Privacy Policy

This policy explains what personal data ForkPoint Ltd. handles when you use the DWithEase browser extension or visit dwithease.com, why we handle it, how long we keep it, and the rights you have over it.

Who is responsible for your data

The controller of the personal data described here is ForkPoint Ltd., trading as ForkPoint, a company registered in Bulgaria, with its registered address at 14 Slivnitza Str., Ruse, Ruse 7000, Bulgaria.

• General contact, including privacy and data protection requests: hello@forkpoint.com
• Telephone: +359878466722

We are not required to appoint a Data Protection Officer and have not appointed one. Privacy requests reach a named person at the address above and are answered within the one-month deadline in Article 12(3) GDPR.

What this policy covers

• The DWithEase extension for Chrome, Safari, Edge, Firefox and Chromium browsers.
• This website, dwithease.com, including the docs and support pages.
• Email you send us for support, sales or anything else.

It does not cover the Salesforce Commerce Cloud instances you use the extension against. Those belong to your employer or client, who is the controller for whatever sits inside them.

The extension: your sandbox credentials

DWithEase stores Salesforce Commerce Cloud sandbox configurations so it can log you in automatically. Those configurations can include Account Manager usernames and passwords, storefront passwords, sandbox domains and WebDAV credentials. This is the most sensitive data the product touches, so it gets its own section.

Where it is stored

In your browser’s extension storage, on your own machine. Passwords are encrypted with AES, and the optional OnePass passphrase encrypts every stored account behind a single secret that only you know. If you have your browser’s profile sync switched on, your browser — not us — may replicate that storage to your other devices under your browser vendor’s own privacy policy.

What is not sent to us

ForkPoint does not receive your credentials. There is no DWithEase account, no login to our servers and no server-side copy of your sandbox configurations. We cannot read them, cannot reset them, and cannot recover them for you if you lose your OnePass passphrase. Exporting a configuration deliberately strips the passwords out.

Browsing activity

The extension reads and acts on the Commerce Cloud pages you have open because that is the feature you installed it for. It does not send your browsing history, page contents or usage telemetry to ForkPoint or to any third party.

Limited Use

Our use of information received from Google APIs adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements. We do not sell user data, do not use it for advertising, do not transfer it for creditworthiness or lending purposes, and do not allow humans to read it except where you have asked us to for support, where it is necessary for security, or where the law requires it.

The website: what we process, why, and for how long

We use no analytics, no advertising and no tracking cookies on dwithease.com. The one exception to a site that sets nothing is the roadmap: the pages under /roadmap/ embed Canny’s board widget, which sets its own cookies so that it can show you the board and remember what you have voted on. Everywhere else there is nothing to consent to. The processing that does happen is set out below with its purpose, its legal basis under Article 6(1) GDPR, and how long the data survives.

The support and newsletter forms on this site currently open your own email client rather than posting to a server, so what reaches us is an ordinary email from your own address.

Third parties your browser reaches on this site

Some pages load resources from other companies. Loading a resource sends your IP address and browser details to that company, which is processing of your personal data even when nothing is stored. In full:

• Google Fonts (Google Ireland Ltd. / Google LLC) — the typefaces and icon font on every page are requested from fonts.googleapis.com and fonts.gstatic.com. Your IP address reaches Google as part of that request. Google’s policy.
• Canny (Canny Inc., United States) — the roadmap is run by Canny, and the roadmap pages under /roadmap/ embed it: those pages, and only those pages, load Canny’s widget from sdk.canny.io, which sends your IP address and browser details to Canny and may set cookies of its own in order to render the board. No other page on this site loads anything of Canny’s. If you post, comment or vote — whether in the embedded board or on their portal at dwithease.canny.io — you create a relationship with Canny governed by their privacy policy. Canny’s widget loads its own error-monitoring script from js.sentry-cdn.com (Functional Software, Inc., trading as Sentry). We did not add it and we receive nothing from it, but it runs in your browser on those pages, so it is named here rather than left for you to find.

