Privacy Policy

This Privacy Policy explains how MSW Digital LLC(“we,” “us,” or “our”) collects, uses, shares, and safeguards information in connection with Cake Day, a Slack app that posts birthday and work anniversary shout-outs in Slack workspaces (the “Service”). It applies to our website at cakeday.io, the Cake Day Slack application, and any related services that link to this policy.

By installing Cake Day into your Slack workspace, creating an account, or using the Service, you acknowledge that you have read and understood this policy.

1. Who we are

Cake Day is operated by MSW Digital LLC, a Delaware limited liability company. For privacy questions or to exercise your rights, contact us at info@mswdigital.com.

If you are an individual user whose workspace administrator has installed Cake Day, your employer or the organization operating the Slack workspace is the “data controller” for your personal information under laws like GDPR. We process that information on their behalf as a “data processor.”

2. Information we collect

2.1 Information you or your workspace provide

• Slack account information. When an administrator installs Cake Day, we receive your Slack workspace ID, workspace name, channel IDs, and a bot token that lets Cake Day post and read information necessary to run the Service.
• Member information.To figure out who to celebrate, we store each roster member's Slack user ID, display name, and (if the member opts in) their birth month and day and/or their work start date (year, month, day).
• Administrator preferences. Channel choices, post time, timezone, pause state, and other configuration you enter through our setup modal or slash commands.
• Billing information. If your workspace subscribes to a paid plan, you provide payment details directly to our payment processor, Stripe, Inc. We do not see or store full card numbers. We store billing identifiers (Stripe customer ID, subscription status, plan tier, invoice history) and your billing email address.
• Support communications. If you email us, we retain the content of that email and your contact details so we can respond and improve the Service.

2.2 Information we collect automatically

• Log data. IP address, user agent, request timestamps, and minimal error information from our servers and the Slack events our app receives.
• Cookies and similar technologies. Our marketing website uses a minimal set of essential cookies needed to keep the site working. If we introduce analytics or non-essential cookies, we will ask for consent where required.

2.3 Information we do NOT collect

• We do not ask for or store birth years for birthday celebrations.
• We do not track your activity across third-party websites.
• We do not sell personal information.
• We do not use your Slack workspace content to train AI models.

3. How we use information

We use the information described above to:

• Provide the Service — generate and post birthday and work anniversary shout-outs.
• Administer your account, subscription, and billing.
• Respond to your support requests.
• Monitor, debug, and secure the Service.
• Send you operational communications (e.g., billing receipts, incident notices).
• Comply with legal obligations and enforce our agreements.

4. How shout-out text is generated

When Cake Day generates a shout-out, we send a minimal context (typically the recipient's Slack display name or handle, and whether the occasion is a birthday or work anniversary) to an AI text-generation service, Google's Gemini API. No roster, no historical posts, no organization-identifying information beyond what is strictly needed to write the message is transmitted.

Google processes this request as our subprocessor under their applicable terms and does not use the content of API requests to train their models. We retain the generated shout-out text so it can be posted and audited.

5. Service providers and sharing

We share information only with service providers who help us operate Cake Day and only to the extent needed for them to perform their services. Current subprocessors:

We may also disclose information (a) to comply with a lawful subpoena, court order, or legal obligation, (b) to protect our rights, property, or the safety of users or the public, (c) in connection with a merger, acquisition, or sale of all or part of our business (you will be notified of any change of data custodian), and (d) with your consent.

6. Legal bases (for users in the EEA and UK)

• Performance of a contract. Processing necessary to provide the Service to your workspace.
• Consent. Where you have opted in — for example, adding your birthday or work anniversary to the roster.
• Legitimate interests. Securing the Service, preventing fraud, maintaining quality, and basic analytics. We balance these against your privacy rights.
• Legal obligation. Tax, accounting, and regulatory compliance.

7. International transfers

We are based in the United States, and our primary service providers operate in the United States. If you access the Service from outside the United States, your information may be transferred to, stored, and processed in the United States or other countries where our providers maintain facilities. Where required, we rely on mechanisms such as the EU Standard Contractual Clauses or the EU–US and UK–US Data Privacy Framework for lawful cross-border transfers.

8. Data retention

• Active workspace data. Retained for as long as your workspace has Cake Day installed.
• After uninstall. We delete workspace roster and configuration data within 30 days of uninstall, except where we need to retain records to resolve disputes, comply with legal obligations, or enforce our agreements.
• Billing records. Retained for up to 7 years to comply with U.S. tax and accounting requirements.
• Server logs. Retained for up to 30 days.
• Broadcast audit logs. Retained for up to 12 months to audit opt-in campaigns.

9. Your rights

Depending on where you live, you may have the following rights with respect to your personal information:

• Access. Request a copy of the personal information we hold about you.
• Correction. Ask us to fix information that is inaccurate.
• Deletion. Ask us to delete your personal information. You can also self-serve by running /cakeday me→ “Remove me entirely” in Slack.
• Portability. Receive a copy of your data in a structured, machine- readable format.
• Objection and restriction. Object to or request restriction of certain processing activities.
• Withdraw consent. Withdraw any consent you gave us at any time, without affecting prior processing.
• Complain. Lodge a complaint with your local data protection authority.

To exercise these rights, email info@mswdigital.com. If you are a workspace member, we may direct your request to your workspace administrator where they act as the data controller.

10. Your California privacy rights

If you are a California resident, you have the rights described in Section 9, plus rights under the California Consumer Privacy Act (“CCPA”) including the right to know the categories and specific pieces of personal information collected, the right to request deletion, the right to opt out of the “sale” or “sharing” of personal information, and the right not to be discriminated against for exercising these rights.

We do not sell personal information, and we do not share personal information for cross-context behavioral advertising.

11. Security

We use commercially reasonable technical and organizational measures to protect information from unauthorized access, disclosure, alteration, or destruction. These include encryption in transit (TLS) and at rest, access controls, logging, regular backups, and regular software updates. No method of transmission over the Internet is 100% secure, so we cannot guarantee absolute security.

12. Children

The Service is not directed to children under 16, and we do not knowingly collect personal information from children under 16. If you believe we have collected information from a child, please contact us and we will delete it.

13. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify workspace administrators by email or by posting a notice in the Service. The “Last updated” date at the top of this policy indicates when it was last revised. Continued use of the Service after a change means you accept the updated policy.

14. Contact

MSW Digital LLC
info@mswdigital.com