Data retention policy
Luffy retains workspace configuration, audit metadata, and request/run records only as needed to provide the service, secure it, troubleshoot failures, and maintain auditability. Slack data is not used for advertising or LLM training.
Data archiving and removal policy
Admins can uninstall Luffy or revoke Slack access. Verified export, correction, or deletion requests sent to support@zonko.ai are processed by deleting or anonymizing applicable data unless retention is legally required or needed for security/audit.
Data storage policy
Customer data is stored in cloud infrastructure with encrypted credentials and access controls. Credentials stay server-side and are not exposed in Slack messages, model-visible tool arguments, artifacts, or sandbox files.
Data hosting details
Cloud hosted on Cloudflare Workers, D1, R2, and related services. AI requests and connected-tool actions are processed server-side through Luffy/Harbor and approved providers.
Data hosting company
Cloudflare
App/service has sub-processors
yes
Guidelines for sub-processors
App/service uses large language models (LLM)
yes
LLM model(s) used
DeepSeek V4 Pro (primary, utility, and advisor); Anthropic Claude Opus 4.8 (onboarding); OpenAI GPT-5.4 (vision, document analysis, and web search). Requests are routed through Vercel AI Gateway.
LLM retention settings
Luffy does not use Slack data to train LLMs. Retention is limited to service operation, security, troubleshooting, and auditability.
LLM data tenancy policy
Luffy sends only request-needed context to approved model/runtime providers. Slack workspace data is not used to train provider models.
LLM data residency policy
Luffy runs on Cloudflare-hosted infrastructure. Model/runtime processing may occur through approved providers as described in the privacy policy.