Privacy Policy

Hear ("we," "us," or "our") provides an AI-powered team health platform that connects to Slack workspaces. This Privacy Policy explains what data we collect, how we use it, and your rights regarding that data.

By using Hear, you agree to the practices described in this policy. If you are an administrator connecting your organization's Slack workspace, you represent that you have the authority to do so.

1. What Data We Collect

Slack Workspace Data

When you connect a Slack workspace, Hear accesses the following through the Slack API:

• Messages — messages in the public channels you choose to track. Message text is stored in Hear’s database (see Data Retention) and scored for sentiment, energy and collaboration. Hear does not show message logs in the product.
• Reactions — emoji reactions on messages, used for recognition mapping and engagement signals.
• User profiles — display names, roles, and team membership, used to organize health metrics by team.
• Channel metadata — channel names and membership lists, used to scope analysis.

Account Data

• Email address and name (from Slack OAuth or manual registration)
• Organization name
• Billing information (processed by our payment provider; we do not store card numbers)

Usage Data

• Pages visited, features used, and session duration
• Browser type, device type, and IP address

2. How We Use Your Data

We process Slack data to provide the core Hear product:

• Sentiment analysis — detecting team mood trends over time
• Team health scoring — aggregated metrics on collaboration, energy, and engagement
• Burnout detection — identifying patterns that indicate risk (after-hours messaging, declining engagement, tone shifts)
• Recognition mapping — surfacing who is giving and receiving positive signals across the team

Hear scores messages and aggregates results per person and per channel. The administrator who installed Hear and people they invite by email through Settings can see team-level and per-person scores (for example Impact, burnout risk and recognition). Slack membership alone does not grant dashboard access. Dashboard pages do not show individual message text.

3. Sub-Processors & Third-Party Services

Hear uses the following sub-processors to operate the service. Each is bound by a data processing agreement and handles customer data only for the purpose listed.

Sub-processor	Purpose	Data
Cloudflare, Inc. (US)	Application hosting, database (D1, primary in EU), CDN, DDoS/WAF, captcha (Turnstile)	All customer data (encrypted)
OpenRouter Inc. and the model providers it routes to	LLM inference: message scoring, workplace signal discovery and the Ask Hear Q&A feature	Pseudonymized message excerpts and reactions; per-person and per-channel metrics; your questions and recent conversation
OpenAI, L.L.C.	Background images for shared insight cards	A short mood label only; no Slack or team data
Replicate, Inc.	Fallback for background images for shared insight cards	A short mood label only; no Slack or team data
Resend	Transactional email (magic links, weekly digests, contact form)	Recipient email, subject, body
Polar Software Inc.	Merchant of record, subscription billing, invoicing, tax handling	Billing contact and subscription metadata
Stripe, Inc.	Payment processing on behalf of Polar (nested sub-processor)	Payment method; we do not store card numbers

What we send to LLM providers

Hear sends data to large language models via OpenRouter for:

• Message scoring and workplace signals. Hear sends message evidence of up to 4,000 characters per message, reactions and scoring definitions to TypeSafe Jev through the Decisions API. The legacy scorer uses excerpts of up to 150 characters.
• Signal discovery. Hear sends a sample of pseudonymized excerpts of up to 240 characters each to Google Gemini 2.5 Flash to propose workplace event definitions. Separate validation determines whether a proposed signal qualifies for tracking.
• Ask Hear. Hear sends your question, recent conversation and workspace metrics, including per-person scores, recognition and burnout signals. Hear does not attach stored Slack message text to this request. Text you include in a question forms part of the request.

Before sending requests, Hear replaces known workspace member names, email addresses, Slack identifiers and mentions, credentials and URLs with local references or redaction markers. Hear keeps the reference mapping inside its Worker and restores permitted display names and links in Ask Hear answers. This is pseudonymization, not a guarantee that Hear can detect every identifying detail or unknown name in free-form text.

OpenRouter requests include provider.data_collection: deny and provider.zdr: true to select endpoints that comply with these routing policies. Hear does not retry requests with weaker privacy settings. These request controls do not establish the configuration of separate account-level prompt logging.

We do not train models on Slack data

Hear does not use Slack data to train, fine-tune, or otherwise improve large language models — our own or anyone else's. Requests are processed under the API terms of OpenRouter and the model provider that serves them.

