Privacy Policy

1. Data Controller

SFADDON India LLP ("SFADDON", "we", "us", "our") is the data controller for personal data processed in connection with our products and services. We are incorporated in India and build intelligent add-ons for SAP SuccessFactors, including SFPulse, SFCare, and other products under the SFADDON brand.

This Privacy Policy applies to our website at sfaddon.com, all SFADDON product subdomains, and any services we provide.

2. Data We Collect

Account Data

When you register for any SFADDON product, we collect your full name, business email address, company name, job title, and an encrypted password.

Usage Data

We collect basic analytics about how you interact with our products — pages visited, features used, and operation frequency. This data is aggregated and cannot be linked to individual employees in your SuccessFactors tenant.

Scan Data

SFPulse connects to your SAP SuccessFactors tenant via OData APIs to perform health diagnostics. Raw employee data is processed in memory and immediately discarded after each scan. Only derived results — health scores, issue summaries, and audit trails — are retained. We never store raw employee PII from your SuccessFactors tenant.

Tenant Connection Data

Your SuccessFactors instance URL and API credentials are stored encrypted at rest using AES-256-GCM. We never store credentials in plaintext.

3. How We Use Your Data

• To provide the services and functionality of SFADDON products
• To send notifications, alerts, and operational emails
• To generate health reports and dashboards
• To improve our products, features, and user experience
• To communicate product updates and service notices
• To comply with our legal obligations

4. Data Retention

Account data is retained for the duration of your subscription. Scan history and audit trail retention depends on your subscription tier (180 days on Starter, 1 year on Growth, 2 years on Professional, 5 years on Enterprise). Upon account closure, all associated data is permanently deleted within 30 days. You may request a data export before closure.

5. Your Rights (GDPR / PDPA)

Depending on where you are located, you may have the following rights regarding your personal data:

• Access — request a copy of the personal data we hold about you
• Rectification — request correction of inaccurate data
• Erasure — request deletion of your personal data
• Restriction — request that we limit processing in certain circumstances
• Portability — receive your data in a structured, machine-readable format
• Objection — object to processing based on legitimate interests

To exercise any of these rights, email privacy@sfaddon.com. We will respond within 30 days and may need to verify your identity before acting on your request.

6. Subprocessors

We use industry-standard, security-reviewed third-party infrastructure providers to host and operate our products. We do not sell, share, or transfer your data to any third party for advertising or marketing purposes.

The complete list of subprocessors is published at sfaddon.com/subprocessors. SFADDON commits to notifying customers at least 30 days before adding a new subprocessor that processes customer personal data.

7. Contact

For privacy-related questions or to exercise your data rights:

8. Governing Law

This Privacy Policy is governed by the laws of India. Any disputes arising under or in connection with this policy shall be subject to the exclusive jurisdiction of the courts of Pune, Maharashtra, India. For customers in the European Economic Area, United Kingdom, or Switzerland, we apply appropriate safeguards for cross-border data transfers, including Standard Contractual Clauses where applicable. SFADDON's data processing practices comply with applicable data protection regulations including India's Digital Personal Data Protection Act (DPDP Act, 2023) and international data transfer standards.

9. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or in-product notification. The "Last updated" date at the top of this page indicates when the policy was last revised. Continued use of SFADDON products after changes constitutes acceptance of the updated policy.