Privacy Policy

Last updated: 17 June 2026 · CloudEzee Technologies

      The short version: MaskEzee reads Salesforce field schema and record IDs only. It never reads, stores, or transmits actual field values (names, emails, phone numbers, financial data). Your customer data never leaves your Salesforce org.
    

1. Who we are

MaskEzee is operated by CloudEzee Technologies. Contact us at contact@cloudezee.tech. For data protection queries, use the same address with the subject line "DPO".

2. What we are

Under UK GDPR and EU GDPR, MaskEzee acts as a data processor on your behalf. You (the Salesforce administrator or organisation) are the data controller. We process data strictly under your documented instructions — specifically, the fields and objects you select in the MaskEzee interface.

3. What MaskEzee reads from your Salesforce org

Field schema (metadata): object names, field names, field types, picklist values. This is structural information — it does not contain personal data.
Record IDs only: Salesforce record identifiers (18-character alphanumeric IDs). These are system identifiers with no personal data content.

MaskEzee does not read, access, store, or transmit actual field values — no names, email addresses, phone numbers, dates of birth, financial figures, or any other personal data held in your Salesforce records.

4. What MaskEzee writes to your Salesforce org

MaskEzee writes randomly generated realistic fake values back into the fields you selected. These values are generated locally and are not derived from your real data in any way.

5. Data we store about you

We store a minimal set of operational data in our own systems:

Authentication session: Your Salesforce OAuth access token is stored in an encrypted httpOnly session cookie on your browser. It expires after 8 hours. It is never written to our database.
Account record: Your Salesforce org ID, your Salesforce user ID, and your Salesforce user email address. Used to associate your account with your licence tier.
Job records: For each masking run: the object name, field names masked, timestamp, duration, and status. No field values. Used to provide your audit log.

6. Third parties

We do not sell, share, or transfer your data to third parties. Our infrastructure uses:

FastHosts VPS (UK): Application hosting. Data stays in UK/EU.
Salesforce (your org): OAuth authentication and field masking. Data remains in your org.
Cloudflare: DNS and TLS termination. No data stored.

7. Your rights

Under UK/EU GDPR you have the right to access, rectify, erase, or port your data held by us. To exercise any right, email contact@cloudezee.tech. We will respond within 30 days.

8. Retention

Job records are retained according to your plan tier: 6 months (Bronze), 24 months (Silver), 5 years (Gold). Account records are retained while your account is active and for 12 months after deletion request.

9. Security

All traffic is encrypted via TLS 1.2+. Access tokens are stored in httpOnly, Secure, SameSite=Lax cookies. Private keys and credentials are stored outside the web root with restricted file permissions. The application does not log field values at any point.

10. Changes

We will notify registered users of material changes to this policy by email at least 30 days before they take effect.