Privacy Policy

Effective November 6, 2026.

This policy explains, in plain words, what personal data Slaiky uses, why, who we share it with, how long we keep it and how you can use your rights. It covers the website (slaiky.xyz), the web app (app.slaiky.xyz) and the desktop apps.

Summary

1. Who we are and who decides about your data

Slaiky is a service of DeepFrame, CNPJ 67.236.317/0001-00, based in Brazil ("we", "us").

There are two different roles:

• We are the controller of your account data (name, e-mail, sign-in), billing, security, the website, and usage and ad measurement. We decide how that data is used.
• We are the processor of workspace content (messages, files, canvases, members). The organization that owns the workspace, our customer, decides about that content. We process it only to provide the service, under the Terms of Use and the customer's instructions. If you are a member of a workspace and want to use a right over its content, ask the workspace's owner or admin first. We help the customer answer.

Data protection officer (encarregado, Brazil's LGPD art. 41): Jonh Alex Paz de Lima, at [email protected]. We answer in Portuguese and English.

2. What data we use

Account

• Name, e-mail, language and, if you turn it on, your two-step verification secret (stored encrypted).
• If you sign in with Apple: the identifier Apple sends us, your name and e-mail (which may be an Apple relay address).
• Sign-in doesn't use passwords: you sign in with a link or code sent by e-mail, or with Apple. Older accounts may still hold a password from before, no longer used, stored only as a cryptographic hash.

Profile in each workspace

• Name, @handle, title, photo, time zone, status and notification preferences.
• Other members see your name, @handle, title, photo, status, time zone and role. They don't see your e-mail.
• The workspace's owner and admins also see, in its activity log, the IP address and device recorded with important actions.

Content

• Messages, replies, reactions, mentions, drafts, saved items, files, voice messages, canvases and their versions.
• Notifications, with a preview of the text that caused them.
• E-mails of people invited to a workspace.
• If the customer brings data from Slack: the names, e-mails and titles in the export they upload.

Use and security

• Sessions and devices: IP address, browser and system (user agent), when created and last used.
• Audit log: important actions (such as signing in, inviting, changing roles), with date, IP and browser.
• Browser push notification subscriptions.

Billing

• The plan, the subscription status and the customer identifiers at Stripe.
• Card details, billing address and tax ID are given directly to Stripe, on its payment page. Slaiky never receives your card number.

App usage measurement

• Simple events, such as "message sent" or "channel created", with kinds and counts, never the text.
• Pages visited, without the workspace name or conversation codes (for example "/[workspace]/c/[conversation]").
• Technical errors, without the error message.
• An internal code for your account. Never your name or e-mail.
• We don't record your screen, don't use automatic click capture, and keep none of this in cookies.

Website

• Visit counts without cookies (Cloudflare Web Analytics).
• OpenAI ad measurement (ChatGPT Ads), only if you accept it in the cookie notice.

3. Why we use it and on what legal basis

When we rely on legitimate interests, we first check that the use is necessary, expected by you and doesn't override your rights. You can object at any time at [email protected].

We don't make decisions that affect you based solely on automated processing.

4. Artificial intelligence

• Slaiky has AI (Tomo and other agents). AI replies are marked as coming from an agent.
• When an agent works (someone mentions it, it answers in its channel, or a canvas or workflow asks it), we send OpenAI the content it needs: the workspace's name, the channel's name and topic, the agent's instructions, people's names and @handles, the conversation, the text of files mentioned, and what its tools read in the workspace (messages and threads from channels it can access, canvases, and people's names and titles).
• An agent set to answer every message in a channel reads all messages there, including those not addressed to it. The workspace chooses where each agent works and how it answers.
• When the setup assistant is on, the description of your team you type while creating a workspace goes to the AI provider that drafts the setup.
• Under OpenAI's API policy, this data isn't used to train models by default and may be kept for up to 30 days for abuse monitoring.
• A customer can connect other AI providers with its own keys (such as Anthropic or Google) and connectors. Each member can also connect AI keys and connectors of their own: only that member's personal agents use them, and nobody else in the workspace sees them. In these cases, content goes to the provider the customer or the member chose, under that provider's terms.
• We don't use your content to train models.

5. Who we share it with

We don't sell personal data, and we don't share it for third-party advertising, except ad measurement on the website if you accept it.

