Privacy Policy

Introduction

This Privacy Policy explains how Slack Question Router collects, uses, stores, and protects your data when you use our Slack application. We are committed to transparency and protecting your privacy in compliance with GDPR, CCPA, and other applicable data protection laws.

By using Slack Question Router, you consent to the data practices described in this policy.

1. Information We Collect

1.1 Data Collected Automatically

When you install and use Slack Question Router, we automatically collect:

1.2 Data You Provide

1.3 Data We Do NOT Collect

We explicitly do NOT collect:

• Email addresses (removed in compliance update)
• Password or authentication credentials (handled by Slack)
• Direct messages or private conversations (unless explicitly monitored)
• Files or attachments
• Slack workspace billing information
• Sensitive personal data (health, financial, biometric data)
• Data from channels where the bot is not added

2. How We Use Your Data

2.1 Primary Purposes

We use your data exclusively for:

2.2 What We Do NOT Do With Your Data

We explicitly do NOT:

• Sell your data to third parties
• Share your data for marketing or advertising purposes
• Use your data to train AI models or for any purpose outside the Application
• Access data from channels where the bot is not installed
• Read or process direct messages between users
• Retain data indefinitely (see Data Retention below)

3. Data Retention

We maintain strict data retention policies to minimize data storage and comply with GDPR Article 5 (storage limitation):

3.1 Question Data Retention

Automated Cleanup:

• Our system runs daily cleanup jobs at 2 AM UTC
• Old questions are permanently deleted (not soft-deleted)
• Deletion is logged for audit purposes

3.2 Configuration Data Retention

Upon Uninstallation:

• All configuration data is deleted within 30 days
• Question data follows the retention schedule above
• Logs are retained for 90 days for security purposes

4. Data Storage and Security

4.1 Where We Store Your Data

Your data is stored in:

• Primary Database: PostgreSQL database hosted on secure cloud infrastructure
• Application Servers: Hosted on secure cloud infrastructure

4.2 Security Measures

We implement industry-standard security practices:

4.3 Security Incident Response

In the event of a data breach:

1. We will investigate and contain the incident within 24 hours
2. Affected users will be notified within 72 hours (GDPR requirement)
3. We will notify Slack as required
4. We will provide details on the breach scope and remediation steps
5. We will file reports with relevant data protection authorities if required

5. Data Sharing and Third Parties

5.1 Third-Party Services

We share limited data with these third-party service providers:

5.2 No Third-Party Marketing

We do NOT share your data with:

• Advertising networks
• Marketing platforms
• Data brokers
• Analytics services (except anonymized usage metrics)

5.3 Legal Requirements

We may disclose your data if required by law:

• To comply with legal obligations or court orders
• To protect our rights, property, or safety
• To investigate fraud or security issues
• In connection with a merger, acquisition, or sale of assets (with notice)

6. Your Rights and Choices

6.1 GDPR Rights (EU/EEA/UK Users)

If you are located in the European Economic Area, United Kingdom, or other GDPR-applicable jurisdictions:

• Right to Access (Article 15): Request a copy of all personal data we hold about you in structured, machine-readable format.
• Right to Rectification (Article 16): Request correction of inaccurate or incomplete data.
• Right to Erasure (Article 17): Request deletion of your personal data. Use /qr-delete-data command or uninstall the app.
• Right to Restrict Processing (Article 18): Request limitation of how we process your data.
• Right to Data Portability (Article 20): Receive your data in portable format (JSON, CSV).
• Right to Object (Article 21): Object to processing for specific purposes.
• Right to Withdraw Consent (Article 7): Withdraw consent at any time by uninstalling the app.

6.2 CCPA Rights (California Users)

If you are a California resident:

• Right to Know: Request disclosure of personal data collected, used, or shared.
• Right to Delete: Request deletion of your personal data.
• Right to Opt-Out: Opt-out of sale of personal data (Note: We do NOT sell personal data).
• Right to Non-Discrimination: We will not discriminate against you for exercising your rights.

6.3 How to Exercise Your Rights

Via Slack Commands:

• /qr-delete-data - Delete specific question data
• Uninstall the app - Delete all workspace data

Via Email:

• Data requests: privacy@slackquestionrouter.com
• General support: support@slackquestionrouter.com
• Security concerns: security@slackquestionrouter.com

We will respond to all requests within 30 days (GDPR requirement). Complex requests may take up to 60 days with notification.

7. Children's Privacy

Slack Question Router is not intended for use by individuals under 16 years of age. We do not knowingly collect personal data from children. If we discover that we have collected data from a child, we will delete it immediately. If you believe a child has provided us with personal data, contact us at privacy@slackquestionrouter.com.

8. International Data Transfers

If you are located outside the region where our servers are hosted, your data may be transferred internationally. We ensure adequate protection through:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Adequacy decisions for transfers to approved jurisdictions
• Privacy Shield frameworks (where applicable)

For users with specific data residency requirements, contact sales@slackquestionrouter.com for enterprise data localization options.

9. Cookies and Tracking

Our Slack application does NOT use cookies. All authentication is handled through Slack's OAuth tokens.

We collect anonymized usage analytics to improve the Application:

• Command usage frequency (no content)
• Feature adoption rates
• Error rates and types
• Performance metrics

Analytics are anonymized and do not contain message content, user names or identifiers, or workspace-specific information.

10. Changes to This Privacy Policy

We may update this Privacy Policy periodically. Material changes will be notified via:

• Email notification to workspace administrators
• In-app notification when using the Application
• Updated "Last Updated" date at the top of this document

Changes take effect immediately for new users and 30 days after notification for existing users. Continued use after changes take effect constitutes acceptance of the updated Privacy Policy.

11. Compliance

We are committed to maintaining compliance with:

• GDPR (General Data Protection Regulation) - EU/EEA/UK
• CCPA (California Consumer Privacy Act) - California, USA
• Slack App Security Requirements

12. Contact Information