Privacy Policy

What we collect

Slack workspace data: team ID, channel IDs, user IDs, and message content in channels where Viably is invited.
Usage data: which Powers are enabled, AI model selections, and feature interaction counts.
Credentials you provide: optional AI provider API keys, stored encrypted at rest.
Google Calendar data: if you connect your Google account through the Calendar Power: your Google email address, OAuth tokens (encrypted at rest), and the calendar events and free/busy information needed to show your team agenda and schedule meetings.
Google Search Console data: if you connect a property through the Search Console Power: your Google email address, OAuth tokens (encrypted at rest), and the search performance statistics Google reports for the properties you select (clicks, impressions, average position, and per-URL index status).

Incidental data

Slack payloads delivered to Viably include data we receive but do not intentionally store or use, such as Slack user IDs in slash command payloads, channel IDs, message timestamps, and system metadata. This data flows through our service to process your request but is not retained beyond what is necessary to complete the operation.

What we don't collect

Private DMs or channels Viably hasn't been invited to. We never read messages beyond what is needed to respond to a direct mention or reaction. Via requires explicit user interaction (e.g. @Via summarize this above, or when user uses a 🐛 reaction to file an issue with Viably, or when its in a thread where it was previously mentioned) before it participates.

How we use it

Solely to operate the Powers you enable: answering AI chat messages, tracking issues, syncing medal, relaying webhooks, and so on. We do not sell or share your data with third parties for advertising.

Third-party processors

These services run Viably for every workspace:

Cloudflare R2: stores files such as uploaded images.
Amazon SES: sends transactional email and receives mail sent to inbound.viably.app addresses.
LLM Model provider: routes AI chat requests to the model provider your workspace selects including Google or OpenAI. A workspace that brings its own API key sends requests under its own account instead.
Stripe: processes subscription payments.

These only receive data once you turn on the Power that uses them:

GitHub: issue titles and descriptions when GitHub sync is enabled.
Stripe: webhook payloads you configure for relay.
Meta: when you connect Instagram, Facebook or Threads accounts through the Social Media Power, we read (read-only) the post and account statistics Meta reports for them.
Google Calendar: when you connect your Google account via the Calendar Power, we read (read-only) your calendar events and free/busy times; events you create are written by our service account to a separate shared team calendar.
Google Search Console: when you connect a property via the Search Console Power, we read (read-only) the search statistics Google already reports for that property. Nothing is sent to Google beyond the read requests themselves.

Google user data

Two Powers use Google APIs, and each is optional. Neither is enabled until you connect an account yourself, and each requests a single read-only scope. We request no other Google scopes at any point.

View events and free/busy on your calendars (calendar.readonly): used by the Calendar Power to (1) find open meeting slots across participants when you ask Via to schedule a meeting, and (2) show your upcoming events alongside your Slack tasks and reminders in a unified agenda.
View Search Console data for your verified sites (webmasters.readonly): used by the Search Console Power to show your own search performance inside Slack and the dashboard: clicks, impressions and average position for the properties you choose, and per-URL index status retrieved through the URL Inspection API so the dashboard can tell you which of your pages Google is indexing.

Both scopes are read-only. Viably never creates or edits events on your personal calendars, and never writes to Search Console: it cannot submit or remove URLs, request indexing, or change any property setting. Events you create from Slack are written by Viably's own service account to a separate shared team calendar maintained for your workspace, never to your personal calendars. For Search Console you may skip OAuth altogether and instead grant Viably's service account restricted access to a single property from within Search Console.

We read only what the feature needs. Viably does not crawl, fetch or store the content of your web pages, and it reads no Google product other than the two named above. Search Console statistics and calendar data are stored per workspace, are never pooled across customers, and are never combined with another workspace's data.

OAuth tokens are encrypted at rest and are transmitted only to Google. Google user data is used solely to provide the user-facing features described above. We do not sell it, we do not use it for advertising, we do not transfer it to third parties, and we do not use it to develop, improve or train generalized AI or machine-learning models. No human at Supertype reads your Google data except with your explicit consent (for example, when you ask us to investigate a support issue), where required for security or to comply with applicable law.

You can disconnect at any time from the Calendar or Search Console Power page. Disconnecting revokes Viably's access and deletes the stored tokens along with the data synced under them. You can also revoke access directly from your Google account permissions page.

Viably's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Data retention

Workspace data is retained as long as your Slack app installation is active. Uninstalling Viably from Slack triggers deletion of your workspace's data within 30 days. You can also request immediate deletion by emailing us.

Security

All data is stored in a hosted PostgreSQL database with encryption at rest and in transit. API keys are encrypted before storage. Access is restricted to Supertype engineering staffs that require it to operate the service. We perform regular security audits and vulnerability scans, in line with best practices for SaaS applications of this type.

Your data rights

You have the right to access, transfer, and delete the data Viably holds about your workspace.

Access: Request what data we hold for your workspace via email.
Transfer/portability: Request your data in a machine-readable format (JSON).
Deletion: Uninstalling Viably from Slack triggers automatic deletion within 30 days. For immediate deletion, email us.
Legal rights: If you are in the EU or California, you may have additional privacy rights under GDPR, CCPA, or similar laws. Contact us to understand your options.

GDPR

We apply the EU and UK General Data Protection Regulation to every workspace, wherever it is based.

Our role: for the content your workspace sends through Viably, your organization is the controller and Supertype acts as its processor. We process that data only to run the Powers you enable. For account and billing details, Supertype is the controller.
Legal basis: we process data to perform our contract with you, and for our legitimate interest in keeping the service secure and reliable. Optional integrations such as Google Calendar, Search Console and Meta run on your consent, which you can withdraw by disconnecting them.
Your rights: you can ask us to access, correct, delete, restrict or export your personal data, or object to how we process it. Email [email protected] and we will respond within one month.
Sub-processors: every service that handles your data is listed under Third-party processors above. We will update that list before adding a new one.
International transfers: some sub-processors handle data outside the EEA and the UK. For those transfers we rely on the Standard Contractual Clauses in their data processing terms.
Data processing agreement: customers who need a DPA can request one from [email protected].
Breaches: if a breach affects your data, we will notify you without undue delay so you can meet your own 72-hour reporting duty.
Complaints: you can lodge a complaint with your local data protection authority at any time.

Data deletion

If you need to delete your data, see our User Data Deletion page. For questions, data access requests, deletion requests, or GDPR/CCPA privacy rights: [email protected]

Contact

For questions, data access requests, deletion requests, or GDPR/CCPA privacy rights: [email protected]