We use providers that process data on our behalf, under contract and only for these purposes:

Some sharing depends on you or your workspace:

• Other members of the workspace see content and profiles, according to permissions.
• Integrations the customer or a member chooses (bots, webhooks, connectors, their own AI providers, MCP clients) receive the data they set up.
• Link previews and images from other sites: when a message has a link, our server visits the page to build the preview. The preview image, and images that messages show from other sites, load from their original site, which may see the IP of whoever opens the conversation.
• Authorities, when the law requires, and in a reorganization or sale of the company, with notice to you.

6. International transfers

Data is stored on servers in the United States, and some providers work in other countries. We make these transfers under LGPD art. 33 and GDPR arts. 44 to 49, relying on each provider's data protection terms, which include the European Union's standard contractual clauses where the provider offers them, and on certifications such as the EU-U.S. Data Privacy Framework where the provider is certified. We are adopting the standard contractual clauses of Brazil's ANPD with these providers. You can ask which safeguard applies in each case at [email protected].

7. How long we keep it

8. Cookies and browser storage

Necessary (always on)

• __Host-slaiky_session: keeps you signed in (30 days).
• __Host-slaiky_magic and __Host-slaiky_apple: complete sign-in by e-mail or with Apple (minutes).
• slaiky_locale: remembers your language (1 year).
• slaiky_ws: remembers the last workspace you opened (1 year).
• In the browser's local storage: theme, last workspace and notices already closed. On the website, slaiky-lang remembers the language you picked and slaiky-ads-consent remembers your answer about ad cookies.
• In the tab's session storage, erased when the tab closes: sign-in checks, the plan you picked before paying, a notice after you leave a workspace, and waiting times between attempts.
• In the browser's cache: private files you opened, for up to 1 hour. Signing out clears it.

Advertising (only with your consent, website only)

• __obref (1 year) and __oppref (30 days), from OpenAI, with the lifetimes its documentation sets: measure whether a visit came from an ad on ChatGPT.

You can accept, refuse or change your choice at any time under "Cookies" in the website's footer. If your browser sends the Global Privacy Control signal, we treat it as a refusal. App usage measurement uses no cookies. We honor "Do Not Track" and Global Privacy Control in the app too.

9. Your rights

Under the LGPD (art. 18), the GDPR and other laws, you can ask for:

• confirmation that we process your data, and access to it;
• correction of incomplete or wrong data (much of it you can fix yourself in your profile);
• anonymization, blocking or deletion of unnecessary data or data processed unlawfully;
• portability of your data;
• deletion of data processed with your consent, and withdrawal of consent;
• information on who we share data with;
• objection to processing based on legitimate interests;
• review of automated decisions.

How to ask: write to [email protected] from your account's e-mail. We answer within 15 days (LGPD) or 30 days (GDPR). We may ask you to confirm it's you.

Delete your account: for now, ask at the e-mail above. Messages and files you posted in a workspace are part of its content, so removing them depends on that workspace's owner. The audit log stays. A workspace owner can delete the workspace at any time in Settings → General.

Export your data: for now, export is done by request at the e-mail above.

If you're not satisfied, you can complain to Brazil's data protection authority (ANPD, gov.br/anpd) or to your country's data protection authority.

California (US): we don't sell personal data. The only data that may be "shared" for advertising comes from the website's ad cookie, and only with your consent. You can refuse at any time under "Cookies". We don't discriminate against anyone who uses their rights.

10. Security

• Connections are always encrypted (HTTPS).
• Provider keys, connector tokens and two-step verification secrets are stored with AES-256-GCM encryption.
• Sign-in codes, sessions, tokens and any old password are stored only as cryptographic hashes.
• Two-step verification, attempt limits, a new identity check for sensitive actions, and an audit log.
• Location (GPS) data is removed from public photos.

No system is fully secure. If an incident may bring you relevant risk or harm, we'll tell you and the ANPD within the legal deadlines.

11. Children and teenagers

Slaiky is made for teams and organizations. It isn't meant for anyone under 18, and we don't knowingly collect data from children or teenagers. If you know of an account of a minor, write to [email protected] and we'll remove it.

12. Changes to this policy

We may update this policy. If a change is relevant, we'll tell you in advance in the app or by e-mail. The date at the top shows the current version.

13. Contact

DeepFrame, CNPJ 67.236.317/0001-00, Brazil. Data protection officer: Jonh Alex Paz de Lima. E-mail: [email protected].

For users in Brazil, the Portuguese version prevails.