Skip to content
On This Page
  • 1. Introduction

  • 2. Information We Collect

  • 3. How We Use Your Information

  • 4. Data Sharing and Disclosure

  • 5. Data Security

  • 6. Data Retention

  • 7. Your Rights

  • 8. Third-Party Services

  • 9. Children's Privacy

  • 10. International Data Transfers

  • 11. Changes to This Policy

  • 12. Contact Us

Privacy Policy

Last updated: October 9, 2026

1. Introduction

SlackBridge ("we," "our," or "us") is a product of Square Post Labs Inc., a Canadian company, and is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Slack-to-Microsoft Teams integration service and our website, including the help pages.

By using SlackBridge, you agree to the collection and use of information in accordance with this policy.


2. Information We Collect

2.1 Information You Provide

  • Slack workspace information (workspace name, team ID)
  • Microsoft Teams tenant information (tenant ID, organization name)
  • Channel mapping configurations
  • Contact email addresses for account administration

2.2 Information Collected Automatically

  • OAuth tokens (encrypted and stored securely)
  • Message routing metadata (timestamps, message and channel identifiers) retained for 7 days; this record never contains sender names or message text
  • Transient user profile data (display names and avatar images) cached for up to 24 hours so that message senders and mentioned users appear by name on the receiving platform; these cache entries expire automatically
  • For each bridged channel with mentions turned on, a member list (each person's display name, the name they can be addressed by, and their Slack or Microsoft user ID) so that @mentions reach the right person; it is replaced after each complete refresh and kept until that channel mapping is deleted, including while the mapping is paused
  • Usage statistics (message counts, feature usage)
  • Session recordings of the website and the signed-in SlackBridge dashboard, captured by our product analytics provider (PostHog) if you have accepted analytics, or by default outside the UK, the EU/EEA and Switzerland (see Cookies and your choices below), to understand how people use them: page addresses (which can include internal record identifiers), layout, clicks and scrolling. Typed input is always masked. On public website, help and legal pages the page text is visible in recordings, because it is public anyway. Everywhere else, including the sign-in page and the dashboard, all on-screen text is masked and images and elements carrying labels or tooltips are blocked, so recordings there are designed not to capture names, email addresses, channel names or message content. Recordings are retained for up to 30 days. On the same basis we also collect heatmap data: click positions, scroll depth and sampled mouse movement, linked to the page address without its query string; heatmaps contain no screen content or text
  • Technical logs for debugging and service improvement

Cookies and your choices

If you visit from the United Kingdom, the European Union or European Economic Area, or Switzerland, we ask before using analytics. Until you choose, no analytics events, session recordings or heatmap data are sent and no analytics cookies are set. If you decline, we count page views anonymously, without cookies or identifiers, and nothing is recorded and no heatmap data is collected. If you accept, analytics (including the session recordings and heatmaps described above) is turned on. Elsewhere, analytics is on by default. Wherever you are, we store your choice in your browser so we only ask once, and you can change it at any time.

2.3 Message Content

Important: SlackBridge operates on a serverless architecture. Full message content is never stored on our servers. Messages are relayed in real-time between Slack and Microsoft Teams. To support thread synchronization, we retain for 7 days only routing metadata (message and channel identifiers, timestamps, and a non-reversible one-way fingerprint, or BLAKE3 hash, of the message), after which it is automatically deleted. That record never contains the readable message body or the sender's name. Display names and avatar images are cached separately for up to 24 hours, and bridged channels with mentions turned on keep a member list of display names and user IDs, as described in section 2.2. Operational logs record identifiers, timings and error details. They never include the text of bridged messages or the names of people in bridged conversations; events about your account can include the account holder's email address. Cloudflare keeps these logs for up to 7 days. When an error occurs, an error report containing the error, the request method and path, and the most recent log lines (never the request body, headers or query string) is sent to our error-monitoring sub-processor, Sentry, which keeps it for up to 90 days.

2.4 Docs Assistant on Our Help Pages

Our help page offers an optional automated assistant. It is not a person: it finds passages in our help articles and shows them word for word, with a link to the article, and it does not write answers. When you type a question, the text is sent to Cloudflare Workers AI, part of our hosting provider Cloudflare, to find matching passages. When our answer check is switched on (the assistant says so), the question and the candidate passages are also sent to TypeSafe AI, Inc. (United States), which tells us whether a passage answers the question. It receives the question exactly as typed, so anything you include in it, but we do not send it your contact-form email, your IP address or any account data. Please don't include personal details in a question. We do not store that question, and it is not written to our logs or captured in session recordings. So that the conversation can follow you from page to page, the assistant keeps your question and the passages it showed in your browser's storage for this tab only; they are deleted when you close the tab. Your email address and any message you write to a person are not kept there. If you have accepted analytics, we record whether an answer was shown, which article it came from and your “Did this answer your question?” reply, never the question itself. To limit abuse, we count each visitor's requests using a one-way hash of their IP address (never the address itself, and never linked to a question or email); these counters are deleted within three days.

