Privacy Policy

Who we are

Jev for Slack is published by We The Folks sp. z o.o., based in Poznań, Poland. Our address and registration details are in the Contact section. The application runs on Cloudflare Workers with Cloudflare D1 storage.

What this policy covers

This policy covers Jev for Slack and this website. Slack itself is governed by its own policies and your organisation’s agreement with Slack. Jev for Slack is an independently published application.

Technical data-processing inventory

Our role

For workspace content processed according to an organisation’s automation rules, the organisation determines the purposes of processing and We The Folks processes that content to provide the configured service. Administrators select channels, prompts, variables, outcomes and actions.

We use contact and service-administration information to respond to requests, provide the service and maintain security. Contact us to arrange any data processing agreement required for your organisation before use.

Legal bases for processing

Where we decide why and how personal data is processed, we rely on the legal bases below under the EU General Data Protection Regulation (GDPR). For Slack content processed under a workspace’s automation rules, the organisation operating the workspace chooses what is processed and is responsible for its own legal basis; we process that content to provide the service it configured.

Providing the service

Installing and operating the app, storing rules, consent and activity, running classifications and configured actions, and answering customer support requests. Performance of a contract, Art. 6(1)(b) GDPR.

Subscriptions and billing

Free weeks, Checkout, trials and trial reminders, member counts, usage allowances, payment status and invoices. Performance of a contract, Art. 6(1)(b) GDPR.

Tax and accounting records

Keeping invoices and billing records for the periods required by tax and accounting law. Compliance with a legal obligation, Art. 6(1)(c) GDPR.

Security and operation

Verifying Slack and Stripe requests, preventing abuse, enforcing usage limits, keeping sanitized error records, delivering and protecting this website, and answering general enquiries. Our legitimate interests in a secure and reliable service, Art. 6(1)(f) GDPR.

Website analytics

Google Analytics cookies and measurement on this website, only after you accept them. Consent, Art. 6(1)(a) GDPR. You can withdraw consent at any time with Cookie settings at the bottom of every page; withdrawal does not affect processing that took place before it.

Availability email

Your email address, if you asked on this website, before October 27, 2026, to hear when Jev for Slack becomes available. Consent, Art. 6(1)(a) GDPR. You can withdraw it at any time with the unsubscribe link in the email or by writing to us; withdrawal does not affect processing that took place before it.

What the app stores

Application records are scoped to the installed Slack workspace. Full message bodies and expanded action text are excluded from activity and pending recovery records. Rule templates may contain personal information if an administrator enters it.

During the trial, Jev sends reminders as Slack messages from the Jev app to a workspace administrator’s direct message with Jev, shown in the Messages tab of App Home: one about a day and a half before the free week ends, and a heads-up about a day and a half before the Stripe trial ends and the first payment is taken. They go to the administrator who started the free week or opened Checkout, or to the installer if that person is no longer an administrator. Sending a reminder reads no message text; the app records only when it was sent.

Installation

Workspace ID and name, bot user ID, encrypted bot access token, installing administrator ID and installation time.

Rules and drafts

Workspace and owner identifiers, name, channel IDs, trigger settings, prompt, outcome descriptions, action templates, enabled state, timestamps and revision. Temporary modal drafts are bound to the workspace and administrator.

Temporary test results

Rendered action previews, selected outcomes and scores for the dry-test modal. Expanded action text may contain referenced Slack message content. Stored in workspace/user-bound drafts for up to 30 minutes, separate from Activity log.

Activity

Rule and message references, time, selected outcomes, model probabilities, action statuses and sanitized errors. Message bodies, expanded action text and provider credentials are excluded.

Pending work and receipts

Event, workspace, channel, message, rule and action identifiers, revision, retry counts, deadlines, delivery status and limited delivery results. For reaction-triggered automations, also the reaction name and the Slack user ID of the person who added it.

Processing consent

Authorization state, administrator identifier and update time.

