Plain English. Nothing smuggled in.

TL;DR

Who we are

fynn is operated by Axelerant Consulting Pvt. Ltd. ("Axelerant", "we", "us"), a company registered in India with an EU presence. Axelerant is the data controller for information processed in connection with fynn for Slack.

For purposes of the GDPR (EU), UK GDPR, India's DPDP Act 2023, and the California CCPA/CPRA, Axelerant acts as controller for data it collects about you through fynn, and as processor for data your workspace administrator directs it to process on your behalf.

What we collect

From your Slack workspace

• Member roster: Slack user IDs, names, email, avatar URL, timezone, role (member/admin/owner), guest status, display name, title, pronouns. Pulled via Slack's users:read scope.
• Messages fynn can see: replies in fynn's DM threads, replies to watercooler posts in the channel it posted to, and messages in channels your admin explicitly adds to the Channels watch list (under the Oversight pillar). fynn does not request channels:history for channels outside this list.
• Reactions on fynn's own posts (for engagement tracking).
• Opt-out preferences you set via DM commands or the member portal.

From linked integrations (per-user, optional)

• Google Calendar / Microsoft Outlook: free/busy for the next 7 days, used only to suggest mutually-free pairing windows. We do not store meeting content, attendees, or titles.
• Zoom: permission to create meetings on your host account for pairings you approve.

These integrations are per-user and optional. You grant access from the fynn member portal and can revoke at any time.

From your admins

• Workspace OAuth app credentials (Google, Microsoft, Zoom) — encrypted at rest.
• Billing details via Stripe (tenant-level; Stripe holds the card, we don't).
• Culture notes and brand-voice settings entered in the admin panel.

What we don't collect

• Your DMs with other humans.
• Messages in channels fynn was not explicitly added to.
• File attachments or file contents.
• Any data from third-party apps in your Slack workspace.
• Browser cookies on the marketing portal beyond a single session cookie (no Google Analytics, no ad pixels, no tracking).

Why we collect it and legal basis

Purpose	Data	Legal basis (GDPR)
Deliver fynn's core workflows (check-ins, pairings, watercoolers)	Roster, messages fynn can see, reactions	Contract (Art. 6(1)(b))
Personalize follow-ups via engagement profiles	Paraphrased summary of your reply style	Legitimate interest (Art. 6(1)(f)) — opt-out-able anytime via delete my profile
Calendar/Zoom integration for pairings	Free/busy windows, Zoom host token	Consent (Art. 6(1)(a))
Billing, fraud prevention, invoicing	Stripe customer ID, workspace email	Contract; legal obligation
Service reliability, security monitoring, error reporting	Server logs, error traces	Legitimate interest

Who we share with (sub-processors)

We share only with service providers we need to deliver fynn. We do not sell personal data. Current sub-processors:

Sub-processor	Purpose	Region
Anthropic (Claude API)	LLM inference for check-in/pairing/watercooler AI. Zero-retention by contract; not used to train models.	United States
AWS	Application hosting, database, object storage.	Asia-Pacific (Mumbai)
Stripe	Subscription billing, tax, card handling.	United States
Slack	The platform fynn operates on.	United States
Sentry	Server-side error and performance monitoring.	United States
Giphy (platform-wide)	Image lookup for watercooler topics (rating=g only).	United States

Our sub-processor list is canonical here. We will post notice 30 days before adding a new one that processes personal data.

Storage & retention

• Messages fynn can see: stored in your tenant's database row. Purged 90 days after your workspace uninstalls fynn.
• Engagement profiles: held until the member types delete my profile or the workspace uninstalls. Deletion is immediate and irreversible.
• AI traces (tokens, cost, latency): retained 12 months for cost accounting and abuse prevention.
• Integration tokens (Google / Microsoft / Zoom): encrypted at rest. Revoked when the member disconnects or the workspace uninstalls.
• Daily channel digests: compressed summaries; retained 90 days rolling.
• Server logs: 30 days.
• Audit / analytics events: 24 months.

Your rights (and how to exercise them)

Under GDPR, UK GDPR, DPDP (India), and CCPA/CPRA, you have the right to: access, rectify, delete, restrict processing, object, data portability, and withdraw consent. Specific to fynn:

• Access your profile: DM fynn show my profile.
• Delete your profile: DM fynn delete my profile. Instant, no admin approval needed.
• Pause pairings: DM pause / snooze 2 weeks.
• Block a specific person: DM don't pair me with @someone.
• Opt out of follow-ups: DM stop DMs.
• Disconnect integrations: open the member portal link fynn DMs you.
• Any other request (access, rectification, portability, objection, complaint): email privacy@axelerant.com. We respond within 30 days.

If you're in the EU/UK and aren't satisfied with our response, you have the right to lodge a complaint with your local supervisory authority.

AI specifics

fynn uses large language models (Claude, from Anthropic) to write some of its output.

• What's sent to the LLM: compressed summaries and brand-voice context — not raw messages verbatim where avoidable.
• Zero retention: Anthropic's commercial terms guarantee inputs and outputs are not used to train their models, and are not retained beyond the duration of the request.
• Never-discuss topics are enforced at the prompt and service layer: health, family, finances, religion, performance, politics, mental health, trending crises, identity. Rate limits cap personal follow-ups at 1/user/7 days.
• Every AI call is logged (agent, model, tokens, cost, latency) in your tenant's ai_traces audit table — your admin can inspect what the AI has been doing.

Security

• TLS 1.2+ in transit, AES-256 at rest (AWS-managed keys).
• OAuth tokens and per-tenant provider secrets are encrypted application-side with Laravel's encrypted cast.
• Tenant data isolation enforced by a global Eloquent scope — cross-tenant reads require explicit escape and are audit-visible in code review.
• Principal-of-least-privilege: Slack bot token holds only the scopes listed in our app manifest; restricted Stripe keys in production.
• Vulnerability reports: security@axelerant.com. We acknowledge within 72 hours.

Children's data

fynn is a workplace tool. We do not knowingly process data of anyone under 16. If you believe we have, contact privacy@axelerant.com and we will delete it.

International data transfers

Some sub-processors (Anthropic, Stripe, Slack, Sentry) are located in the United States. Transfers out of the EU/UK rely on the EU Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum. We will accommodate data residency requests for Enterprise customers on request.

Changes to this policy

We'll post material changes here and notify workspace admins by email at least 30 days before they take effect. Non-material changes (typo fixes, broken-link repairs) can ship without notice; the effective date at the top of this page will update accordingly.

Contact

Privacy questions: privacy@axelerant.com
Security reports: security@axelerant.com
General: fynn@axelerant.com

Axelerant Consulting Pvt. Ltd.
India registered office: 4th Floor, Plot 10, Sector 44, Gurugram 122003, Haryana, India.