We add no Google Analytics, Matomo, advertising pixels, session recording or product analytics SDK of our own, on the site or in the extension. The only third-party script that runs anywhere on this site is Canny’s, on the roadmap pages named above, together with the error monitoring Canny loads with it.

Reviews we republish

The homepage shows real reviews from the Chrome Web Store and Firefox Add-ons listings, including the reviewer’s display name, review text, rating, date and — for Chrome — the profile picture shown next to the review, which we copy to our own server rather than hotlink. That data is personal data about the reviewer and it did not come from them directly, so, per Article 14 GDPR: we take it from the public store listing, we rely on legitimate interests (Art. 6(1)(f)) in showing prospective users honest, attributable feedback, and we show only reviews already published publicly against our own listing. If a review is yours and you would rather not appear here, email hello@forkpoint.com and we will remove it — no reason needed.

Who else sees your data

We share personal data only with:

• service providers acting on our instructions under a written Article 28 processor agreement — hosting and email;
• our accountants and lawyers, where they need it to do their job for us;
• public authorities, where a law that applies to us requires it — and we will tell you unless we are legally barred from doing so.

We do not sell personal data, do not share it for cross-context behavioural advertising, and do not disclose it to data brokers.

Transfers outside the EEA

We are based in Bulgaria and process data there. Some of the providers above are in the United States. Where personal data leaves the EEA, it is covered by the European Commission’s Standard Contractual Clauses, or by the provider’s certification under the EU–US Data Privacy Framework where it holds one. You can ask us for a copy of the safeguards that apply to any specific transfer.

Security

The site is served over HTTPS. Extension credentials are encrypted at rest on your machine as described above. Access to support mail is limited to the people who need it. No system is perfectly secure, and we do not claim otherwise — but if a breach happens that is likely to put your rights at risk, we will notify the Bulgarian supervisory authority within 72 hours and tell you directly, as Articles 33 and 34 GDPR require.

Automated decision-making

There is none. We do not profile you and we make no decisions about you by automated means that produce legal or similarly significant effects.

Your rights under the GDPR

If the GDPR applies to you, you have the right to: get a copy of the data we hold about you (Art. 15); have it corrected (Art. 16); have it erased (Art. 17); restrict how we use it (Art. 18); receive it in a portable format (Art. 20); object to processing we base on legitimate interests, including the reviews above (Art. 21); and withdraw consent at any time without affecting what we did before you withdrew it (Art. 7(3)).

Email hello@forkpoint.com. We answer within one month, free of charge. We will ask you to confirm your identity only where we genuinely cannot tell it is you, and we will not use that as a way to collect more data about you.

You can also complain to a supervisory authority. Ours is the Commission for Personal Data Protection (Комисия за защита на личните данни), 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria. If you live elsewhere in the EEA you may complain to your own national authority instead.

If you are in the United States

California, Colorado, Connecticut, Virginia and a growing list of other states give you rights over your personal information. The categories we collect are the ones listed in the table above. We do not sell your personal information, we do not share it for cross-context behavioural advertising, and we do not use it for targeted advertising or profiling. To exercise any of your rights, email hello@forkpoint.com. We honour the Global Privacy Control signal, and because we do not sell or share personal information there is nothing for it to switch off. We treat a browser “Do Not Track” header the same way.

Children

DWithEase is a professional developer tool. It is not directed at children, and we do not knowingly collect personal data from anyone under 16. If you believe a child has sent us personal data, email hello@forkpoint.com and we will delete it.

Changes to this policy

When we change this policy we update the date at the top of the page. If a change materially affects your rights, we will say so on the site and, where we have your address and the change requires it, by email — and where the change needs your consent, we will ask for it rather than assume it from your continued use.

Contact

ForkPoint Ltd., 14 Slivnitza Str., Ruse, Ruse 7000, Bulgaria
Email: hello@forkpoint.com
Telephone: +359878466722