Privacy Policy

Untanglr is two things: a Salesforce managed package that analyses metadata inside your org, and a website (getuntanglr.com) that sells and manages licences for that package. The two handle very different data, so we keep them apart below.

• The package reads metadata only, never your business records, and sends nothing out of your org.
• The website keeps the account, billing and licence data needed to issue and manage a licence key.
• We don't sell data, we don't run ads, and we don't track you across other sites.

Once installed, Untanglr reads how your org is built. The Flow Scanner reads your Flows: elements, loops, DML, Get Records, subflows, entry criteria, API versions and trigger context. Field X-Ray reads where fields are used: Flows, Apex classes and triggers, validation rules, page layouts and Lightning pages, list views, matching rules, formula fields and field level security, and, in the optional deep scan, report and email template definitions.

The package does not read, copy or transmit business records (Accounts, Opportunities, Cases, or any other data your org stores). A report is read as a definition, its columns and filters, never as rows of data. To read metadata, the package calls your own org's API. It makes no call to Untanglr's servers or to anyone else. The analysis, the dashboard and any exported report are generated and stored inside your Salesforce org, under your org's own security model.

Scheduled scan summaries are sent by your Salesforce org itself, to the recipients you choose in the package. They don't go through us.

The licence is checked inside your org too. An admin enters a key generated on getuntanglr.com, and the package verifies its signature with a public key that ships inside it. Nothing is sent to us to do that.

getuntanglr.com collects data at four points: your account, your billing, your licences, and our emails to you.

• Account. When you set up an account, we ask for your email address, and may ask for your first and last name and, optionally, your company. Authentication is handled by Supabase, with a one time code sent to your email and a password you choose.
• Billing. Purchases are made through Stripe, which acts as the merchant of record and collects any applicable sales tax. Stripe collects and stores your card details directly; we never see or store your full card number. We keep a record of each transaction (plan, amount, date, currency) linked to your account, so we can show your billing history.
• Licence data. To issue a licence key, we ask for the Salesforce My Domain of the org it is for and the email of an active user of that org. That user may be someone other than you, for example a client's admin. This is the minimum needed to bind a key to one org and to contact the right person about it. We never ask for business data from that org.
• Emails. We send operational emails: sign in codes and password reset links (sent by Supabase), and licence keys (sent through Resend, from billing@send.getuntanglr.com). If you cancel a Premium subscription, we also send a few reminders before it ends, 14, 7, 3 and 1 days before, so you can change your mind. Each one has a link to stop them. We don't send newsletters or advertising.

We rely on a small number of subprocessors to run the service. Each only sees the data it needs to do its job.

• Supabase: database and authentication (account, licence and billing records).
• Stripe: payment processing (card details, subscription and purchase records).
• Resend: delivery of licence and subscription emails.
• Vercel: website hosting, and Vercel Web Analytics, which counts page visits without cookies.

None of these providers are permitted to use your data for their own purposes.

The website keeps very little in your browser:

• the cookies that keep you signed in, set by Supabase;
• the currency prices are shown in, guessed from your browser's language and remembered on your device;
• while you set up an account, the choices you have made so far, kept only for that browser tab.

Page visits are counted with Vercel Web Analytics, which uses no cookies and does not follow you across other sites. We don't use advertising cookies, third party trackers, or cross site analytics pixels.

• We don't sell, rent or trade your data to anyone.
• We don't run advertising, and we don't share your data with ad networks.
• We don't access your Salesforce org's business records, ever.

We keep account, billing and licence records for as long as your account is active, and for a reasonable period after that to meet accounting and legal obligations (typically tied to tax and financial record keeping requirements).

You can ask us to access, correct, export or delete the personal data we hold about you at any time by emailing support@getuntanglr.com. We'll respond within a reasonable timeframe and confirm once it's done.

If you're in the European Union, this reflects the rights you have under the GDPR (access, rectification, erasure, portability, and the right to object). If you're in Canada, this reflects the rights you have under PIPEDA regarding access to and correction of your personal information. In both cases, the same email address handles the request.

How the package itself protects your org is described on the security and data page.

If we materially change how we collect or use data, we'll update this page and the "last updated" date at the top. For significant changes, we'll also email active account holders.

Questions about this policy, or a request about your data? Email support@getuntanglr.com.