Privacy Policy
This Privacy Policy explains how Asyncbot collects, uses, and protects data when you use our Slack rotation management application.
1. Who We Are
Asyncbot is a product of Asyncmode, operated by Sven Meys BV, a company registered in Belgium. We provide a rotation management service for Slack workspaces.
Contact:
Email: [email protected]
Location: Belgium, European Union
2. What Data We Collect
We collect what the service needs to run, and nothing we do not use:
| Data Type | What It Is | Why We Need It |
|---|---|---|
| Workspace ID, name, icon and timezone | Slack's identifiers and basic details for your workspace | Identify your workspace and schedule at the right local time |
| User IDs and display names | Slack's identifiers, plus the name shown in Slack, cached | Name the person responsible on the card without a lookup every time |
| Workspace admin and owner status | Whether a person can administer the workspace | Decide who may change billing and workspace settings |
| Availability and time off | The weekdays someone works, and dates they are away | Skip people who are unavailable when handing over |
| Channel IDs | Slack's identifiers for channels | Post rotation updates in the right place |
| Rotation configurations | Schedules, membership, order and settings you create | Operate your rotations |
| Handover notes | Free text you write when handing over, encrypted at rest | Pass context to the next person |
| Support conversations | Messages you send the app, and our replies | Answer your questions |
| Usage events | A log of actions taken in the app, linked to the user who took them | Operate the service, debug faults, and understand where new workspaces get stuck |
| OAuth tokens | Authentication tokens from Slack, encrypted at rest | Post messages and send reminders on your behalf |
| Billing identifiers | Stripe customer and subscription IDs for paid plans | Manage your subscription |
| HiBob integration data | Only if an admin connects HiBob: credentials, the mapping between Slack users and HiBob employees, and leave policy names | Sync time off from your HR system |
What we do not collect:
- The content of channel conversations. The app never reads channel history and does not have permission to.
- Slack email addresses. Email is used in memory during a HiBob sync to match a person, and is not stored.
- Payment card details. Those go directly to Stripe and we never see them.
- Data for advertising or profiling. We sell nothing and share nothing with advertisers.
Messages you send the app directly are a deliberate exception to the first point. Support only works if we can read what you write to us.
3. How We Use Your Data
We use your data to:
- Provide the service: Run your rotation schedules
- Post updates: Send rotation announcements to your designated channels
- Send reminders: Notify users via DM when it is their turn
- Answer support: Read and reply to messages you send the app
- Improve onboarding: Look at aggregate usage events to see where new workspaces get stuck
We do not use your data for advertising or profiling, and we do not sell or share it with advertisers.
4. Cookies and Browser Storage
We use only strictly necessary cookies and browser storage for core functionality. No tracking, analytics, or advertising cookies are used.
| Type | Purpose | Duration |
|---|---|---|
| Authentication cookie | Keep you signed in to the billing area (httpOnly, secure) | 15 minutes |
| Session storage | Your workspace name, icon and plan, so the page can greet you, plus checkout state if you started an upgrade | Until the browser tab closes |
Because these are strictly necessary for functionality you explicitly request, no consent banner is required under GDPR and the ePrivacy Directive.
5. Legal Basis for Processing
Most of what we do rests on contract performance (Article 6(1)(b) GDPR). When your workspace installs Asyncbot, you enter into an agreement with us to provide rotation management, and processing your data is necessary to fulfil it.
Two things rest on a different basis, and we would rather name them than stretch one:
- Error monitoring relies on our legitimate interest (Article 6(1)(f)) in keeping the service working. You can object by writing to [email protected].
- Invoices and billing records rest on legal obligation (Article 6(1)(c)), which is why they survive deletion of everything else.
6. Where We Store Your Data
Your rotation data lives in the European Union:
- Application and database: Hostinger, Paris, France
- Backups: same infrastructure, kept 5 days
Some of the providers we depend on process data outside the EEA. Slack is in the United States, Sentry is in the United States, Stripe is in the United States and the EU, and HiBob is in whichever region your company uses. Those transfers rely on Standard Contractual Clauses. Section 7 names each one and what it receives.
