Privacy

• Your organization's Slack workspace, once an admin installs Big Ups.
• You, when you use Big Ups on the web or in Slack.
• Stripe, when your organization pays for a plan.
• Your browser, when you visit our website.

When Big Ups is installed, and again each night, we read the workspace's member list. For each member who has an email address, we store their name, email address, Slack member ID, a link to their Slack profile picture, and the time zone Slack reports for them. Bots and deactivated Slack accounts are skipped. This includes people who are not on your organization's roster and may never use Big Ups. Slack also tells us when somebody joins the workspace or changes their profile. When somebody leaves the workspace, we mark them inactive and they lose access.

If an admin chooses which Slack profile fields hold a person's team and manager, we read those fields and store each person's team and who manages them. An admin can correct either by hand, and a correction is never overwritten by a later sync. Nothing is read until an admin makes that choice.

By default, everyone in your workspace is on the roster, which decides who can use Big Ups and how many seats your organization is billed for. An admin can instead limit it to the members of one or more public channels. When they do, we ask Slack who is in those channels, and Slack tells us when somebody joins one; we use that to decide who is on the roster, and we do not keep the channel member lists themselves.

For each person we store whether they are on the roster, when they were added, and how - by the admission rule or by an admin. An admin can also decide that a specific person should always be included or always excluded, and we store that decision along with who made it and when. If somebody added by a channel rule is later outside every chosen channel, we store the date we first noticed. We also keep a short record of each roster check, including who it added or removed and why.

Only your organization's admins can see roster records. Big Ups does not tell anyone why they do not have access. This notice describes the kinds of records we keep in general; it is not a message about any particular person.

We do not read the messages in your channels.

You can sign in with Slack or with a link sent by email. A sign-in link works once and expires 15 minutes after it is created. A session lasts up to 30 days. We store a hash of each link and session rather than the value itself, and record when you last signed in. When you sign in with Slack, Slack sends us your name, email address and profile picture, which we use to match you to your existing account. Signing in with Slack never creates one.

For each big up: the message, who sent it, who received it, when, and the value it was tagged with, if any. We also store the formatted copy of the message we post to Slack and references to the Slack messages themselves (the channel post and the direct message), so we can update or delete them later. We record whether a big up was withdrawn, reported, hidden by an admin, or resolved after a report, and by which admin. When somebody reacts to the Slack message with an emoji, we store who reacted, by their Slack ID, and which emoji they used - this can include people who are not on your organization's roster, since anybody in the channel can react.

Your organization's name and subdomain, its Slack workspace ID and domain, a bot token for the Big Ups app installed in that workspace, the ID and name of the channel chosen for announcements, its values and teams, its roster settings, and dates about its Slack connection. We do not store an organization's postal address.

We send Stripe your organization's name. Stripe collects the payment card, billing address and email address at checkout; a full card number never reaches us. We store the Stripe customer ID and a copy of the subscription: the plan, the number of seats, its status, the end of the current period, cancellation dates and the next payment attempt. We also keep copies of the billing notifications Stripe sends us, which can include the billing email, billing address, and the card's brand and last four digits. We clear that detail from our copies after 90 days.

We send sign-in links, a list of your Big Ups workspaces when you ask for one, and, to admins only, billing notices and notices about the Slack connection.

The signed-in app sets a cookie that keeps you signed in for up to 30 days. We also set a cookie for your light or dark theme, and use your browser's storage to remember your theme and notices you have dismissed. We do not use advertising cookies. Our public pages, but not the signed-in app, use Cloudflare Web Analytics to count visits. Profile pictures are loaded from Slack's servers.

Our servers keep request logs, which include IP addresses and the address requested. We filter email addresses, sign-in tokens and message text out of what we log. To limit abuse, we briefly count requests in memory: sign-in attempts by email address and IP address, other requests by IP address alone. Error reports from our API are sent to Sentry, set up to exclude personal information by default and to remove email addresses, tokens and message text before anything is sent. We also keep operational metrics: counts and timings, never labeled with an organization or a person, and deleted from our own database automatically after 90 days.

• To run Big Ups: posting big ups to Slack, messaging the recipient, showing the feed, and giving admins analytics.
• To decide who is on the roster, and so how many seats your organization is billed for.
• To bill paid plans and tell admins about billing problems.
• To send sign-in links and service notices.
• To keep the service secure, and to find and fix problems.

We do not use advertising trackers, we do not build advertising profiles, and we do not sell personal information.

• Everyone in the workspace can see big ups posted to the announcement channel. The recipient also gets a direct message, unless they have turned it off.
• People on the roster can see the feed. A reported or hidden big up is not shown there, and a withdrawn one is shown only to the person who received it.
• Admins can also see analytics, roster records, and hidden and reported big ups. On a paid plan, admins can export big ups, including each message and the sender's and recipient's names and email addresses.

• Slack - the source of your workspace's members, profile fields and channel membership; where big ups are posted; and Sign in with Slack.
• Stripe - payments, subscriptions and sales tax. Stripe stores the payment card.
• Resend - sends our email.
• DigitalOcean - runs our API server and hosts our database.
• Cloudflare - hosts our web app, carries traffic to our website and API, and provides Web Analytics on our public pages.
• Sentry - error reports from our API.
• Grafana Cloud - operational metrics.

While your organization has an account, we keep its records.

When somebody leaves your Slack workspace, they are marked inactive and lose access. Their big ups stay part of your organization's history, still attributed to them.

When an admin deletes your organization, it goes offline immediately: nobody can sign in, and Big Ups stops posting to Slack. Until 30 days have passed, it can be restored by replying to the deletion receipt sent to every admin. After that, we permanently delete its big ups, values, roster, members, settings and Slack connection, and people who belong to no other Big Ups organization are deleted too. Messages already posted in your Slack workspace stay there, under your own Slack retention settings, and Stripe keeps its own record of your organization as a customer.

Copies of Stripe's billing notifications are cleared after 90 days, whether or not your organization has been deleted.

Backups. Our database provider keeps backups, so deleted information, including a deleted organization's records, may remain in a backup until that backup expires.

Logs, error reports and provider metrics are kept for a limited time to operate and support the service. The metrics we store ourselves are deleted automatically after 90 days.

Recognition is written by one person about another, so the two of you do not have the same rights over it.

If you received a big up, you can delete it. It is deleted for everyone, including the person who sent it. We ask Slack to delete the channel post and the direct message, and keep no copy for our own purposes, though it may remain in a database backup until that backup expires.

If you sent one, you can withdraw it. It is removed from the channel and from everyone else's feed. The person who received it keeps it, in their feed and in the Slack direct message they were sent. We keep the record, marked as withdrawn, because you can take back what you said but not what somebody else received.

When you delete a big up you received, you can also report it. Reporting keeps a copy for your organization's admins and removes it from everywhere else, including Slack. The person who sent it is not told that you reported it. You never have to report something in order to delete it.

Admins can also delete or hide a big up, and can delete the whole organization from the admin area.

You can ask for a copy of the information we hold about you, ask us to correct it, or ask us to delete it. Email support@bigups.work and we will respond. Because your organization's Slack workspace decides who is a member, some requests, such as leaving the organization, are handled by your organization's admins or in Slack.

When we change this notice, we will update the date at the top.

Questions about this notice can be sent to support@bigups.work.