Subscription

Workspace subscription and customer references, trial and billing history, free week start and end times, the Slack user IDs of the administrator who started the free week and of the administrator who opened Checkout, reminder send times, billable member counts, any access grant issued by us, expiring billing links and processed webhook identifiers. Payment details, billing address and VAT or tax ID are handled by Stripe.

Usage

Monthly request counts per workspace and UTC calendar month, and a separate request count for the free week, used to apply the usage allowances. Counts only, with no message content or user identifiers.

Credentials

We The Folks supplies and pays for the OpenRouter credential. Customers do not need their own API key. The provider credential and token-encryption secret stay on the backend. Slack workspace bot tokens are encrypted before storage and are used to perform the configured Slack operations.

What is sent for classification

The app sends the prompt, outcome descriptions, configured outcome labels and the Slack values explicitly referenced by those templates through OpenRouter to TypeSafe’s Jev model. It does not add implicit whole-workspace context.

Values used only in action templates are expanded by the app and are not included merely because an action references them. The complete expanded model request is limited to 30,000 UTF-8 bytes. Oversized input fails without silent truncation.

A workspace administrator or owner must authorize external processing before classifications or tests run. Consent is checked before each action. Withdrawing it cannot recall data already sent or reverse an operation already accepted by Slack.

Provider health checks verify OpenRouter account access and remaining credits without Slack message content. They do not run synthetic model inference. A successful account check does not clear a retained inference failure; that problem remains visible until a real classification succeeds. Account checks create no activity entries and perform no Slack actions.

Retention and deletion

Activity, pending recovery and action receipts have a fixed 14-day deadline from the original event receipt. Retries and progress updates do not extend that deadline. Expired operational records are excluded from application access and purged by scheduled maintenance.

Temporary editor drafts and dry-test modal results are stored in Cloudflare D1, bound to the workspace and administrator, and expire after 30 minutes. Test results can include rendered action text containing referenced Slack message content. These records use D1 storage protection; the app does not apply its separate bot-token encryption to draft or test-result JSON.

Rules remain until deleted or the app is uninstalled. Uninstall removes application data and schedules the workspace’s Stripe subscription to cancel at the end of the current billing period, or at the end of the trial. Billing identity, free week and trial history remain. Deletion does not recall data already sent to providers or reverse prior Slack actions.

Expired billing links are purged; processed Stripe webhook identifiers are retained for 90 days. Monthly and free-week usage counters contain only counts, survive reinstall so a used allowance cannot be reset, and are purged after about 13 months. Billing identity, free week and trial history, and any plan granted by us survive reinstall; we keep them while the workspace may return as a customer and delete them on request once they are no longer needed for tax, accounting or legal claims. Invoices and billing records are kept for as long as tax and accounting law requires. Contact us for workspace-specific deletion requests or information about support correspondence and required billing records.

Service providers and subprocessors

We use the providers below to run the app and this website. Where they process personal data on our behalf, they act as our processors, or as subprocessors for workspace content we process for your organisation. Locations reflect each provider’s published information and are not an exhaustive list of every onward location.

The app does not enforce provider zero retention, a no-training setting or a fixed external processing region. Do not infer those guarantees from the application’s 14-day activity window.

Cloudflare

Hosting: the Workers application runtime, the D1 application database and Pages website delivery. Location: a global network, including countries outside the EEA; Cloudflare, Inc. is based in the United States.

Slack

The platform the app runs in: workspace identity, installation authorization, message events, the reactions or posts you configure and Jev’s trial reminder messages. Your organisation’s agreement with Slack governs Slack itself. Location: as set by your Slack plan and data residency settings.

Stripe

Payments, tax calculation (Stripe Tax), invoicing, hosted Checkout and the billing portal. Stripe receives the billing details, address and VAT or tax ID provided during checkout. Location: Ireland and the United States.

