Privacy policy

Draft text, pending legal review. It is not yet legally binding advice or a final contract. Text in square brackets is a placeholder that the operator has not configured yet.

Who is responsible

The controller of your personal data is [not configured: ITSTHEM_LEGAL_ENTITY_NAME], [not configured: ITSTHEM_LEGAL_ADDRESS]. Contact for privacy questions: [not configured: ITSTHEM_LEGAL_CONTACT_EMAIL].

What we collect

[Legal review: complete the list of data categories.] The personal data we hold is mainly your email address, your name, your workspace and your Slack identifiers (Slack team, user and channel ids). Session records and technical data such as IP addresses in server logs are also processed to run and secure the service. Billing data is handled by Paddle, our merchant of record, not by us. We do not track you across sites.

Where data is stored

Infrastructure, databases, backups and email processing are in the European Union. Slack, which you choose to connect, delivers messages in your own Slack workspace. See the sub-processor list for the companies involved.

Cookies

We set only strictly necessary cookies, all with the __Host- prefix, so no consent banner is shown. __Host-itsthem_session keeps you signed in until the session expires or you sign out. __Host-itsthem_slack_oidc holds the state of a Sign in with Slack request for up to 10 minutes. __Host-itsthem_slack_link binds an email-confirmed Slack account link to the browser that started it, for up to 30 minutes. __Host-itsthem_slack_install holds the state of a Slack app installation request for up to 10 minutes.

Analytics

We use no third-party analytics, advertising or tracking scripts. Optional first-party analytics is off by default and, if the operator turns it on, is cookieless and served from our own origin.

Your rights

A workspace owner can download an export of the workspace data and erase the workspace in the app under Data and privacy. Erased data also leaves our backups within 30 days. Data and privacy settings

Retention

[Legal review: retention periods per data category.] Workspace data is kept until the workspace is erased. Backups keep a point-in-time recovery window of 23 days, so erased data leaves backups within 30 days of the erasure request.

Legal basis and complaints

[Legal basis, supervisory authority and complaint information to be supplied by legal review.]