Data retention policy
When the Slack integration is enabled, VacationTracker processes limited data required to provide authentication and absence management / absence reminder features.
We apply data minimization and retain only the information necessary to operate the integration.
OAuth tokens, workspace and user identifiers are retained only while the integration is active and they are, along with all other slack related data is deleted upon uninstalling the slack integration or deleting the VacationTracker account.
Aside of this the only retention which remains is log data:
- event and request logs: may be retained for up to 30 days for debugging and security purposes
- system logs (non-content): retained up to 1 year
Data archiving and removal policy
When a Slack workspace uninstalls the application, all associated OAuth tokens are immediately revoked and securely deleted.
Workspace-level and user-level identifiers (such as team IDs and user IDs), along with integration configuration data, are deleted within 30 days of uninstall.
Any Slack event data or request payloads are processed transiently and are not retained beyond short-term operational logging. Debugging and security logs containing limited metadata may be retained for up to 30 days, after which they are automatically deleted.
The application does not persist Slack message content beyond what is necessary to process user-initiated actions (such as slash commands), and such data is not stored after processing.
Backup systems may retain encrypted data for up to 180 days; however, such data is isolated and automatically overwritten as part of normal backup rotation and is not used for active processing.
Data storage policy
We store as little as possible. Stored data includes:
Workspace identifiers (e.g., team ID)
User identifiers (e.g., user ID) where required for mapping users to accounts
OAuth access tokens, stored encrypted at rest
Integration configuration settings (e.g., notification preferences)
Slack message content is not stored. Message payloads (such as slash commands or interaction data) are processed transiently and are not persisted beyond request handling.
All data is stored on infrastructure operated by Linode and is encrypted in transit and at rest.
Access is restricted via role-based access controls and limited to authorized systems and personnel.
Operational logs may include limited metadata (e.g., request timestamps, team identifiers) and are retained for a short duration (30days) for debugging and security monitoring.
No Slack data is sold or used for advertising purposes. Data is used solely to provide and secure the application’s functionality.
Data hosting company
Linode
App/service has sub-processors
yes
Guidelines for sub-processors
App/service uses large language models (LLM)
no