted to GitHub so that we can triage and respond to it.
esm.sh (content-delivery network, United States and global): serves front-end framework code to your browser at runtime. Your browser’s request to it discloses your IP address and user-agent string when the application loads.

For our AI products, AI model inference is performed only through AWS Bedrock; we do not send Customer Data to any separate third-party AI provider. The Who Sees What base Service applies deterministic analysis only and does not use AI model inference.

We may also disclose information: to comply with law or valid legal process; to protect the rights, property, or safety of Digadop, our Customers, or others; and in connection with a merger, acquisition, financing, or sale of assets, subject to the protections of this policy.

We provide our Customers at least 30 days advance notice before adding or replacing a Sub-processor, by email to the Customer’s designated privacy or legal contact and by updating the Sub-processor list at whoseeswhat.com/legal/sub-processors. A Customer may object on reasonable data-protection grounds as described in the DPA.

9. How we secure data

We maintain technical and organizational measures designed to protect Personal Data against unauthorized access, use, alteration, or disclosure, which currently include:

encryption of stored credentials (for example, the Salesforce refresh token is encrypted with AWS Key Management Service (KMS));
encryption in transit using TLS, and encryption of data at rest;
tenant isolation designed to prevent one Customer’s data from being accessible to another, implemented through organization-id scoping and PostgreSQL Row-Level Security enforced under a non-superuser database role;
HMAC-signed session cookies and Salesforce OAuth authentication, with no server-side password store;
access to production data restricted to authorized personnel on a least-privilege basis;
maintained and encrypted backups; and
vulnerability management and an incident-response process.

Our hosting is in the United States (currently the AWS us-east-1 region). No method of transmission or storage is completely secure, and while these measures are designed to protect your information, we cannot guarantee absolute security.

If we become aware of a personal-data breach affecting your Personal Data, we will notify the affected Customer without undue delay and, where we act as Processor, within 72 hours of becoming aware, consistent with our obligations under the DPA and applicable law.

10. Data retention

We retain information for as long as needed for the purposes described in this policy, then delete or de-identify it. Specifically:

While your account is active: we retain audit-history snapshots, preferences, and account and telemetry data for as long as needed to provide the Service, or until you ask us to delete them sooner.
Connected Org credentials: the encrypted Salesforce refresh token is deleted on sign-out or when it is revoked or becomes invalid.
After account closure or termination: we delete your stored data, including backups, within a commercially reasonable period.

We may retain Aggregated/De-identified Data and records we are required to keep by law beyond these periods.

11. International transfers

We are based in the United States and currently host data in the United States. Before processing Personal Data subject to the GDPR or UK GDPR that requires a cross-border transfer mechanism, we will implement the EU Standard Contractual Clauses or the UK International Data Transfer Addendum as applicable. Until those mechanisms are in place, we do not onboard customers that require such transfers.

12. Your rights and how to exercise them

Depending on where you live, you may have rights over your Personal Data.

GDPR / UK GDPR. You may have the right to access, correct, delete, restrict, or object to our processing of your Personal Data; to data portability; and to withdraw consent where processing is based on consent. You also have the right to lodge a complaint with a supervisory authority.

CCPA / CPRA. If you are a California resident, you may have the right to know what Personal Information we collect, use, and disclose; to access and delete it; to correct inaccurate Personal Information; and to limit certain uses. We do not sell or share Personal Information, so no opt-out of sale or sharing is required. We will not discriminate against you for exercising your rights.

How to make a request. Where your Personal Data sits within a Customer’s Connected Org and we process it as a Processor (for example, Salesforce users whose data is read by the Service), the Customer is the Controller. Please direct your request to that Customer (your organization), and we will assist the Customer in responding as required by the DPA. For your own Account Data or marketing data that we hold as a Controller, contact us at privacy@digadop.com, and we will respond within the timeframe required by applicable law. We will verify your request as required by law before responding, and you may use an authorized agent where the law permits.

13. Children

Our Services and websites are not directed to children, and we do not knowingly collect Personal Data from children under the age of 13 (or the equivalent minimum age in your jurisdiction). If you believe a child has provided us Personal Data, contact us at privacy@digadop.com and we will delete it.

14. Changes to this policy

We may update this policy from time to time. When we make material changes, we will update the Effective Date below and, where appropriate, provide additional notice. Your continued use of the Service after an update takes effect constitutes acceptance of the updated policy.

15. Contact

Stony Point, Inc., doing business as Digadop 8742 Peachtree Park Ct, Windermere, FL 34786, USA Privacy contact / Data Protection Officer: Steve Wasula, privacy@digadop.com Legal notices: legal@digadop.com