Salesforce Support SMS Program Privacy Statement

Trust is our #1 value. This Privacy Statement explains how Salesforce processes Personal Data in connection with our Support SMS program (the “Program”), which allows customers to receive limited SMS messages during a support call (for example, a secure authentication link or a follow-up prompt for case details). 

A reference to “Salesforce,” “we,” “us” or the “Company” is a reference to Salesforce, Inc. “Personal Data” means data that identifies or relates to an identifiable individual. 

For the avoidance of doubt, Salesforce is the controller of this Personal Data, meaning that we determine how and why it is processed. Furthermore, this Privacy Statement applies solely to our processing of this Personal Data.

Scope

This Statement applies to Personal Data we collect and process when you opt in to receive SMS during a support interaction with Salesforce Support. It does not cover other Salesforce products, websites, apps, or activities, which are governed by their own policies. 

What data we collect

Data you provide: mobile phone number, name, email, company/Org ID, case numbers, and message content you send by SMS (e.g., short descriptions or clarifications). We also store your opt-in/opt-out choice and, where applicable, the IVR/voice consent record captured during the call. 

Data from your interaction: message timestamps, delivery status, carrier and route metadata, and limited technical logs necessary to operate the Program and prevent abuse. If we send you a secure link (for example, to verify your identity), any data collected after you follow that link is covered by the destination site’s notices. 

Our purposes for processing personal data

We process Personal Data to:

• Authenticate and verify the caller (e.g., send a secure login link to a verified number).
  
• Triage and resolve support issues, including collecting minimal, relevant details to create or update a case.
  
• Maintain Program operations and security, including fraud prevention, audit logs, and compliance recordkeeping.

We do not use Program messages for marketing and we do not enroll you into recurring messaging campaigns under this Program. Mobile information will not be shared or sold with or to third parties/affiliates for marketing/promotional purposes.

Other uses and disclosures 

On the basis of our legitimate interests or compliance with legal obligations, we may use or share your Personal Data as necessary or appropriate (a) to comply with applicable law, including laws outside your country of residence; (b) to comply with legal process; (c) to respond to requests from public and government authorities, including authorities outside your country of residence and to meet national security or law enforcement requirements; (d) to enforce our terms and conditions; (e) to protect our operations; (f) to protect the rights, privacy, safety or property of the Salesforce, you or others; and (g) to allow us to pursue available remedies or limit the damages that we may sustain. 

We may also share your Personal Data with relevant third parties if we are involved in a corporate transaction, such as a merger, reorganization, dissolution or other fundamental corporate change, or if all or a portion of our business, assets or stock are acquired by a third party. 

Our legal bases

We rely on your consent (captured via IVR keypress or verbal consent) to initiate SMS for a given call, and on legitimate interests to operate a secure, effective support channel (e.g., logging delivery events, detecting misuse).   

How we share data

We may share necessary data with:

• Telecom providers and messaging vendors to deliver SMS;
  
• Salesforce affiliates and service providers (IT hosting, analytics, security) that support the Program; and
  
• Authorities where required by law.

We take reasonable steps to ensure recipients provide appropriate protection for Personal Data. 

Mobile information and data collected for the purpose of opting into this SMS program will not be shared or sold with or to third parties/affiliates for marketing/promotional purposes. 

Program details (opt-in, frequency, and opt-out)

• Informational messages: You agree to receive informational messages from Salesforce, Inc.
• Opt-in method: You opt in during a support call via IVR/DTMF or verbal consent. Consent is tied to the current call/session.
  
• Message frequency: Typically 1–3 messages per support session (for example, one authentication link and up to two follow-ups).
  
• Opt-out: Text STOP to end SMS for the current and future sessions; text HELP for help. Standard Msg&Data rates may apply.
  
• U.S. messaging: The Program uses registered 10DLC or Toll-Free numbers and complies with carrier requirements. 

Data retention

Salesforce may retain your Personal Data for a period of time consistent with the original purpose of collection (see the “Our Purposes for Processing Personal Data” section above). 

Your privacy choices and rights

Subject to applicable law, you may request to access, correct, delete, restrict, or object to processing of your Personal Data, or request data portability. Where processing is based on consent, you can withdraw it at any time (this won’t affect prior processing). To exercise rights regarding Personal Data we process for our own purposes, contact us as described below. 

Security

We implement reasonable and appropriate technical and organizational measures to protect Personal Data.

International transfers

Your Personal Data may be processed in the United States and other countries that may have different data-protection laws. Where required, we use appropriate safeguards (e.g., standard contractual clauses) for cross-border transfers. 

Children’s data

The Program isn’t intended for children. We don’t knowingly collect Personal Data from children in connection with support SMS. 

Changes to this statement

We may update this Statement to reflect changes in practices, technologies, or legal requirements. We will revise the “Last updated” date accordingly. 

Contacting us

To exercise your rights regarding your Personal Data, or if you have questions regarding this Privacy Statement or our privacy practices, please fill out this form or mail us at: 

Salesforce Data Protection Officer (Salesforce Privacy Team) 

Salesforce Tower, 415 Mission Street, 3rd Floor 

San Francisco, CA 94105 

USA 

We are committed to working with you to obtain a fair resolution of any complaint or concern about privacy. If, however, you believe that we have not been able to assist with your complaint or concern, and you are located in the EEA, you have the right to lodge a complaint with the competent supervisory authority.

Additional disclosures for California residents

The California Consumer Privacy Act requires businesses to disclose whether they sell Personal Data. As a business covered by the CCPA, we do not sell Personal Data. We may “share” (as defined by California law) limited Personal Data with service providers to deliver SMS and support services under written contracts that restrict their use of the data.