Vansa Bot privacy.

01 Who operates the service

Vansa Bot is operated by Vansa.org under the VANSA Labs brand. Bot support and data requests: [email protected].

This page explains the website demo and summarises the installed app. The app's Privacy and data flow notice provides its full operational retention and deletion details. Read it and the bot terms before installation.

02 The website demo

The channel selectors, policy controls and review cards on the bot page use illustrative data in your browser. They do not read Slack channels, invite the app or send Slack notifications.

When you choose Analyze, the message checker sends your text and its moderation questions to the Vansa API using shared demo access. Choosing an example or moving the cursor does not send text for analysis. Use synthetic examples and avoid confidential messages, personal details and credentials.

The demo does not save its draft, results or cursor coordinates in browser storage, and the bot pages do not load website analytics. Reset clears the displayed draft and result; reloading discards the page's in-memory state. These actions do not erase API usage, security or infrastructure records. Your browser and extensions may keep their own records.

03 The installed Slack app

A workspace administrator connects the workspace's own Vansa API key, chooses checks and a private review destination, and activates eligible public source channels. Monitoring starts after setup and channel approval, with a notice in each activated channel. New human messages are checked; edited messages can be checked again. The app does not import earlier message history or replay messages posted while monitoring was paused.

Direct messages, private source channels, Slack Connect channels, bot messages and file contents are outside monitoring. The private review channel receives alerts; its messages are not checked. A message accompanying a file can be checked, but the file itself is not downloaded.

The installation requests permissions to receive public-channel messages and channel information, inspect user roles and private-channel information for access checks, post notices and review cards, and provide the /vansa command. The requested bot scopes are channels:history, channels:read, users:read, groups:read, chat:write and commands. Review Slack's permission screen before authorising an installation; an existing installation's grant can differ until reauthorised.

For evaluation, the bot sends message text and the configured criteria with the workspace's API key. It replaces Slack user mentions with placeholders, channel mentions with a generic label, and email addresses with a placeholder; links become their visible label or host. It does not add profile details, workspace or channel names, or Slack message links to the API request. Names and other information written directly in the message may remain, so this is not a guarantee of anonymity.

04 Storage & deletion

The installed app stores workspace, channel and user identifiers, the names of channels it is added to, installation records, encrypted credentials, policies, roles, access checks, evaluation scores and review decisions. Pending message text, optional review excerpts and review notes are encrypted. This is separate from the website demo and the API's routine usage database. The installed app is self-hosted on servers Vansa.org owns and operates in Lithuania; its database and encrypted backups are stored there, not with a cloud provider.

The active app's configured schedules, verified on 4 October 2026, are:

• Pending message text is cleared after evaluation and scheduled to expire within 24 hours.
• Check results and review cases, including optional excerpts and notes, are retained for up to 30 days; excerpts, notes and message links are then removed, and the remaining case record is deleted within 2 more days plus the hourly cleanup interval.
• Event identifiers and deletion markers are retained for 7 days; daily usage counts for 400 days; security and configuration audit records for 90 days; operational logs for 14 days.
• Encrypted database backups expire 7 days after their snapshot starts, with hourly cleanup. Cleanup or storage failures can delay removal.

On uninstall, the bot stops monitoring, deletes its Slack tokens and pending message text, and schedules the workspace's remaining app records for deletion 7 days later. Reinstalling before deletion keeps the existing settings. Deletion depends on the deletion ledger and cleanup jobs; failures require operator attention. After an on-time deletion, an older backup can retain records for up to 7 more days plus the cleanup interval. The current installation uses local backup and deletion-ledger storage; it does not establish recovery after loss of that server.

Original messages and review cards remain in Slack under the workspace's retention rules. The bot removes excerpts from its own review cards after source deletion or case expiry where it still has access. Pausing, uninstalling or removing an API key does not erase Slack's copies or the API's separate records. The full installed-app notice explains these limits.

05 The Vansa API

Website analysis and the installed bot both call the Vansa API. Requests pass through Cloudflare to Vansa-owned inference infrastructure. Slack's deliveries to the installed app, including message text and button actions, and the app's API-key connection form also pass through Cloudflare in transit; the app does not use Cloudflare to store its records. The routine API usage database does not store full request bodies or answers; it does retain operational metadata. Exceptional diagnostics can contain submitted fragments. Vansa currently has no fixed automatic deletion schedule for application usage records, and infrastructure logs and backups have separate handling.

The bot's retention schedule does not prove deletion of API or infrastructure copies. A request runs inference; it does not itself train or update the model. Read the Vansa privacy policy and contact us before submitting data that needs particular processing terms, deletion commitments or location restrictions. These notices do not replace a required data-processing agreement.

06 Human review & requests

Anyone in the selected private review channel can read its alerts. Only authorised reviewers and administrators can claim, dismiss or resolve cases. Installation alone does not grant review authority. Alerts link to the source message and may include an excerpt when the administrator enables that option.

Model estimates can be wrong, miss concerns or lack context. A flag is a request for human review, not a finding of misconduct. The bot does not block or delete members' messages or make disciplinary decisions. The workspace organisation is responsible for lawful use, member notices, proportionality, reviewer access and any required workplace assessment or consultation.

Anyone whose information is processed by the bot can request access, correction or deletion, or raise a privacy concern at [email protected]. Include a workspace identifier if known and the request type, without sending API keys, Slack tokens or confidential message text. We verify identity and, for workspace-wide requests, authority. For original Slack messages and workspace-controlled review posts, contact the workspace organisation as well.

For the website demo or API records, contact [email protected]. You do not need an account to ask. Section 07 explains these rights and the right to complain to a data-protection authority. Installation help is available at bot support.

07 GDPR & your rights

Vansa Bot is operated from Lithuania by Vansa.org, and the EU General Data Protection Regulation (GDPR) applies to the personal data it processes. Sections 03, 04 and 06 describe what the app processes, how long it keeps records and who can see alerts; section 05 and the Vansa privacy policy cover records kept by the Vansa API.

Monitoring in a workspace. The workspace organisation that installs Vansa Bot decides which public channels are checked, which criteria apply and who reviews alerts. It is the controller for this monitoring: it is responsible for having a lawful basis and for informing its members. Vansa.org processes the message text, review records and identifiers on the organisation's behalf to provide the app. Organisations can contact [email protected] to arrange any required data-processing terms before activating monitoring.

Records we keep to run the app. For installation details, roles and permissions, security and configuration audit records, usage counts and support requests sent to us by email, Vansa.org is the controller. It relies on its legitimate interests in providing the app the workspace organisation installed and in operating a reliable and secure service, balanced against your rights.

Your rights. Depending on the applicable law and circumstances, you can request access to your personal data, correction, deletion, restriction or a portable copy, and object to processing based on legitimate interests. For the installed app, email [email protected]; for the website demo or API records, email [email protected]. Requests about a workspace's monitoring may also need to go to that organisation, and we may handle them on its instructions. You can complain to Lithuania's State Data Protection Inspectorate or the competent authority where you live or work.