Salesforce

Salesforce publishes privacy, trust, and AI-governance materials around customer-data processing.

Admins can decide where AI, Data Cloud, and related product features are enabled in the organization.

Salesforce distinguishes many customer workloads where it acts as processor or service provider rather than pure controller.

Field permissions, role boundaries, and org setup can limit what sensitive CRM context reaches AI features.

Salesforce says it may use AI to process personal data, including to develop and deploy AI systems.

AI and Data Cloud features can process broad CRM context depending on org configuration.

CRM data can still flow through apps, integrations, processors, marketplace tools, and admin-managed automations.

Salesforce also allows legal, public-source, and business-transfer disclosure paths.

Salesforce provides DPA, trust, security, and subprocessor documentation for enterprise review.

Many customer-service contexts are framed as processor or service-provider activity for customer-owned workloads.

Admins can use roles, field-level security, and access governance to narrow internal sharing.

AppExchange and integration choices are at least customer-governed rather than globally forced.

Salesforce websites use cookies, web beacons, pixels, tags, and similar technologies.

The privacy statement also allows tailored advertising and cross-site activity collection on web properties.

Enterprise admins can manage permissions, data access, and AI feature availability inside the product environment.

Salesforce is primarily an enterprise SaaS platform rather than a public consumer advertising surface.

Cookie preferences and privacy choices are disclosed rather than hidden.

Salesforce gives organizations administrative control over records, exports, and lifecycle workflows.

Role-based access, auditing, and security controls support more deliberate data-lifecycle management than many lighter SaaS tools.

Customer-controlled deployments and processor contexts let organizations set stronger internal rules for many workloads.

Trust and compliance documentation gives enterprises the information needed to review lifecycle implications across clouds.

Retention still depends on product cloud, org setup, legal requirements, backups, and connected systems.

AppExchange tools and integrations can duplicate or retain customer data outside the core record lifecycle.

Admins have extensive roles, field-level security, export, audit, and privacy-request tooling.

Organizations can govern AI, Data Cloud, and connected feature access rather than leaving everything to individual users.

Salesforce publishes trust, privacy, and control documentation that helps teams understand what levers exist.

Identity and access controls such as MFA and related security features further narrow access to sensitive CRM data.

Controls require careful admin configuration and can vary by edition, product cloud, and add-on.

The large product surface makes it easy to create new sharing and AI paths unless teams govern them actively.