Email contact — explicit opt-in

During Slack installation, Hear reads the installing user’s Slack email via users:read.email to match their Hear account. Hear also caches the workspace user directory, including email addresses when Slack supplies them, alongside Slack IDs, display names, avatars and bot or deactivated-account flags. On reinstallation, Hear identifies the organization by its Slack workspace ID and checks the Hear account’s workspace membership. Directory email addresses alone do not grant dashboard access.

Hear sends weekly digests to the email addresses of Hear accounts with dashboard access, only after those users opt in. New accounts start with digests off. Users can unsubscribe through each digest or change the setting from their dashboard. Hear does not send marketing or cold outreach to addresses from the cached Slack directory.

Slack API

Hear accesses Slack workspace data via the official Slack Web API under the permissions you grant during OAuth. Only the scopes you approve are used; you can revoke access at any time from your Slack workspace admin settings, which will immediately and irreversibly cut off Hear's ability to read any data from your workspace.

4. Data Retention

• Scores and analytics are based on the last 30 days of messages and are kept while your workspace is connected
• Hear retains Slack message text from tracked channels for 90 days from each message’s timestamp. A daily cleanup deletes older messages and their dependent scoring records in bounded batches. Active processing can defer deletion until its lease ends; subsequent cleanup runs continue any remaining backlog. Hear retains aggregate analytics under the separate policy above. To request deletion before the retention period ends, email support@hear.dev.
• Account and billing data is retained for the duration of your subscription and as required by law

Removing Hear from Slack stops new data collection but does not delete data already stored. To delete your account or your workspace’s data, email support@hear.dev from the account’s email address.

5. Cookies

We use minimal browser storage:

• Authentication — a login token (JWT) stored in your browser’s localStorage to keep you signed in

We do not use advertising cookies or sell data to advertisers.

6. Your Rights

You have the right to:

• Export your data — request a copy of all analytics data associated with your workspace
• Delete your data — request full deletion of your account and all associated data
• Disconnect Slack — revoke Hear's access at any time by removing the Hear app in your Slack workspace settings (Manage apps)
• Access and correction — view and correct your account information
• Object to processing — opt out of specific data processing activities

To exercise any of these rights, email support@hear.dev. We will respond within 30 days.

7. Security & Data Location

We take the security of your data seriously:

• All data is encrypted in transit using TLS 1.2+
• All data is encrypted at rest using AES-256
• Access to production systems is restricted and audit-logged
• We conduct regular security reviews of our infrastructure

Where your data is physically stored

Hear's primary database (Cloudflare D1) and application workers currently run from Cloudflare's European data centers, with the primary database replica located in Warsaw, Poland. Cached asset delivery may be served from any Cloudflare edge location globally to the nearest visitor.

Legal jurisdiction of our host

Our infrastructure provider, Cloudflare, Inc., is a United States corporation headquartered in San Francisco, California. Although your data is physically stored in the European Union, Cloudflare is subject to US law — including the CLOUD Act and FISA Section 702 — which means US authorities could, in principle, compel Cloudflare to produce customer data regardless of where it is physically located. We rely on Cloudflare's published transparency reports and legal process guidelines for any such requests.

For customers in the European Economic Area, we rely on the EU-U.S. Data Privacy Framework and Standard Contractual Clauses to provide a lawful basis for transfers of personal data to a US-headquartered processor. If you require data to be processed only by non-US-jurisdiction providers, Hear is not currently the right fit for your organization.

8. GDPR Compliance

For users in the European Economic Area (EEA), the following applies:

• Legal basis — we process data based on your organization's consent (when connecting Slack) and our legitimate interest in providing the service
• Data processor — Hear acts as a data processor on behalf of your organization (the data controller)
• Data transfers — see Section 7 ("Security & Data Location") for where your data is physically stored and the legal jurisdiction of our hosting provider. We rely on the EU-U.S. Data Privacy Framework and Standard Contractual Clauses as required
• DPA — we offer a Data Processing Agreement to enterprise customers upon request
• Right to lodge a complaint — you may contact your local data protection authority

9. Children's Privacy

Hear is a business product and is not directed at individuals under 16. We do not knowingly collect data from children.

10. Changes to This Policy

We may update this Privacy Policy from time to time. If we make significant changes, we will notify workspace administrators by email. Continued use of Hear after changes constitutes acceptance of the updated policy.

11. Contact Us

If you have questions about this Privacy Policy or how we handle your data:

• Email: support@hear.dev
• Web: hear.dev