Plain language, in the order people actually ask. If your organisation runs a dedicated instance, the short version is simpler still: your workspace data stays in your own infrastructure and we never hold it.
All of it belongs to your workspace, is governed by your permissions, and is exportable.
Two categories, and we keep them separate. Account data is what we need to run your workspace: names, email addresses, avatars, workspace and channel names, roles and billing details. Workspace content is what your team creates: messages, files, voice notes, tasks, events and reactions.
We also record technical telemetry — device type, app version, error traces, and timing for socket delivery. That is what lets us tell you an incident is real before you open a ticket.
Running the product, supporting you when something breaks, billing, and security. That is the complete list.
We do not sell personal data, we do not rent it to advertisers, and we do not train models on your workspace content. Support engineers access workspace content only when you ask us to look at something, and that access is logged.
We use a small number of sub-processors: cloud infrastructure and storage, LiveKit for huddle media transport, a payment processor for billing, and a transactional email provider. Each is contractually bound to process data only on our instructions, and the current list is available on request.
Workspace content stays until you or your workspace admin deletes it, or until 30 days after a workspace is closed, after which it is purged from live systems and rolls out of backups within a further 30 days. Live call reactions are never stored at all. Telemetry is retained for 90 days.
You can export your workspace content, correct your profile, delete messages and files, and close the workspace. Where you have statutory rights — access, rectification, erasure, portability, objection — we honour them for personal data we control, and we help your workspace admin do the same for content they control.
Our multi-tenant cloud runs in a primary region with backups in the same jurisdiction. If you need data pinned to a specific country, that is what managed private hosting is for; if you need it never to leave your network, that is on-premise.
We use an HttpOnly session cookie and a rotating refresh token to keep you signed in, plus local storage for your theme and interface preferences. There are no advertising or cross-site tracking cookies, and the marketing site carries no third-party trackers.
If we make a material change we will tell you in the product before it takes effect — in a channel, not buried in a footer. Questions, data requests and DPAs all go to the same place: our security and privacy queue on the contact page, answered by a person.
A dedicated instance removes most of this document from the conversation: single-tenant, deployed inside your perimeter, data that never transits our systems.