OpenRouter

Routes configured classification requests to the model provider. Location: United States.

TypeSafe

Provides the Jev model that selects among configured outcomes. Location: United States.

Google

Website analytics through Google Analytics, only if you accept analytics cookies. Location: the United States and other countries where Google operates.

Resend

Stores the email addresses of people who asked to hear when Jev for Slack becomes available, and sends the availability email. Location: the United States.

Access and security

Workspace administrators and owners manage rules, tests, activity and processing consent. Administrative operations check access on the server. Installations, drafts, rules, logs and consent are isolated by workspace.

Slack requests are verified with signing secrets and timestamp checks. OAuth installation uses state validation, and bot tokens are encrypted before storage. Both the bot and the rule owner need current access to the source and destination channels; administrative status alone does not establish private-channel membership.

When a non-idempotent Slack post may have succeeded but cannot be confirmed, the app records an uncertain result and does not blindly replay it.

Security controls and limits

This website and cookies

This website is hosted on Cloudflare Pages. Cloudflare receives request information such as IP addresses and headers to deliver and protect it.

Google Analytics runs on the public domain only if you accept analytics cookies in the cookie banner. Until you accept, no Google Analytics script loads and no analytics cookies are set. If you accept, Google Analytics sets first-party cookies such as _ga and receives page URLs, referrers, device and browser details and online identifiers, which help us understand visits and interactions. Advertising storage stays denied. Website analytics is separate from the Slack app and does not connect to a workspace.

You can change or withdraw your choice at any time with Cookie settings at the bottom of every page. After withdrawal, analytics stops on this site and we remove Google Analytics cookies from your browser where the browser allows it. Your choice is stored in your browser’s local storage, not sent to us. Withdrawal does not affect processing that took place before it.

Website fonts are served from our own domain; no font request reaches a third party. Illustrative demos operate locally and do not send their sample messages to Slack or a model provider.

Availability email: until October 27, 2026, this website let you leave your email address to hear when Jev for Slack becomes available. That sign-up is now closed. The addresses already given are stored with Resend, our email provider, in a list used only for the welcome email sent at sign-up and one email announcing that Jev for Slack is available. You can unsubscribe with the link in either email or by writing to hello@wethefolks.eu, and we delete the list after the availability announcement, or earlier on request. The keyed hashes of IP addresses the form kept to limit abuse are deleted within an hour of the last sign-up.

Cloudflare Privacy Policy

Google Privacy Policy

Stripe Privacy Policy

Resend Privacy Policy

Your choices and requests

Workspace administrators can disable or delete rules, withdraw external-processing consent, and uninstall the app. These controls do not reverse reactions or messages already delivered. Administrators can cancel the subscription in the billing portal; uninstalling also schedules cancellation at the end of the current billing period.

For personal information in workspace content, contact the organisation that operates the workspace. We assist with authorized requests. Contact privacy@wethefolks.eu for access, correction, deletion, restriction or portability requests involving information we handle directly. Where we rely on legitimate interests, you can object to the processing on grounds relating to your particular situation. Where we rely on consent, you can withdraw it at any time. You may also raise a complaint with a supervisory authority, such as the President of the Personal Data Protection Office (UODO) in Poland.

Personal information embedded in administrator-written templates or labels may require a workspace-specific review. We cannot automatically locate every personal reference or remove data already transmitted to another provider.

International processing

Some providers process information outside the European Economic Area, including in the United States. The app does not restrict all processing to an EEA region.

For these transfers we rely on the safeguards each provider offers, such as the European Commission’s Standard Contractual Clauses or, where a provider is certified, the EU-U.S. Data Privacy Framework. Available safeguards differ by provider and by the role each party plays. Contact us to review the applicable contracts and transfer arrangements before using the app with data that requires them.

Changes to this policy

This Slack-specific policy is version 1.5, updated October 27, 2026. Material changes will be published with an updated date and version, with notice where required.