7. Sub-processors
We use the following third-party services to operate Asyncbot. A canonical copy of this table, with the same content, is on our security page.
| Service | Purpose | Location |
|---|---|---|
| Hostinger | Application hosting and the PostgreSQL database | Paris, France (EU) |
| Cloudflare | Marketing site, DNS, CDN, DDoS protection, and an encrypted tunnel to the database | Global edge network |
| Slack | Workspace integration, sign-in, message delivery, and support conversations | USA (Standard Contractual Clauses) |
| Stripe | Checkout, tax and subscription billing for paid plans. We send a workspace identifier. Stripe collects payment details, name, address and email directly. | USA and EU |
| Sentry | Error and performance monitoring. Reports may include an IP address, request headers, and the Slack user and workspace identifiers involved. | USA |
| HiBob | Optional, and only when a workspace admin connects it. Employee matching and time off sync, and creating or cancelling time off requests when that is switched on. | Your company's HiBob region (USA or EU) |
We use no advertising vendors. Sentry is the only monitoring service. We will publish a change here before adding a new sub-processor, and workspace admins can ask to be notified by writing to [email protected].
8. Data Retention
- Active workspaces: we keep your data for as long as Asyncbot remains installed.
- After uninstall: the workspace is marked uninstalled at once and Asyncbot stops acting in your Slack. An automated job permanently deletes every record belonging to it 14 days later. Slack requires deletion within 14 business days and we sit inside that. If you reinstall inside those 14 days, the workspace comes back as it was: rotations, members and out-of-office dates. After the 14 days a reinstall starts from nothing.
- Backups: kept 5 days, so the last recoverable copy of a deleted workspace is gone by day 19.
- On request: you can ask for immediate deletion at any time. See Your Rights.
Two things outlive that window, and we would rather say so than leave you to find out:
- Stripe billing records. A Stripe customer record is created the moment you start a checkout, whether or not you finish it. Uninstalling stops the subscription renewing at the end of the paid period, and does not delete that customer record. Invoices are kept for tax and accounting purposes. Ask us and we will request deletion where the law allows it.
- Payment webhook receipts. We keep a list of Stripe event identifiers for 90 days so a repeated notification is not processed twice. It contains no personal data, only an identifier and a timestamp.
9. Data Security
We implement appropriate technical and organizational measures to protect your data, including:
- Encrypted data transmission (TLS)
- Encryption at rest for the most sensitive fields: Slack OAuth tokens, HiBob credentials, and handover notes
- Access controls limiting data access to essential operations only
- Regular security reviews
10. Your Rights
Under GDPR, you have the following rights regarding your data:
| Right | What It Means |
|---|---|
| Access | Request a copy of the data we hold about your workspace |
| Rectification | Request correction of inaccurate data |
| Erasure | Request deletion of your data |
| Restriction | Request we limit how we use your data |
| Portability | Receive your data in a structured, machine-readable format |
| Object | Object to processing (though this may prevent service operation) |
To exercise any right: Email [email protected] with your request. Include your Slack workspace ID so we can locate your data. We will respond within 30 days.
Workspace administrators: Data access requests should come from a workspace administrator, as they control the Asyncbot installation.
11. Supervisory Authority
If you believe we have not handled your data correctly, you have the right to lodge a complaint with the Belgian Data Protection Authority:
Autoriteit Persoonsgegevens / Autorité de protection des données
Rue de la Presse 35, 1000 Brussels, Belgium
Website: dataprotectionauthority.be
Email: [email protected]
12. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify workspace administrators of significant changes via Slack or email. The "Last updated" date at the top indicates when the policy was last revised.
13. Contact Us
Questions about this Privacy Policy or our data practices?
Email: [email protected]
Legal entity: Sven Meys BV, Belgium