Privacy Policy

Effective: March 2026 · Last updated: July 2026

Summary: Slack MCP Cloud processes Slack API responses on the live request path to return tool results and AI-generated workflow briefs. We do not log or retain Slack messages, files, prompts, or generated briefs. We store account state plus workflow configuration that an operator explicitly saves, content-free outcome metadata, and consented proof submissions.

Buyer review: For the controls and procurement summary, use /security. This page remains the detailed privacy and data-handling reference.

1. Who We Are

Slack MCP Cloud is operated by Rêvasser Labs ("we", "us"). Contact: privacy@revasserlabs.com.

2. What We Collect

Account credentials: Your Slack session tokens (xoxc- and xoxd-) submitted during setup. These are encrypted at rest using AES-256-GCM when stored in persistent mode, or held in ephemeral memory only.
API key: Your bearer token (stmh_ prefix) used to authenticate MCP requests.
Billing data: Stripe handles all payment processing. We receive your Stripe customer ID, plan type, and subscription status. We never see or store credit card numbers.
Usage metrics: Request counts per billing period (month), stored for rate limiting and billing. No message content, channel names, or user data is included.
Saved workflow configuration: Profile name, workflow kind, channel identifiers, optional priority-person identifiers, focus, cadence, IANA timezone, Slack delivery channel, and encrypted downstream webhook configuration when an authenticated operator explicitly saves them.
Workflow operations measurement: Tenant identifier, tool name, workflow kind, success or failure outcome, bounded error code, plan, and duration. These records never include Slack messages, prompts, generated briefs, channel identifiers, or webhook URLs.
Customer proof submissions: Workflow kind, display name, role, optional company or team name, a customer-written quote, and an operational outcome. Submission requires explicit publication consent and a content-boundary confirmation; nothing is public until operator approval.
Website analytics: Cloudflare Web Analytics records aggregate page-view and visit metrics on the hosted website. This applies to the public web pages only and is separate from Slack MCP request handling.
Hosted funnel events: The hosted web pages record limited first-party funnel events such as pricing visits, deployment review clicks, checkout starts, checkout completes, setup starts, token-connect success, usage dashboard opens, billing portal opens, and Gemini configuration views. These events are used to understand product funnel performance, not Slack message content.

3. What We Do NOT Collect

Slack message content, files, or attachments
Channel names, user-profile details, or workspace metadata outside identifiers explicitly saved in a workflow profile
Search queries or search results
Ad-tech cookies or cross-site tracking identifiers that follow you across sites
Message analytics, prompt logging, or Slack-content telemetry outside the live request path

4. How Slack Data Flows

When you invoke an MCP tool (e.g., slack_list_conversations), the hosted worker:

Authenticates your bearer token against our tenant database
Retrieves your encrypted Slack credentials
Proxies the request to the Slack API on your behalf
Returns the Slack API response directly to your MCP client

Slack API response data is processed by the requested tool and, for AI-augmented tools, by Cloudflare Workers AI during the live request. Message content and generated briefs are not logged, cached, or retained by Slack MCP Cloud after the request or scheduled delivery finishes.

5. Token Storage Modes

Ephemeral mode: Slack credentials are held in worker memory only. They are lost on worker restart or cold start. No database write occurs.
Persistent mode: Slack credentials are encrypted with AES-256-GCM using a key stored in Cloudflare environment secrets, then written to a Cloudflare D1 database. Requires explicit user consent (consent_persistent_storage: true).

6. Data Retention

Slack credentials: Stored until you disconnect them (via API) or delete your account. Ephemeral credentials are lost on worker restart.
Usage records: Retained for the current billing period plus one prior month for dispute resolution.
Billing data: Retained by Stripe per their privacy policy.
Hosted funnel events: Retained only for product analytics and conversion reporting, separate from Slack request traffic and message handling.
Workflow profiles: Retained until the account is deleted or an authenticated removal request is completed.
Workflow outcome events and schedule receipts: Bounded operational metadata is retained for product measurement, reliability review, and conversion analysis; Slack content and generated briefs are excluded.
Customer proof: Private submissions remain non-public unless approved. Approved proof remains public until consent is withdrawn or the record is removed.

7. Data Sharing

We do not sell, rent, or share your data with third parties except:

Stripe: Payment processing only.
Cloudflare: Infrastructure provider (Workers, D1, AI, and Web Analytics for the hosted site). Subject to Cloudflare's privacy policy.
Slack: Your credentials are used to authenticate API requests to Slack on your behalf.
Operator-configured downstream service: When you explicitly configure and invoke webhook delivery, the generated workflow payload is sent to that public HTTPS endpoint. The destination's own privacy terms apply.
Law enforcement: Only if required by valid legal process.

8. AI-Augmented Tools

4 tools (slack_catch_me_up, slack_triage, slack_smart_search, slack_workflow_brief) use Cloudflare Workers AI to process Slack messages. This processing happens within Cloudflare's infrastructure during the request and is not retained. Cloudflare's Workers AI does not train on customer data.

9. Security

All traffic over HTTPS/TLS
Slack tokens encrypted at rest (AES-256-GCM)
Bearer tokens are cryptographically random, scoped per tenant
No plaintext credentials in logs or responses
Worker runs on Cloudflare's global edge network with DDoS protection
Cloudflare Web Analytics is limited to aggregate website metrics and does not change MCP token or message handling

10. Website Analytics and Funnel Measurement

The hosted marketing and account pages use two separate measurement layers:

Cloudflare Web Analytics: aggregate page-view and visit metrics for hosted pages.
First-party funnel events: product-site events such as pricing visits, deployment review clicks, checkout starts, checkout completes, setup starts, token-connect success, account views, billing portal opens, and Gemini CLI documentation/config views.

These measurements apply to the hosted web surfaces. They do not add Slack message retention, Slack-content telemetry, or prompt logging to the MCP request path.

11. Workflow Operations Measurement

Workflow operations measurement is separate from website analytics. It records which hosted workflow tool ran, the selected workflow kind, success or failure, a bounded validation or delivery error code, the current plan, and duration. It is used to improve onboarding, reliability, scheduling, and the Free-to-paid path. It excludes Slack messages, prompts, generated briefs, channel identifiers, priority-person identifiers, and webhook URLs.

12. Your Rights

Regardless of your location, you can at any time:

Disconnect credentials: Remove your Slack tokens via the setup page or API
Delete your account: Contact us to permanently delete all stored data
Export your data: Request a copy of all data we hold about you
Revoke access: Rotate your Slack session tokens to immediately invalidate stored credentials

For EU/EEA residents (GDPR): You have the right to access, rectify, erase, restrict processing, data portability, and object to processing of your personal data. We process data under legitimate interest (service delivery) and contract performance. To exercise these rights, contact privacy@revasserlabs.com. We respond within 30 days.

For California residents (CCPA): You have the right to know what personal information we collect, request deletion, and opt out of sale. We do not sell personal information. To exercise these rights, contact privacy@revasserlabs.com.

Data breach notification: In the event of a data breach affecting your personal data, we will notify affected users within 72 hours of discovery via the email address associated with your account or Stripe subscription.

13. Children's Privacy

Slack MCP Cloud is not directed at individuals under 18. We do not knowingly collect data from minors.

14. Changes

We may update this policy. Material changes will be posted here with an updated effective date. Continued use after changes constitutes acceptance.

15. Contact

Questions about this privacy policy: privacy@revasserlabs.com