Privacy Policy

• Account & workspace. When you add Super Duper to Slack, we receive your Slack workspace (team) ID and name, your Slack user ID, display name, and—where your workspace exposes it—your email, via Slack’s OAuth and users.info API.
• Content you direct us to. Messages in channels the bot has been added to, direct messages with the bot, and files you share with it, so we can summarize, answer questions, and generate output you request.
• Connected sources (optional). If you connect a third-party tool (e.g. Google Docs, Notion, Linear), we access the data needed to fulfill your requests, via that provider’s authorization.
• Usage & billing. Product usage (e.g. requests and token counts for metering) and billing records. Card details are handled by Stripe; we do not store full card numbers.

To provide and operate the service (summaries, answers, document generation), to meter and bill usage, to maintain security, and to improve the product. We do not sell your data, and we do not use your workspace content to train third-party foundation models.

We share data with processors that help us run the service: Supabase (database and authentication), Amazon Web Services and Anthropic (AI model processing via Amazon Bedrock), Vercel (hosting), Stripe (payments), Braintrust (observability and quality evaluation of AI interactions), and Pipedream (only for sources you choose to connect). Each processes data on our behalf under contract.

We retain data while your account and installation are active. Removing Super Duper from your Slack workspace stops further processing. You can delete your account from Settings, which removes your associated profile data. Some records may be retained as required for legal, accounting, or security purposes.

You control which channels the bot can access (it only sees channels it’s invited to) and which third-party sources you connect. Depending on your location, you may have rights to access, correct, or delete your personal data; contact us to exercise them.

We use industry-standard safeguards: encryption in transit, encryption of stored third-party tokens, scoped access (the bot only sees channels it’s invited to), and access controls on our systems. No method of transmission or storage is perfectly secure, but we work to protect your data and limit retention to what we need.

Depending on where you live (e.g. the EEA/UK under GDPR, or California under CCPA/CPRA), you may have rights to access, correct, delete, or port your personal data, and to object to or restrict certain processing. You can delete your account from Settings or contact us to exercise these rights; we don’t sell personal information or use it for cross-context behavioral advertising.

We and our processors operate primarily in the United States. If you access the service from elsewhere, your data may be transferred to and processed in the U.S. and other countries under appropriate safeguards.

The service isn’t directed to children under 16, and we don’t knowingly collect their personal data. Slack itself requires users to meet minimum age requirements.

We may update this policy; material changes will be reflected by the “Last updated” date above.