GDPR Commitment

This page describes how BuyerBot complies with the General Data Protection Regulation (GDPR) for users in the European Economic Area (EEA), United Kingdom, and Switzerland.

Data controller

BuyerBot acts as a data processor on behalf of your Slack workspace (the data controller). The workspace administrator who installs BuyerBot is responsible for ensuring that their use of BuyerBot complies with applicable data protection laws, including obtaining any necessary consent from workspace members.

Lawful basis for processing

We process personal data under the following lawful bases:

• Legitimate interest (Article 6(1)(f)) — processing Slack user IDs and display names to operate the purchase request workflow and display who requested and approved items
• Contract performance (Article 6(1)(b)) — processing data necessary to deliver the Service as described in our Terms of Service

Data we process

BuyerBot processes only the minimum personal data necessary to operate:

• Slack user IDs and display names
• Messages sent directly to BuyerBot
• Purchase request details (search queries, product selections, approval decisions)

We do not process sensitive personal data (special categories under Article 9). For a full description of data collected, see our Privacy Policy.

International data transfers

BuyerBot's infrastructure runs on Cloudflare's global edge network. Data may be processed in locations outside the EEA, including the United States. Our sub-processors (listed on our Sub-Processors page) are primarily US-based.

For transfers outside the EEA, we rely on:

• Cloudflare's Data Processing Addendum, which includes Standard Contractual Clauses (SCCs)
• Sub-processor terms that include appropriate data transfer mechanisms

Your rights as a data subject

If you are in the EEA, UK, or Switzerland, you have the following rights under GDPR. To exercise any of these, contact us at [email protected]:

• Right of access (Article 15) — request a copy of the personal data we hold about you
• Right to rectification (Article 16) — ask us to correct inaccurate data
• Right to erasure (Article 17) — ask us to delete your data, or uninstall BuyerBot from your workspace
• Right to restriction (Article 18) — ask us to restrict processing of your data
• Right to data portability (Article 20) — request a machine-readable export of your purchase request history
• Right to object (Article 21) — object to processing based on legitimate interest

We will respond to data subject requests within 30 days.

Data retention and deletion

• Data is retained for as long as BuyerBot is installed in your workspace
• When BuyerBot is uninstalled, all workspace data is deleted within 30 days
• Cached data (search results, product images) is purged automatically within 24-48 hours
• LLM conversation context is cached temporarily and purged automatically

Data breach notification

In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of data subjects, we will:

• Notify affected workspace administrators without undue delay
• Provide details of the breach, the data affected, and the measures taken
• Cooperate with data controllers in their obligation to notify supervisory authorities within 72 hours

Supervisory authority

If you are in the EEA and believe your data protection rights have been violated, you have the right to lodge a complaint with your local supervisory authority.

Contact

For GDPR-related inquiries, contact us at [email protected].