Slack Privacy Policy

This document is Slack's global Privacy Policy, governing the collection, use, and disclosure of personal data across Slack's services, with Slack Technologies, LLC (a Salesforce company) serving as the primary data controller for most users and Slack Technologies Limited acting as controller for users in the EEA, UK, and Switzerland. The policy states that Slack collects data across three categories: information users provide directly (name, email, payment info, content), information collected automatically (usage data, device identifiers, log files, cookies, location inferred from IP), and information from third parties (identity providers, connected apps, partners); the terms authorize use of this data for service operation, marketing, analytics, safety, and 'developing and improving' Slack's products. Notably, the policy draws a structural distinction between 'Customer Data' (content controlled by workspace administrators, including messages and files) and other personal data Slack controls directly, meaning individual users within an organization may have limited direct rights against Slack for their own message content, with those rights mediated through the employing or administering organization. The policy engages GDPR and UK GDPR (citing Standard Contractual Clauses and adequacy decisions for international transfers), CCPA/CPRA for California residents (with explicit opt-out rights for certain data uses and a 'Do Not Sell or Share My Personal Information' link), and references COPPA by stating the service is not directed at children under 13 (or 16 in certain jurisdictions). Compliance teams operating Slack in regulated industries (healthcare, financial services, education) should note that the policy's broad data use authorizations for 'improving services' and sharing with Salesforce affiliates may require evaluation under HIPAA, GLBA, and FERPA depending on the nature of Customer Data processed.