If you choose “Ask a person” or “My bridge stopped” and send the email form, we store a support request containing your email address, the name you give, your message, the help passages you were shown, and the notice shown beside the Send button with the time, and we notify our support team by email and in our Slack workspace (the notification contains only a reference and a link to the request). We do not verify the name or address, and we use them only to reply to that request: we do not add you to any mailing list or use them for marketing. These requests are deleted automatically 90 days after you send them; you can ask us to delete one sooner at privacy@slackbridge.com.

When our team is online, “Chat with a person” (and “My bridge stopped”) opens a live chat instead. The name and email address you give, the page you were on, your chat messages and any images you send are shown to our team in a private channel of our Slack workspace, which Slack Technologies, LLC hosts for us. Our system keeps the conversation, including any reactions and images, and deletes it 90 days after the chat ends (when you or our team end it, or after a period with no activity), together with the messages our system posted in Slack. Replies our team types in Slack stay in our Slack workspace. If no one joins within 5 minutes, the conversation is saved as an email support request instead and is kept as described above, and we notify our support team by email (the notification contains only a reference and a link to the request). You can stay in the chat: a reply from our team may still arrive there, and the chat then continues as described above. We do not verify the name or address, and we use them only to answer you.


3. How We Use Your Information

We use the information we collect to:

  • Provide, operate, and maintain the SlackBridge service
  • Route messages between Slack and Microsoft Teams
  • Authenticate your connections with Slack and Microsoft
  • Send administrative communications (service updates, security alerts)
  • Reply to questions and support requests you send us, including through the docs assistant on our help pages
  • Process billing and subscription management
  • Improve and optimize our service
  • Detect and prevent fraud or abuse
  • Comply with legal obligations

4. Data Sharing and Disclosure

We do not sell your personal information. We may share your information in the following circumstances:

  • Service Providers: We use the service providers (sub-processors) listed on our Sub-Processors page, for example Cloudflare for hosting and for the docs assistant's AI processing, TypeSafe for the docs assistant's answer check when switched on, and Stripe for payment processing. These providers have access only to information necessary to perform their functions.
  • Platform APIs: We interact with Slack and Microsoft Graph APIs to provide our service. Your information is shared with these platforms as necessary for functionality.
  • Legal Requirements: We may disclose information only if required by law, legal process, or government request.
  • Business Transfers: In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction.

5. Data Security

We implement industry-standard security measures to protect your information:

  • OAuth 2.0 authentication for all platform connections
  • TLS/SSL encryption for all data in transit
  • Encrypted storage for OAuth tokens and sensitive data
  • Serverless architecture with no long-term message storage (routing metadata retained for 7 days for thread sync)
  • Regular security audits and monitoring

For detailed information about our security controls and compliance status, see our Security & Compliance page.


6. Data Retention

  • Account Data: Retained for the duration of your account, plus 30 days after deletion
  • OAuth Tokens: Automatically refreshed and old tokens discarded
  • Message Content: Full messages are never stored. Only routing metadata (message and channel identifiers, timestamps, and a non-reversible one-way fingerprint) is retained for 7 days to support thread synchronization, then automatically deleted, never the readable message text or sender name
  • Usage Statistics: Per-organization message counts, totalled by month and by day and split by direction, containing no message content, sender names or recipient names. Used to show you your own usage in the optional weekly report and for our internal service reporting. Message volume does not affect your plan limits or your bill: plans are counted in linked channels and Teams connections only. These counts are currently retained for the life of the account
  • Technical Logs: Platform request logs used for debugging, containing identifiers and error details but never the text of bridged messages or the names of people in bridged conversations (events about your account can include the account holder's email address), retained by our infrastructure provider (Cloudflare) for up to 7 days. Error reports, which include the most recent log lines but never request bodies, headers or query strings, are retained by our error-monitoring provider (Sentry) for up to 90 days
  • Docs-Assistant Support Requests: Deleted automatically 90 days after you send them. Questions typed into the assistant without asking for a person are not stored
  • Billing Records: Retained as required by law (typically 7 years)

7. Your Rights

Depending on your location, you may have the following rights:

  • Access: Request a copy of your personal data
  • Correction: Request correction of inaccurate data
  • Deletion: Request deletion of your account and associated data
  • Portability: Request your data in a portable format
  • Objection: Object to certain processing of your data

To exercise these rights, contact us at privacy@slackbridge.com.


8. Third-Party Services

SlackBridge uses third-party service providers (sub-processors) to deliver our service. For a complete list, see our Sub-Processors page. Key integrations include:


9. Children's Privacy

SlackBridge is not intended for use by children under 16 years of age. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us immediately.


10. International Data Transfers

SlackBridge operates globally using Cloudflare's edge network. Your data may be processed in various locations worldwide. We ensure appropriate safeguards are in place for international transfers, including standard contractual clauses where applicable.


11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Last updated" date. Your continued use of SlackBridge after changes constitutes acceptance of the updated policy.


12. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us:

Company: Square Post Labs Inc. (Canada)
Email: privacy@slackbridge.com
Website: https://slackbridge.com