Privacy Policy

BuyerBot ("we," "us," or "our") operates a Slack application that helps teams request, approve, and purchase products. This policy explains what data we collect, why we collect it, and what control you have over it.

We built BuyerBot with a simple philosophy: collect only what's needed to make the product work, and nothing more.

1. Data we collect

Workspace information

When you install BuyerBot, we receive and store:

• Your Slack workspace ID and name
• A bot access token issued by Slack (used to send messages on BuyerBot's behalf)
• The Slack user ID of the person who installed the app (set as the default approver)

User information

When a team member interacts with BuyerBot, we store:

• Their Slack user ID and display name
• Whether they are designated as an approver

We do not collect email addresses, phone numbers, profile photos, or any personal information beyond what Slack provides through normal bot interactions.

Purchase request data

When someone submits a purchase request, we store:

• The search query they typed
• Product details for selected items (title, price, ASIN, product image URL)
• The approval status and which user approved or rejected the request
• The Slack channel and thread where the request was made
• A generated Amazon cart URL for approved requests

What we do NOT collect

• Payment information (credit cards, bank accounts, etc.)
• Amazon account credentials or login information
• Browsing history or purchase history on Amazon
• Messages in your Slack workspace outside of direct BuyerBot interactions
• Files, documents, or other media shared in Slack

2. How we use your data

We use the data we collect to:

• Operate the service — process search queries, manage approval workflows, and generate cart links
• Send messages in Slack — deliver search results, approval notifications, and cart links to the appropriate users and channels
• Maintain request history — let workspace admins and approvers see past purchase requests and their outcomes
• Improve the product — understand usage patterns in aggregate (e.g., how many requests are made per workspace) to improve BuyerBot

3. Affiliate disclosure

BuyerBot is a participant in the Amazon Associates Program. When your team checks out using a BuyerBot-generated cart link, that link contains our Amazon affiliate tag. We earn a small commission from qualifying purchases at no additional cost to the buyer.

This is how BuyerBot generates revenue. We do not charge users for product searches or cart generation on the Free plan, and the affiliate tag is the same for all workspaces — it is not user-configurable.

4. Data storage and security

• Infrastructure: All data is stored on Cloudflare's global network using Cloudflare D1 (database), KV (caching), and R2 (image caching). Data is encrypted at rest and in transit.
• Access control: Only BuyerBot's application code accesses your data. We do not share your data with third parties, sell it, or use it for advertising.
• Slack tokens: Bot tokens issued by Slack are stored securely and are only used to communicate with your workspace through Slack's API.
• Request verification: All incoming requests from Slack are verified using Slack's request signing mechanism to prevent tampering.

5. Data sharing

We do not sell, rent, or share your personal data with third parties. Data is transmitted to the following services only as required to operate BuyerBot:

• Slack — to send and receive messages via the Slack API
• Amazon — to search for products and generate cart links (no personal data is sent to Amazon; only search queries)
• Cloudflare — our hosting and infrastructure provider

6. Data retention

• Active workspaces: We retain your data for as long as BuyerBot is installed in your Slack workspace.
• After uninstall: When you uninstall BuyerBot from your workspace, we will delete your workspace data, including all purchase requests, user records, and configuration, within 30 days.
• Cached data: Search result caches and product image caches are automatically purged after a short retention period (typically 24-48 hours).

7. Your rights

You can exercise any of the following at any time by contacting us at [email protected]:

• Access — request a copy of the data we hold about your workspace
• Correction — ask us to correct inaccurate data
• Deletion — ask us to delete your workspace data (or simply uninstall BuyerBot from Slack)
• Export — request a machine-readable export of your purchase request history

8. Slack permissions explained

BuyerBot requests the following Slack permissions (scopes), and nothing more:

Permission	Why we need it
commands	Register and respond to the /buy slash command
chat:write	Post search results, approval prompts, and cart links in channels
im:write	Send direct messages (e.g., approval notifications to approvers)
im:history	Read conversation history in direct messages with BuyerBot to provide context
users:read	Look up display names so request messages show who is asking

9. Children's privacy

BuyerBot is a workplace tool. It is not intended for use by anyone under the age of 18. We do not knowingly collect data from minors.

10. Changes to this policy

We may update this policy from time to time. If we make material changes, we will notify affected workspaces via a Slack message from BuyerBot. The "last updated" date at the top of this page reflects the most recent revision.

11. Contact

Questions or concerns about this policy? Reach us at [email protected].