01 What we collect
Workspace identity: the Slack team id and name, and the user who installed the app. This is what keeps one customer's data separate from another's.
People data you or your administrators provide or import: names, job titles, departments, reporting lines, work email addresses and Slack user ids.
Records created while using the product: reports, comments, time-off requests, approval forms and attached receipts.
Technical logs: timestamps, request paths and error details, kept to operate and secure the service.
02 What we do not collect
We do not read channel messages, direct messages or files outside the modules you use.
We do not sell personal data, and we do not use it to train models.
We do not store Slack passwords or Slack user tokens.
03 Why we process it
To provide the features you installed: rendering the org chart, routing an approval to the right person, counting business days correctly.
To secure the service: detecting abuse, investigating errors, keeping tenant boundaries intact.
To meet legal obligations where they apply.
04 Legal basis and roles
For people data inside your workspace, your organisation is the controller and we are the processor, acting on your instructions. A data processing agreement is available on request.
For account and billing information belonging to the person who installed the app, we act as controller.
05 How long we keep it
People and organisation data is kept while the app is installed. Uninstalling stops processing immediately; the workspace token is destroyed at once.
Approval and leave records follow the retention window configured by your administrators, which defaults to 24 months. When it expires, claim contents and attachments are deleted and the remaining record is anonymised.
Technical logs are kept for a short rolling window and then discarded.
06 Who we share it with
Cloudflare for content delivery and network protection, and a managed database host for storage. These providers process data on our instructions.
We disclose data if compelled by law, and we will tell you unless legally prohibited.
07 Your rights
People whose data is in the workspace can ask their administrator for access, correction or deletion; we support those requests.
Where the law provides rights of access, rectification, erasure, restriction, portability or objection, you can exercise them by contacting us. You may also complain to your local supervisory authority.
08 Contact
Questions about this policy, or a request about your data: write to the address on the contact page and we will respond within one business day.