Skip to main content

Privacy Policy

Effective Date: March 2026 Company: Simplementix Product: SimplePerm (Salesforce AppExchange Managed Package)

Overview​

SimplePerm is a Salesforce managed package that migrates profiles to permission sets. This policy explains how the package handles data.

The short version: SimplePerm does not collect, transmit, or store any data outside your Salesforce org.

Data Collection​

SimplePerm does not collect data from your Salesforce org.

  • No external data transmission. All HTTP callouts target your org's own Salesforce Metadata API and REST API. Nothing leaves Salesforce.
  • No analytics or telemetry. No tracking of usage patterns, feature adoption, or error rates.
  • No cookies. SimplePerm does not set, read, or use browser cookies.
  • No user tracking. No tracking of individual behavior, login frequency, or feature usage.
  • No personal data processing. SimplePerm reads Salesforce metadata -- profile definitions and permission set configurations. It does not read, process, or store end-user personal data (names, emails, phone numbers, addresses, etc.).

Data Stored in Your Org​

SimplePerm creates data in four custom objects, all within your Salesforce org:

  • Migration_Project__c -- One record per migration run (status, source profile name, timestamps, error messages)
  • Migration_Log__c -- Log entries for each pipeline step
  • SimplePermConfig__c -- Package configuration (Metadata API version number)
  • Migration_Event__e -- Transient platform events for real-time progress updates (not persisted beyond the event bus retention period)

This data is governed by your org's security model, sharing rules, and access controls.

HTTP Callouts​

SimplePerm makes HTTP callouts to your org's own Salesforce APIs only:

  • SOAP Metadata API (/services/Soap/m/62.0) -- reads profile metadata and deploys permission sets
  • REST API (/services/data/v62.0/composite/sobjects) -- permission set assignment operations

No external domains are contacted.

Session ID Usage​

SimplePerm calls UserInfo.getSessionId() to authenticate with the Metadata API and REST API within the same org. The session ID is:

  • Used only for same-org API authentication
  • Never stored in any record, custom setting, or log
  • Never transmitted externally
  • Never exposed to client-side LWC

Data Retention and Deletion​

Migration records and log entries persist until you delete them. Deleting a Migration_Project__c record cascades to its Migration_Log__c children (master-detail). Draft migration projects are cleaned up automatically after 30 days.

Uninstalling SimplePerm removes all custom objects and their data. Nothing persists after uninstallation.

Changes to This Policy​

Simplementix may update this policy. Changes will be posted here with an updated effective date.

Contact​

Questions about this policy or SimplePerm's data handling:

Email: support@simplementix.com