Slack, a workplace messaging platform owned by Salesforce since its $27.7 billion acquisition closed in July 2021, discloses in its privacy policy that it collects workspace/account, usage, cookie, and audio/video metadata, and that it may share identifiers and internet-activity information with third-party advertisers for ad targeting on non-Slack sites. Slack's public record includes a 2015 central-database breach, a 2022 password-hash exposure, a 2022 GitHub token compromise, and a 2024 controversy over default opt-in use of customer data to train internal machine-learning models, each of which the company has publicly addressed. Corporate ownership is clearly disclosed through SEC filings and Salesforce's own press materials naming Slack Technologies, LLC as a Salesforce subsidiary.
TIMELINE
NO ENTRIES ON FILE YET.
ULTIMATE PARENT
TOOLS WE RECOMMEND
PLUS
RECEIPTS
17 ON FILE
COLLECTION
Slack's privacy policy states it collects Workspace and account information, usage information, cookie information, contact information, third-party data, and audio and video metadata.
As assessed by PrivacySpy on 2020-06-24 (see PrivacySpy's rubric entry for this product for the per-claim citation): Does the service collect personal data from third parties? — Yes.
Slack's careers privacy notice discloses that Slack collects personal data from job candidates including personal details submitted through job applications and recruiting events.
Reporting on Slack's AI privacy principles found that as of 2023-2024 Slack used customer data, including messages, content and files, to train machine-learning models powering channel and emoji recommendations and search, with users opted in by default.
Salesforce's FY2021 Form 10-K filed with the SEC discloses that Salesforce entered into a definitive agreement in December 2020 to acquire Slack Technologies, Inc., describing it as a channel-based messaging platform.
As assessed by PrivacySpy on 2020-06-24 (see PrivacySpy's rubric entry for this product for the per-claim citation): Does the policy outline the service's general security practices? — Yes, including independent audits.
Slack's current privacy policy states that Slack may share personal information, in the form of identifiers and internet activity information, with third-party advertisers for targeting advertisements on non-Slack websites, applications, and services.
As assessed by PrivacySpy on 2020-06-24 (see PrivacySpy's rubric entry for this product for the per-claim citation): Does the policy allow personally-targeted or behavioral marketing? — Yes, but you may opt-out.
An archived version of Slack's privacy policy states that Slack does not sell personal information as defined under the CCPA and will not do so without providing a right to opt out.
Slack disclosed in a blog post that in 2015 unauthorized individuals gained access to Slack infrastructure, including a database storing user profile information such as usernames and hashed passwords, and that Slack reset passwords for confirmed affected users.
Slack publicly disclosed on December 31, 2022 that a limited number of employee tokens were stolen and misused to access Slack's externally hosted GitHub repositories, downloading private code repositories, while stating no customer data or Slack's primary codebase was included.
Slack's Cookie Policy states that Slack uses cookies and similar technologies including single-pixel gifs and web beacons, both session-based and persistent, and that it uses third-party cookies such as Google Analytics.
An archived version of Slack's privacy policy states that Slack uses third-party cookies for its own advertising purposes, as further described in its Cookie Policy.