Slack

"We may engage third-party companies or individuals as service providers or business partners to process Information and support our business. These third parties may, for example, provide virtual computing and storage services, assist Slack with verifying Owners and Customers, or we may share business information to develop strategic partnerships with Third-Party Service providers to support our common customers."

Slack shares user information with a broad and open-ended set of third-party service providers, business partners, and corporate affiliates, with no exhaustive list or meaningful user control over this sharing.

"We receive information from you, our Customers and other third parties that helps us to approximate your location. We may, for example, use a business address submitted by your employer (who is our Customer) or an IP address received from your browser or device to determine approximate location to assist with localisation or for security purposes."

Slack collects location information from multiple sources including IP addresses, employer-submitted addresses, and third parties, going beyond what users may expect for a messaging tool.

"Slack collects information about devices accessing the Services, including type of device, what operating system is used, device settings, application IDs, unique device identifiers and crash data. We may use a variety of tools such as device fingerprinting to prevent issues and abuse. We may process, including in an automated fashion, Other Information to better understand how Slack is used or to prevent spam or abuse."

Slack uses device fingerprinting, unique device identifiers, and application IDs, which can be used to track and link user activity across devices and services.

"Slack may retain Other Information pertaining to you for as long as necessary for the purposes described in this Privacy Policy (such as to provide the Services, including any optional features that you use, and to provide customer support). This may include keeping your Other Information after you have deactivated your account for the period of time needed for Slack to pursue legitimate business interests, conduct audits, comply with (and demonstrate compliance with) legal obligations, resolve disputes and enforce our agreements."

Slack retains user metadata and usage information indefinitely after account deactivation with no clear deletion timeline, citing broad justifications like 'legitimate business interests.'

"Slack may change this Privacy Policy from time to time. Laws, regulations and industry standards evolve, which may make those changes necessary, or we may make changes to our services or business. We will post the changes to this page and encourage you to review our Privacy Policy to stay informed. If you disagree with the changes to this Privacy Policy, you should deactivate your Services account."

Slack can change its privacy policy at any time with the only recourse being account deactivation, effectively treating continued use as acceptance of new terms.

"Slack collects information about devices accessing the Services, including type of device, what operating system is used, device settings, application IDs, unique device identifiers and crash data. In accordance with the consent process provided by your device or other third-party API, any contact information that an Authorised User chooses to import (such as importing an address book to find colleagues and Slack Connect contacts or calendar from a device or API) is collected when using the Services."

Slack collects device settings, application IDs, unique device identifiers, and allows importing of contact address books and calendars, accessing data beyond core messaging functionality.

"If you disagree with the changes to this Privacy Policy, you should deactivate your Services account. Contact the Customer if you wish to request the removal of Personal Data under their control. If you cannot use the settings and tools, contact the Customer who controls your workspace for additional access and assistance."

Individual users cannot independently delete their data — they must contact their employer (the Customer) to request removal, creating a dependency on a third party for exercising deletion rights.