SlackRelaySign in with Microsoft

Privacy policy

Effective September 23, 2026

This policy describes how Robocoder LLC (“SlackRelay,” “we,” or “us”) handles information when you visit slackrelay.com or use our Slack–Microsoft Teams relay. Contact support@slackrelay.com with privacy questions or requests.

Information we process

Billing: we store billing contact emails, notification preferences, plan state and Stripe customer/subscription identifiers. Stripe processes payment details; card numbers do not pass through our application. Mailgun delivers billing and account emails. Queued billing-email payloads are encrypted; billing-link tokens are stored as hashes and expire after 15 minutes.

Why we use it

We use information to authenticate users, check access, connect selected channels, deliver messages, maintain sessions, troubleshoot failures, secure the service, manage subscriptions, send account, billing and setup emails, and respond to requests. We also use limited website analytics to understand page usage. We do not sell personal information or use relayed conversations for advertising or to train AI models.

Sharing between organizations

Connecting channels sends message content and sender information to the other organization. Its members may copy, export or retain that information under their own policies. Your organization is responsible for choosing appropriate channels, notifying participants and having authority to share the content.

Microsoft’s team-scoped permissions can allow events from channels throughout an installed team. SlackRelay forwards only approved channel pairings; events from unpaired channels are discarded before being queued. Slack access depends on the permissions granted and channels available to the bot. Access checks may read a small message sample. We do not perform a historical conversation import.

Providers and other disclosures

We use infrastructure providers to operate the service, including Hetzner for hosting, Neon for PostgreSQL, Google Cloud Secret Manager for application credentials, and Cloudflare for domain/DNS services. Mailgun delivers account emails and receives recipient addresses and email content. We disable email open and click tracking. Slack and Microsoft process information through their platforms. We use Google Analytics for limited website measurements and Crisp for support chat. When you open chat, Crisp receives your support messages, information you choose to provide, and browser/network metadata. The chat is embedded separately from application pages; we do not automatically pass account details or invitation URLs to it. Providers receive the information needed for their functions; their own services are also subject to their policies.

We may disclose information when legally required, to investigate abuse or protect rights and security, or in a business transfer subject to appropriate confidentiality protections and applicable law.

Cookies and analytics

We use essential cookies for sign-in and request security. Optional Google Analytics and Google Ads measurement start only after you choose to allow them. You can allow analytics alone, allow analytics and ad measurement, or decline both, and change your choice using “Analytics preferences” in the footer.

With analytics enabled, Google may use measurement cookies, and we measure generic page views, setup steps, actions, errors and confirmed subscription activations. A random browser identifier stored for up to 90 days helps connect visits into a journey; it is not your Slack or Microsoft identity. Sessions reset after 30 minutes of inactivity. We remember your preference for 180 days. With ad measurement enabled, we also retain supported ad-click identifiers and limited campaign parameters to measure which ads lead to visits and upgrades. We do not enable advertising personalization or Google signals.

With your consent, Google’s scripts run directly on our pages and can access browser page information. We send canonical page names rather than invitation tokens, organization IDs, full URLs, form contents or messages. We do not send names, email addresses, billing contacts, Slack or Teams user IDs, channel names, or conversation content. Google may still receive network and browser metadata, including your IP address. Browser privacy controls can block measurement. Declining optional analytics does not affect the relay or essential account features.

Retention and deletion

Undelivered relay jobs expire after 15 minutes. Queued message text is cleared after delivery or a terminal failure; expiry cleanup runs in the background and may be delayed by an outage. This is not a promise that every copy of every record is deleted within 15 minutes.

We retain account settings, authorization records, message identifiers and mappings, delivery metadata, audit records and cached profiles as needed to operate, troubleshoot and protect the service. Cached avatar records expire after seven days unless refreshed. Backups can retain earlier encrypted message payloads after database cleanup. Backups and operational logs can retain other earlier information until their retention cycles complete. Fixed metadata and backup retention periods are not yet fully defined. We may retain records longer when needed to meet legal obligations or resolve disputes.

You can disconnect pairings and delete organizations in the app. These actions do not delete messages already delivered to Slack or Teams, or necessarily remove all account, audit or backup records. Contact us to request additional deletion. Your organization and the receiving organization control copies in their platforms.

Security and processing locations

We use HTTPS for transport. Before writing to PostgreSQL, SlackRelay encrypts queued message text and reaction payloads, stored provider tokens, and cached sender profiles using AES-256-GCM. Each encrypted value uses a fresh random nonce and authenticated context tied to its record, which detects tampering and prevents encrypted values from being substituted between records. The application decrypts messages in memory so it can translate their format and forward them between Slack and Teams. This means SlackRelay can read message content while processing it. Although messages are encrypted in transit and queued content is encrypted in our database, the relay is not end-to-end encrypted: the decryption keys are available to our service, rather than held only by the people sending and receiving messages.

Encryption keys are managed per deployment environment, not per customer organization. All organizations in a deployment share its active application encryption key. Production keys are stored in Google Cloud Secret Manager and supplied to the running application separately from PostgreSQL. We support versioned keys and re-encryption during key rotation; we do not currently provide per-organization or customer-managed keys. This protects encrypted content against a database-only exposure, but the running application has access to decryption keys.

Workspace and channel identifiers, message mappings, delivery status, reaction state, account details including installer email, and approval/audit records are not encrypted by this application-level mechanism. Access controls restrict their use. These safeguards do not guarantee against all loss or unauthorized access. Profile images are served through unguessable URLs so Slack and Teams can display them; anyone with a valid image URL may retrieve it while available.

Our providers may process information in the United States and other countries. We do not currently offer a contractual data-residency guarantee. If your organization requires a data processing agreement or specific transfer safeguards, contact us before connecting channels; this policy is not a substitute for those arrangements.

Your choices and rights

Your organization generally determines why its channel content is shared, and we process that content to provide the service on its behalf. We determine how information is used for our own site operations, security and support. Where applicable, these uses rely on providing our contracted service, legitimate interests in operating and securing it, consent where required, or legal obligations.

Depending on your location, you may have rights to access, correct, delete, restrict or obtain a copy of personal information, object to processing, withdraw consent or complain to a privacy regulator. Contact your organization first for workplace content requests, or email us. We may need to verify your identity and coordinate with the organization that controls the data. Revoking provider access stops future access but does not recall delivered messages.

Children and policy changes

SlackRelay is a business service intended for adults, not children. Contact us if you believe a child has provided personal information. We will update this page when practices change and provide additional notice of material changes where required.