Privacy Policy

At Mellow Company Ltd. (VAT ID: BG208971118; "we", "us", "our", or "Mellowe"), registered at zh.k. Trakiya, bl. 7, vh. A, et. 8, ap. 45, 6450 Harmanli, Bulgaria, we take your privacy and data security seriously. This Privacy Policy describes how we collect, use, store, and process personal data when you install our Slack application, visit our website at withmellowe.com, or access any associated services (collectively, the "Service").

For the purposes of the General Data Protection Regulation (GDPR) and applicable European data protection legislation, Mellow Company Ltd. (represented by Milen Dimitrov) acts as Data Controller for customer account and administrative data, and as Data Processor for workspace employee recognition data processed on behalf of customer organizations.

1. Information We Collect

A. Information from Slack (OAuth Scopes)

When a workspace administrator installs Mellowe or when team members interact with the bot in Slack, we receive only the specific data necessary to deliver peer recognition, strictly scoped by the OAuth permissions granted during installation:

• Workspace Data (team:read): Slack Workspace ID, team name, and authorized domain.
• User Profile Data (users:read, openid,email,profile): Slack User ID, display name, full name, work email address, avatar image URL, timezone, and active status.
• Public Channel & Kudos Data (channels:history, channels:read, groups:read, app_mentions:read, commands): Public channel IDs where Mellowe is invited, mention messages (e.g. @Mellowe), slash commands (/mellowe), kudos text, and core value hashtags (e.g. #teamwork).
• Reactions & Emojis (emoji:read): Workspace custom emoji sets and reaction emojis used for peer appreciation (such as the 🥭 mango emoji).
• Notifications & Delivery (chat:write, im:write): Permission to post celebratory messages in public recognition channels and send direct kudos alerts to individuals.

Strict Data Boundaries: Mellowe only receives messages in which our application is explicitly mentioned or where recognition triggers occur in channels where Mellowe has been invited. We do NOT monitor, read, or store your private Direct Messages (DMs) between team members, nor conversations in channels where Mellowe is not a member. All workspace data originates strictly and solely from the authorized Slack workspace.

B. Account & Billing Information

If your organization subscribes to a paid plan, billing details (such as credit card numbers, billing addresses, and tax identifiers) are collected and processed directly by our payment processor (Paddle). We do not store full payment card numbers on our servers.

C. Usage & Technical Data

When accessing our web dashboard, we automatically collect standard log information such as browser type, operating system, IP address, and interaction timestamps for system security, performance monitoring, and debugging.

2. How We Use Your Information

We use the collected information exclusively to provide, maintain, and enhance Mellowe's features, including:

• Facilitating peer-to-peer appreciation, tracking point allowances, and calculating daily/monthly limits.
• Awarding custom digital badges and managing company core value hashtags (e.g. #teamwork, #innovation).
• Delivering automated birthday and work anniversary milestone announcements.
• Powering cultural engagement analytics, team insights, and rewards market redemptions.
• Authenticating administrators and employees via single sign-on (SSO / OIDC).
• Responding to customer support inquiries and preventing security abuse.

We will NEVER sell your data, rent it to third parties, or use your employee recognition messages to train public AI models.

3. Legal Bases for Processing (GDPR Article 6)

If you reside within the European Economic Area (EEA) or United Kingdom, our legal bases for collecting and processing your personal data under Article 6 of the GDPR are as follows:

• Performance of a Contract (GDPR Art. 6(1)(b)): Processing is necessary to provide, administer, and fulfill our contractual obligations to deliver the Mellowe recognition and engagement platform to your workspace.
• Legitimate Interests (GDPR Art. 6(1)(f)): Processing is necessary for our legitimate business interests, including maintaining robust multi-tenant system security, detecting errors, preventing fraudulent misuse, and optimizing application performance, provided such interests are not overridden by your fundamental privacy rights.
• Compliance with Legal Obligations (GDPR Art. 6(1)(c)): To maintain accurate corporate financial, taxation, and billing records in conjunction with our Merchant of Record, Paddle.com.
• Consent (GDPR Art. 6(1)(a)): Where applicable, for voluntary participation in optional celebratory features (such as sharing birthday announcements).

3. Data Storage, Isolation & Security

We treat your organization's data with enterprise-grade security standards:

• Isolated Database Per Workspace: Every customer workspace operates in a separate, isolated database.
• Encryption in Transit & Rest: All data transmitted between your Slack workspace, browser, and our servers is encrypted using industry-standard TLS 1.3. Stored database backups and persistent volumes are encrypted at rest.
• Secrets Management: API keys, OAuth tokens, and Slack signing secrets are dynamically stored and rotated through HashiCorp Vault.
• Access Controls: Internal access to production systems is restricted strictly on a need-to-know basis and protected by multi-factor authentication.

4. Third-Party Sub-processors & Service Providers

We partner with trusted third-party service providers and sub-processors who adhere to strict data security standards and contractual Data Processing Addendums (DPAs):

• Amazon Web Services EMEA SARL (AWS EU - Stockholm, Sweden): Primary cloud infrastructure, isolated databases, Redis caching, and key management services hosted in ISO 27001, SOC 1/2/3, and GDPR-compliant Stockholm data centers.
• Paddle.com Market Ltd (United Kingdom & Ireland): Merchant of Record, checkout handling, payment processing, sales tax / VAT compliance, and buyer customer support.
• Slack Technologies LLC (Salesforce, Inc.): Communication platform provider and Slack API integration.
• Sentry (Functional Software, Inc.): Real-time application error tracking, crash diagnostics, and operational performance telemetry.
• Axiom, Inc.: Centralized structured server logging, security monitoring, and operational telemetry.
• Cloudflare, Inc.: Global DNS routing, Content Delivery Network (CDN), DDoS mitigation, and frontend edge hosting.

5. Data Retention & Deletion

We retain your workspace data for as long as your account is active or as necessary to provide you with the Service.

Workspace Uninstallation & Data Removal: If you uninstall Mellowe from your Slack workspace or wish to permanently delete all workspace data, an authorized administrator can initiate this directly in the Mellowe web app under Settings → Danger Zone, or submit a deletion request via email at privacy@withmellowe.com. Upon receipt or confirmation, all associated user records, recognitions, points ledgers, and tokens will be permanently purged from our active databases within 30 days.

6. Your Rights (GDPR & CCPA Compliance)

Depending on your location (including the European Economic Area, United Kingdom, and California), you may have specific rights regarding your personal information:

• Right to Access: Request a copy of the personal data we hold about you.
• Right to Rectification: Request correction of inaccurate or incomplete data.
• Right to Erasure: Request the deletion of your personal data ("Right to be Forgotten").
• Right to Data Portability: Request an export of your workspace's recognition and analytics data.

To exercise any of these rights, please reach out to us at privacy@withmellowe.com.

7. Children's Privacy

Mellowe is a B2B productivity and employee engagement tool intended strictly for workplace teams and individuals aged 16 and older. We do not knowingly collect personal information from children under 16.

8. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or relevant legal obligations. If we make material changes, we will notify you by updating the "Last Updated" date at the top of this page or by sending an announcement in your Slack admin channel.

9. Contact & Data Protection Officer

If you have questions, feedback, or wish to exercise your GDPR rights (such as data access, rectification, or the Right to be Forgotten), please reach out to our legal and data protection representative: