Two roles. For account, billing, security and marketing-site data, Saleslox is usually the independent controller/business. For CRM records your organisation stores (companies, contacts, leads, deals, quotes, and related content), your organisation is usually the controller and Saleslox is the processor under the DPA.
Version: 1.0
Effective date: 24 September 2026
Last updated: 24 September 2026
Controller: Saleslox LLC of Bennett St, Jersey City, NJ 07304, United States (“Saleslox”, “we”, “us” or “our”)
Privacy contact: [email protected]
1. Scope
1.1 This Privacy Policy covers: the public marketing site (saleslox.com); trial signup and purchase flows; the organisation console; the platform admin console; authentication; billing; outbound product email; first-party website analytics; threat and error monitoring; and support.
1.2 It does not replace your organisation’s own privacy notices to its employees, customers or prospects whose details are stored in CRM. Direct privacy requests about those records to your organisation’s administrator first.
1.3 Regional and sector-specific addenda in the EULA Schedule 1 still apply where those laws apply to you.
2. What we collect
2.1 Account and organisation data
- Name, work email, organisation name, display preferences, roles and memberships
- Password hashes (argon2id); we never store plaintext passwords
- Session identifiers, device/browser signals used for idle timeout and session security
- SSO configuration metadata when an organisation enables an identity provider (issuer, client credentials encrypted at rest, domain mapping)
- Setup and password-reset tokens (single-use, short-lived)
2.2 Billing and commercial data
- Billing email, plan, seats, trial dates, invoices and subscription status
- PayFast recurring-billing token; payment cards are handled by PayFast — Saleslox does not store full card numbers
- Discount/campaign codes and purchase acknowledgements
2.3 Customer Data in the CRM (processor role)
When your organisation uses Saleslox, it may store companies, contacts, leads, products, opportunities, quotes, orders, invoices, activities, support tickets, campaigns, territories, timesheets, expenses, dashboards, document templates, imports and related attachments or logos. Saleslox processes that content only to provide the Services on the organisation’s instructions.
2.4 Marketing-site and conversion data
- Pages viewed, session and visitor identifiers stored in the browser session (not long-lived advertising cookies)
- UTM campaign parameters and referring host when present
- Source IP and country derived from the request edge (for example Cloudflare), not typed by the browser
- Trial-feedback survey answers when submitted
- Cloudflare Turnstile challenge tokens on signup when abuse controls are enabled
2.5 Security, audit and operations data
- Login failures, lockouts, CSRF rejections, rate limits, IP/country allowlist hits and similar threat events
- Application error diagnostics (path, status, stack, correlation id, optional user/org context)
- Platform and regional audit logs of administrative and record changes
- Email delivery metadata for product mail
2.6 What we do not intentionally collect
Saleslox is not directed to children. Do not submit special-category or child data unless your Order expressly authorises that category and you have a lawful basis. We do not run third-party advertising pixels on the marketing site.
3. Why we collect it
| Purpose | Examples | Typical legal basis (EEA/UK) |
|---|---|---|
| Provide the Services | Accounts, CRM hosting, workflows, exports, document generation | Contract; legitimate interests for platform integrity |
| Authenticate and secure | Login, sessions, SSO, rate limits, threat detection, idle timeout | Contract; legitimate interests; legal obligation |
| Bill and collect | Trials, PayFast checkout, renewals, failed-payment notices | Contract; legal obligation (tax/accounting) |
| Communicate | Password setup, trial nurture, billing notices, support replies | Contract; legitimate interests; consent where required for marketing |
| Improve and operate | First-party site analytics, error monitoring, capacity and reliability | Legitimate interests |
| Comply and defend | Audit logs, legal requests, abuse response | Legal obligation; legitimate interests |
4. Who processes data for us
Third parties that touch personal data for Saleslox include:
| Subprocessor | Role | Typical data |
|---|---|---|
| Amazon Web Services (us-east-1) | Hosting: compute, RDS PostgreSQL, S3/CloudFront for consoles, Secrets Manager | Account, Customer Data, logs, secrets metadata |
| Cloudflare | Marketing site (Pages), DNS, Turnstile bot checks, optional tunnel/edge | IP, country, request metadata, challenge tokens, static site traffic |
| PayFast | Card payments and subscription notifications (ITN) | Billing identity, recurring-billing token, payment outcomes |
| Outbound SMTP (mail.saleslox.com mailbox) | Product and transactional email delivery | Recipient address, message content for product mail |
| Customer-chosen identity provider | SSO for that organisation only | Email and claims the IdP returns — controlled by the Customer |
A fuller contractual treatment, objection rights and transfer terms are in the Data Processing Agreement. Redis on the application host holds short-lived rate-limit and job keys only — not session tokens or passwords.
5. Disclosures
We disclose personal data only as needed to: operate the Services through the processors above; comply with law; protect Saleslox, users or the public from harm or abuse; or complete a corporate transaction under appropriate safeguards. We do not sell personal data for money and do not share it for cross-context behavioural advertising.
6. Retention
| Category | Baseline retention |
|---|---|
| Account / membership | While the account is active, then as needed for disputes, security and legal retention |
| Customer Data after termination | Export window, then deletion or de-identification subject to backups and legal holds (see DPA) |
| Soft-deleted CRM records | Recycle retention of about 30 days, then purge |
| Threat / application error events | Rolling operational window (see admin retention settings), then archive or delete |
| Website analytics sessions | Operational analytics window used by platform staff |
| Billing records | Subscription life plus up to 24 months, or longer where tax/accounting law requires |
| Backups | Rolling retention under normal backup rotation |
7. Security
Controls include tenant isolation with PostgreSQL row-level security, encryption in transit, encryption of selected secrets at rest, role-based permissions, audit logging, CSRF and origin checks, rate limiting, idle session timeout, and infrastructure hardening documented for production. No measure is perfect; report suspected incidents to [email protected] promptly.
8. Your rights
Depending on where you live, you may have rights to access, correct, delete, port, restrict or object to certain processing, withdraw consent, opt out of sale/sharing (we do not sell or share for targeted advertising), and complain to a regulator. For Customer Data in a workspace, contact your organisation’s administrator; Saleslox will assist that organisation under the DPA.
Email [email protected] for controller-side requests. We may need to verify identity and will not override a Customer’s lawful control of Customer Data except where law requires.
9. International transfers
Primary application hosting is in AWS us-east-1 (United States). Marketing assets may be served globally via Cloudflare. Email, payments and support may involve processing outside your country. Where required, we use contractual safeguards (including Standard Contractual Clauses / UK addenda as described in the DPA).
10. Cookies and similar technologies
Authentication uses HttpOnly Secure cookies for sessions. The marketing site’s analytics are first-party and cookie-free for advertising; sessionStorage holds short-lived visitor/session ids for journey analysis. Analytics collection respects recognised Global Privacy Control / Do Not Track signals where implemented. Turnstile may set provider cookies for bot challenges when enabled.
11. Changes
We may update this Policy for legal, security or product reasons. Material changes will be posted here with a new “Last updated” date. Continued use after notice constitutes acceptance where permitted by law.
12. Contact
Saleslox LLC, Bennett St, Jersey City, NJ 07304, United States
Privacy / support: [email protected]
Related documents: Terms and Conditions of Sale · EULA · Data Processing Agreement