Privacy Policy

1. Information We Collect

When You Install Our Slack App

Email address — Retrieved via Slack API for account creation and billing
User ID and name — From your Slack profile
Slack workspace ID and name — To identify your workspace
Selected notification channel — Where you want to receive alerts
Slack bot access token — Encrypted and stored securely to send notifications

AI Assistant Connections

When you connect an AI assistant, we associate its authorization with your AdStatus account, requested read-only permissions, and connection dates. We store hashes of authorization codes, refresh tokens and personal API keys rather than the credentials themselves. Access tokens expire after one hour; assistant authorizations expire after at most one year unless you disconnect earlier.

The connector's tools accept only the platform, time window, result limit, search query, or status-document identifier needed for your request. They do not ask for passwords, API keys, one-time codes, payment card details, health information, government identifiers, or sensitive personal information. Do not include these in an incident search query. Sign-in happens on AdStatus's website through the authorization flow; credentials are not requested in chat or returned in tool results. Authorization tokens are exchanged through the connection's authentication protocol, separately from tool inputs.

We receive the tool inputs your assistant sends, such as a platform name or incident search query, to answer that request. We do not receive your entire chat history. Routine tool-call logs record the tool name and account identifier, without the query text or authentication credentials. Status results and source links are returned to the assistant you chose, whose own privacy policy also applies.

You can disconnect individual assistants in Settings to stop further access immediately, or replace a personal API key to invalidate the previous key. Connection records and consumed credential hashes are retained with your account for authorization and replay detection, including after a token expires or a connection is revoked. Expiration stops access; it does not automatically delete stored records. These records are removed when the associated account is deleted. They are not used for advertising or model training. Contact support for account data deletion.

Operational Data

Alert history — Record of platform issues we've notified you about (kept for 90 days)
Last check timestamps — When we last checked for issues
Subscription status — Active, cancelled, past due, etc.

Payment Information

Stripe customer ID — Reference only, no credit card data stored by us
Stripe subscription ID — To manage your subscription
Subscription dates and status — For billing purposes

Optional Measurement Data

Google Analytics data — Page activity, referral source, UTM campaign details, and product milestones, collected by default unless you opt out of analytics
First-touch attribution — The initial opted-in landing page and campaign source, saved with a new account so we can understand which channels lead to activation
Advertising measurement data — Google Ads and Meta Pixel page and conversion events, only after you separately allow advertising measurement

We DO NOT collect:

❌ Credit card information (handled exclusively by Stripe)
❌ Slack message content
❌ Browsing history
❌ Personal information beyond what's necessary

2. How We Use Your Information

Provide the service — Monitor ad platform status and send Slack notifications
Process payments — Via Stripe for subscription billing
Customer support — To help you with issues or questions
Service improvements — Optional analytics to understand site use and improve onboarding
Advertising measurement — With your separate permission, measure whether Google and Meta campaigns lead to a card-backed trial or subscription

We DO NOT:

❌ Sell your data to third parties
❌ Sell personal data or share it for advertising without your permission
❌ Use connector inputs or connection records to train our own AI models
❌ Send marketing emails (except service updates)

3. Data Storage & Security

Where Data is Stored

Database: PostgreSQL on Railway (AWS US-East)
Data residency: United States only
Backups: Daily, retained for 7 days

Security Measures

✅ Encryption at rest: AES-256
✅ Encryption in transit: TLS 1.3 (HTTPS only)
✅ Slack tokens: Encrypted with Fernet symmetric encryption
✅ Access control: Database restricted to application only
✅ Regular updates: Security patches applied promptly

4. Data Retention

Assistant Connection Records

Access-token validity: one hour; assistant authorization validity: at most one year, or until revoked.
Connection records and credential hashes: retained until the associated account is deleted; expiration and disconnection do not themselves delete these records.
Tool inputs: processed to answer the request; incident search text is not included in routine tool-call logs.
Routine tool-call logs contain the tool name and account identifier and follow the operational log timeline below.

Active Subscriptions

All data retained during active subscription
Alert history: 90 days
Operational logs: 30 days

Cancelled Subscriptions

Slack tokens: Deleted immediately
Account data: 30-day grace period, then deleted
Payment records: Retained 7 years for tax/accounting compliance

Inactive Accounts

Never completed subscription: Deleted after 90 days
Assistant connection records: follow the Assistant Connection Records retention described above

5. Data Sharing

We Share Data With:

Connected assistant provider — Receives the status results and source links you request. Its own privacy policy governs its handling of your conversation and returned results.
Hosting and infrastructure providers — Railway hosts the application and database; Cloudflare provides request delivery and security. They process connection and request information needed to operate the service.
Stripe — Payment processing only (email address, customer ID)
Slack — OAuth tokens (returned by Slack, stored by us)
Google Analytics — Website analytics, on by default unless you opt out
Google Ads and Meta — Optional advertising measurement only when you choose "Allow analytics + ads"
FingerprintJS — Account-security signals for signed-in customers only

For Connector Data, We Do Not:

❌ Sell personal data to data brokers
❌ Send connector inputs or connection records to advertising measurement services
❌ Send connector data to third parties for our own model training

6. Your Rights

Access Your Data

Email [email protected] with subject "Data Access Request"

Response time: Within 7 business days

Delete Your Data

Options:

Email [email protected] with subject "Data Deletion Request"
Uninstall the app from Slack workspace settings
Cancel subscription via Stripe customer portal

What happens:

Slack tokens deleted within 24 hours
User data deleted within 7 business days
Payment records retained 7 years (legal requirement)
Confirmation email sent when complete

Export Your Data

Email [email protected] with subject "Data Export Request"

Receive JSON file with all your data within 7 business days

Correct Your Data

Update directly in Settings or email support

7. Compliance

GDPR (European Users)

✅ Right to access
✅ Right to deletion
✅ Right to portability
✅ Data minimization
✅ Purpose limitation
✅ Clear consent

CCPA (California Users)

✅ We do not sell personal information
✅ Right to deletion
✅ Right to access
✅ Transparent disclosure

8. Cookies & Tracking

We use the following storage and tracking controls:

Session cookie — To keep you logged in (required)
OAuth state — To prevent CSRF attacks during installation (required)
Measurement preference — Stores your choice for analytics and optional advertising measurement
Google Analytics 4 — Loaded by default; you can opt out anytime and it is torn down. It measures page activity, referral and UTM context, and signup or payment milestones.
Google Ads and Meta Pixel — Loaded only after you allow advertising measurement. They measure visits and a confirmed card-backed trial or subscription from their respective ads.
FingerprintJS — Used only after sign-in to help protect customer accounts; it stores an account-security identifier in browser storage.

We never sell personal information. Advertising pixels are optional and disabled until you allow them.

❌ Sale of personal information
❌ Analytics collection after you opt out of analytics
❌ Advertising measurement before advertising consent is granted

9. Data Breach Notification

In the unlikely event of a data breach:

Notification: Within 72 hours of discovery
Method: Email and in-app banner
Details provided: What happened, data affected, steps taken, your options

10. Children's Privacy

Our service is not directed to children under 13. We do not knowingly collect information from children under 13. If you believe we have inadvertently collected such information, please contact us immediately.

11. Changes to This Policy

Notification: 30 days before major changes via email
Change log: Maintained at this page
Review schedule: Quarterly

12. Contact Us

Data Protection & Privacy

Email: [email protected]

General Support