Privacy Policy.

Information we collect

We collect information in the following ways:

• Information you provide directly. When you fill out our contact form, request a trial, or engage us for consulting, you may share your name, email, company, phone number, and a description of your inquiry.
• Product data. SmartDedupe works on the Salesforce objects you enable for deduplication (Leads, Contacts, Accounts, or custom objects). Your own System Administrator decides exactly which fields SmartDedupe uses to match duplicates — chosen as "matching columns" during setup and changeable at any time; Mahcom never selects your fields for you. To detect duplicates, SmartDedupe transmits over TLS only those administrator-selected matching fields — never your complete records. Any field your administrator does not add to the matching configuration — for example, Social Security numbers, financial account numbers, or other sensitive data — is never queried and never leaves Salesforce. Those matching fields are processed on Mahcom's infrastructure hosted on Amazon Web Services (EC2) and MongoDB Atlas, both configured with encryption at rest, and are isolated per Salesforce org. We use this data solely to identify and merge duplicates on your behalf, and for no other purpose. A current list of subprocessors is available on request.
• Usage data. We collect standard web analytics — pages viewed, approximate location, device and browser type, and referrer — to improve the site.
• Cookies. Our website uses strictly necessary cookies and, with your consent, analytics cookies. You can control cookies through your browser settings.

How we use information

• To respond to your inquiries and deliver the services you've requested.
• To provision, operate, and support SmartDedupe in your Salesforce org.
• To send service-related communications (billing, renewals, security notices).
• To improve our products and website.
• To comply with legal obligations.

We do not sell your personal information, and we do not use your Salesforce record data for any purpose other than delivering SmartDedupe's functionality to you.

How we share information

We share information only with:

• Service providers that help us operate our business — including cloud hosting (Amazon Web Services), database hosting (MongoDB Atlas), email delivery, and payment processing — under contractual confidentiality obligations. A current list of subprocessors is available on request from info@mahcom.com.
• Professional advisors (lawyers, accountants, auditors) when required for their work.
• Authorities when required by law, legal process, or to protect rights and safety.

Data retention

We retain personal information only as long as necessary to provide the services you've requested, comply with our legal obligations, and resolve disputes. Contact-form submissions are retained for up to 36 months unless you request earlier deletion. On the Salesforce side, SmartDedupe's operational records — sync-tracking rows, audit events, and cluster snapshots — are retained for 7 to 90 days by default and then removed by a scheduled cleanup job. The working copy of your mapped record fields held on the AI engine (MongoDB Atlas) is retained for as long as SmartDedupe is provisioned for your org; it is not placed on an automatic deletion timer. When you stop using SmartDedupe, or at any time on request, Mahcom purges your org's working data from the AI engine — email info@mahcom.com to request deletion. Your original Salesforce records are never modified or deleted by this process.

Your rights

Depending on your jurisdiction, you may have the right to:

• Access the personal information we hold about you.
• Correct inaccurate information.
• Request deletion of your information (subject to our retention obligations).
• Object to or restrict certain processing.
• Receive a portable copy of your information.
• Opt out of the sale of personal information (we do not sell).

To exercise any of these rights, email info@mahcom.com. We will respond within the time frame required by applicable law.

California residents (CCPA)

California residents have the rights described above under the California Consumer Privacy Act. Mahcom does not sell or share personal information for cross-context behavioral advertising. To submit a request, email info@mahcom.com with "CCPA Request" in the subject line.

International users (GDPR)

If you are located in the European Economic Area or the United Kingdom, you have rights under the GDPR. Our lawful basis for processing is typically the performance of a contract (to deliver services you've requested) or our legitimate interest in operating our business. You may contact info@mahcom.com to exercise any GDPR right.

Security

We use industry-standard technical and organizational measures to protect information, including encryption in transit (TLS), encryption at rest for stored data, access controls, and regular security reviews. No system is perfectly secure; we commit to breach notification as required by applicable law.

Changes to this policy

We may update this policy as our practices or the law changes. When we do, we will revise the "Last updated" date above. Material changes will be communicated by email to active customers.

Contact us

Questions about this policy or how we handle your information?