01 What we collect
Workspace identity: the Slack team id and name, and the user who installed the app. This is what keeps one customer's data separate from another's.
People data you or your administrators provide or import: names, job titles, departments, reporting lines, work email addresses and Slack user ids.
Records created while using the product: reports, comments, time-off requests, approval forms and attached receipts.
Technical logs: timestamps, request paths and error details, kept to operate and secure the service.
Language preference: stored only in your own browser (localStorage), never uploaded, gone when you clear browser data.
02 What we do not collect
We do not read channel messages, direct messages or files outside the modules you use.
We do not sell personal data, and we do not use it to train models.
We do not store Slack passwords or Slack user tokens.
03 Website analytics
Traffic measurement on vktapp.com is a small program we wrote ourselves and run on our own server. It is not Google Analytics, Plausible or any other third-party analytics service, and the results are not handed to anyone.
It records four things: the page path, the referring page, the IP address and the time of the request. No cookies are set, your behaviour on other websites is not tracked, and no cross-device identification is attempted.
The purpose is narrow: seeing which pages are read and whether any link is broken. It is not used for advertising, not used to build profiles, and not shared with advertisers.
IP addresses and referrers are kept for 90 days and then deleted automatically; after that only a count without IP addresses remains.
04 Why we process it
To provide the features you installed: rendering the org chart, routing an approval to the right person, counting business days correctly.
To secure the service: detecting abuse, investigating errors, keeping tenant boundaries intact.
To meet legal obligations where they apply.
05 Legal basis and roles
For people data inside your workspace, your organisation is the controller and we are the processor, acting on your instructions. A data processing agreement is available on request.
For account and billing information belonging to the person who installed the app, we act as controller.
06 Where the data lives
Application databases and files are stored on servers in Osaka, Japan, operated by us.
This website is delivered through Cloudflare's global network, so static pages may be served from a node near you. That affects page load speed only, not where your workspace data is stored.
07 How long we keep it
People and organisation data is kept while the app is installed. Uninstalling stops processing immediately; the workspace token is destroyed at once.
Approval and leave records follow the retention window configured by your administrators, which defaults to 24 months. When it expires, claim contents and attachments are deleted and the remaining record is anonymised.
Technical logs are kept for a short rolling window and then discarded.
Analytics IP addresses and referrers are kept for 90 days; after that only counts without IP addresses remain.
08 Who we share it with
Cloudflare for content delivery and network protection, and a MySQL instance in Osaka, Japan that we operate ourselves. They process data only on our instructions.
The website analytics are first-party and self-hosted: no third-party analytics service receives the data, and we do not publish or resell it.
We disclose data if compelled by law, and we will tell you unless legally prohibited.
09 Who runs this service
VKT is run by an independent developer, ZHANG SHUXIA. It is not a company.
Postal address: Cainiao Station, Fuxingyuan, Shangzhuang, Luquan District, Shijiazhuang, Hebei 050227, China.
Data protection contact: [email protected] .
10 Your rights
People whose data is in the workspace can ask their administrator for access, correction or deletion; we support those requests.
Where the law provides rights of access, rectification, erasure, restriction, portability or objection, you can exercise them by contacting us. You may also complain to your local supervisory authority.
11 Contact
Questions about this policy, or a request about your data: email [email protected] and we will respond within one business day.