Privacy policy

Who is responsible

ZINTORA is responsible for the information described in this policy. For privacy questions or requests, email [email protected].

Information we handle

When a company submits a Quote Request, we store its contact details, selected Products and Packs, quantities, preferences, notes and any uploaded logo so our team can prepare a proposal.

When a Slack workspace installs Zintora Gifts, we store its Slack workspace ID and name, the installing Slack user ID, and an encrypted bot access token. When a campaign is created, we store its name and message, selected gift products, recipient Slack IDs and display names, and delivery status.

We do not request permission to read members’ email addresses from Slack. When a recipient opens a private gift link, the claim page handles the gift choice, recipient-provided name, optional email address, and delivery address. We store a hash of the claim token, not the token itself.

The Slack installation flow also uses a short-lived, HTTP-only cookie to protect OAuth state. Slack sends signed command, interaction, and uninstall event requests to our service; these requests include workspace and user identifiers needed to process the action. When someone uses the /zintora command, we ask Slack whether they are a workspace owner or admin, or the user who installed the app, to decide whether they may send gifts; we do not store this role information.

When a company creates a Zintora company dashboard account, we store the company name and the billing details it adds (legal name, VAT ID, billing address), and the name, work email address, role and last sign-in time of each person given access. Sign-in uses one-time links sent by email; we store hashes of those links and of the HTTP-only session cookie that keeps you signed in, not the links or cookie values themselves. When a company requests a gift budget top-up, we store the amount, purchase order reference and any purchase order file it uploads, which only that company and ZINTORA administrators can download. A company can also keep a people directory to send gifts: each person’s name, and optionally their work email, department, Slack user ID, birthday (day and month only, never the year) and start date, added by the company directly, by spreadsheet import or by syncing names from Slack.

How we use it

We use Quote Request information to prepare and respond to the requested proposal. We send a notification containing the request details to our sales inbox through our email delivery provider. Uploaded logo files are available to authorized Admins and are not attached to that notification.

We use workspace and recipient information to create gift campaigns, send the requested Slack direct messages, provide delivery and claim status, and arrange fulfilment. We use claim addresses to arrange delivery and resolve related support requests. If provided, we use a recipient email address only for gift-related follow-up, such as the gift invitation and shipping updates. Birthdays and start dates are used only to show and send occasion gifts the company sets up. If a company runs a gift shop, we keep each person’s reward history and balance, and the item, delivery address and optional email they give when they choose something; their private shop link is stored only as a hash. We do not use Slack information for advertising or to train AI models.

Sharing and security

Resend processes the Quote Request notification email for delivery to our sales inbox. The Quote Request itself remains in our application database for authorized Admins to review.

Slack processes the installation, commands, and direct messages in Slack. ZINTORA stores campaign and claim records in its application database. Bot tokens are encrypted at rest, claim tokens are stored as hashes, and claim pages and the company dashboard are excluded from analytics tracking. We do not publish a recipient’s address in Slack. Sign-in and gift emails are sent through our email delivery provider, Resend.

How long information is kept

On app uninstall, we clear the workspace token and cached member records. Within 14 business days after the app is uninstalled, we also delete the Slack data we hold for that workspace, such as Slack user IDs and the names that came from Slack. Campaign history, recipient identifiers, claim status, and delivery details are currently retained until a ZINTORA administrator deletes them. Company dashboard account details are kept while the account is in use; removing someone’s access deactivates their sign-in immediately. Contact us to request deletion; we are working toward a defined automatic retention period.

Your requests

You may ask us to access, correct, export, or delete personal information associated with a gift campaign or claim. Email [email protected] and describe the request and the workspace or gift involved. We may ask for enough information to locate the record and protect it from unauthorized disclosure.

Contact

For support, use our contact page or email [email protected].