Slack Privacy Policy

Who this policy covers

This policy covers the Broccoli and Broccoli Dev Slack apps and their directory import into Broccoli. Broccoli is employee operations software for managing your company's people. Your employer or workspace operator decides whether to connect Slack and how to use the imported information. For data collected by our website, see our website privacy policy.

What we access and save

When a workspace administrator connects Slack, we receive the Slack workspace ID and name and an access token that allows Broccoli to read its directory. We record who connected it and when.

When you choose to import the directory, Slack returns member profiles. Broccoli saves names, work email addresses, job titles, and Slack member IDs, together with the source workspace and import time. Bot accounts, deactivated accounts, guests, and members without a valid email address are excluded from the saved list.

We request users:read to read the directory and users:read.email to include work email addresses. This integration does not read messages, conversations, or files, and does not send messages or invitations.

How the information is used

Broccoli uses this information to prepare a saved people list for your administrator to review during company setup. Importing the directory does not automatically create employee accounts or invite your team. Reading the directory again refreshes the saved list; opening a saved review does not fetch new information from Slack.

Where data is stored and who can access it

The connection and imported directory are stored in your company's Broccoli instance. Access within Broccoli is controlled by workspace permissions. Managed instances run on infrastructure operated for Broccoli; self-hosted instances store this data on infrastructure chosen by the workspace operator.

When you connect through the Broccoli Slack app, Slack issues the access token to Broccoli's accounts service (accounts.getbroccoli.com or accounts.dev.getbroccoli.com), which hands it once to your company's Broccoli instance. It is held there for at most 60 seconds, never passes through your browser, is not logged, and is not kept afterwards. The token is then stored only in your company's instance, which reads the directory directly from Slack. When a self-hosted instance uses its own Slack app, Broccoli is not involved: the connection runs only between that instance and Slack.

Slack processes the authorization and directory requests under its own privacy policy. Hosting providers process stored data as part of running the service. We do not sell personal data.

Retention and disconnecting

The access token is kept while the connection is active. Choose Disconnecton Broccoli's people import page to remove the stored token and stop further directory reads through that connection. You can also remove the app from your Slack workspace.

Disconnecting or uninstalling does not delete the directory already saved in Broccoli. That list remains until it is replaced by a new import or deleted from the instance. To request deletion of saved directory data, contact your workspace administrator or email us below. For self-hosted instances, the operator also controls database and backup retention.

Access, correction, export, and deletion

To request access to your information, a correction, an export, or deletion, contact your workspace administrator or privacy@getbroccoli.com. Include your company name and the nature of your request; do not send passwords or Slack tokens. We may need to verify your identity and coordinate with your workspace operator to handle the request.

Contact and updates

For questions about this policy, email privacy@getbroccoli.com. Updates will be published here with a revised date. For connection instructions and support, visit Broccoli for Slack.