🔒 Privacy Policy

Effective Date: June 2025

1) Overview

AlertMind AI is an incident copilot for Slack and Microsoft Teams. We minimize the data we collect and use it only to deliver core features like alert automation, summaries, knowledge-base Q&A, and optional ticketing. You can deploy in our cloud or self-host/on-prem.

2) Data We Collect

Workspace & Tenant Identifiers: Slack team_id/name; Microsoft 365 tenant_id.
Auth Tokens (encrypted at rest): Slack bot token; optional Microsoft OAuth/Graph tokens if you connect them.
Conversation References: Minimal IDs to send proactive DMs (e.g., hourly digest) after you message the bot once.
Admin Settings: Optional admin identifiers such as slack_admin_user_id, teams_admin_user_id, teams_admin_upns.
Uploaded Content: Files/tables you upload for the knowledge base (PDF, DOCX, PPTX, MD, ZIP/CSV, etc.).
Alert Payloads (via webhooks): Minimal incident fields from PagerDuty, Splunk On-Call, or IBM OCM for summaries, ACK, and threads.
Operational Logs: Basic service logs/metrics for reliability and abuse prevention (no broad channel/DM history).

We do not collect: full channel history or DMs you didn’t send to the bot, and we don’t monitor conversations outside the bot thread.

3) How We Use Data

Deliver core features (commands, summaries/digests, KB Q&A, auto-ACK, ticketing).
Operate and secure the service (rate limiting, troubleshooting, abuse prevention).
Optional Microsoft Graph features only use the scopes you explicitly grant.

We do not sell personal data. We do not use your customer data to train our own models.

4) LLM Usage & Data Handling

Your choice of model: OpenAI API, Hugging Face Inference, or Ollama (self-hosted/on-prem).
No long-term storage of prompts/responses by us: We process your prompts/responses to serve the request, and do not retain them beyond short-lived caches/operational logs required for reliability.
No provider training by default: Where providers allow, we do not opt in to using your data for model training. (For example, OpenAI API data is not used for training by default; we do not enable data sharing.)
Ollama/self-hosted: Prompts and outputs stay entirely within your infrastructure; we do not receive them.
PII: Avoid sending sensitive personal data in prompts. If you do, it’s processed only to fulfill the request.

5) Where Data Lives & Security

Isolation: Each workspace/tenant has a separate data area (configs, KB, vector indexes).
Encryption: Sensitive credentials are encrypted at rest; TLS in transit.
Least Privilege: We request the minimum platform scopes required for enabled features.

6) Subprocessors

We use trusted infrastructure and service providers to run AlertMind AI. Depending on your configuration, some or all of the following may apply:

Provider	Purpose	Data Categories	Primary Region
Lemon Squeezy	Billing, subscriptions, checkout	Customer email, plan/variant IDs, transaction metadata	US/EU (per vendor infrastructure)
Render	Application hosting	Runtime app data, encrypted config, operational logs	US
AWS (e.g., S3)	Storage of uploaded KB files and derived indexes	Uploaded docs, embeddings (per tenant)	Region varies by deployment
OpenAI (API) (optional)	LLM inference if you select OpenAI	Prompts/outputs for the request; no training opt-in	US/EU (per provider)
Hugging Face Inference (optional)	LLM inference if you select HF	Prompts/outputs for the request	Per provider
Ollama (self-hosted) (optional)	Local LLM inference	Prompts/outputs remain within your infra	Your environment
Logging/Monitoring (e.g., provider-native)	Reliability and security monitoring	Operational metadata; no KB content beyond necessity	Per provider

We may update this list as our infrastructure evolves. Material changes will be reflected here.

7) Retention & Deletion

Uploaded KB: Stored until you delete it (e.g., via /clearkb) or request removal.
Configs & Tokens: Kept while installed/required; removed on uninstall or by request.
Logs: Retained for a limited period for ops/security, then purged or anonymized.

You can request workspace/tenant deletion at any time via the Support page. We’ll confirm and remove data within a reasonable timeframe.

8) Platform Permissions (Transparency)

Slack (examples; exact scopes depend on features you enable):

commands — slash commands like /kb, /summary.
chat:write — post messages and summaries.
im:read/im:write — DM setup & delivery.
users:read — basic user info for routing/admin checks.
files:read — only if you upload files to the bot for KB ingestion.

Microsoft Teams (Bot Framework works without Graph; Graph is optional):

No Graph scopes required to receive/send messages after you’ve messaged the bot (we store only the conversation reference).
Optional Graph scopes if you explicitly connect them (e.g., organizational lookups): openid profile email offline_access, User.Read. Heavier scopes (e.g., Chat.ReadWrite, Group.ReadWrite.All) are requested only for features that truly require them.

9) On-Prem / Self-Hosted

If you deploy AlertMind AI in your own environment (e.g., air-gapped or on-prem), your data does not leave your infrastructure. You control storage location, retention, and access.

10) Third-Party Integrations

When you connect alert/ticketing providers (e.g., PagerDuty, Splunk On-Call, IBM OCM, Jira, GitLab), we exchange only the data required to fulfill your request (such as acknowledging incidents or creating issues).

11) Your Choices & Controls

Review/change settings via in-app commands (e.g., /config).
Delete knowledge-base content via /clearkb.
Uninstall at any time from Slack/Teams to revoke access and start deletion.
Request export or deletion via the Support page.

12) Children’s Privacy

The service is intended for professional use and is not directed to children.

13) Changes to This Policy

We may update this policy as our product evolves. We’ll update the “Effective Date” and, where required, provide additional notice in-app or on this site.

14) Contact

Questions or requests? Please visit our Support page.

Thank you for trusting AlertMind AI.

Privacy · Terms · Support · Pricing