Your Privacy Matters

Account Information

• Email address
• Password (encrypted and hashed)
• Account creation date
• Subscription plan and billing status

Feedback Data

• User feedback submissions (ratings, comments, sentiment)
• Page URLs where feedback was submitted
• Environment labels (e.g., production, staging)
• Timestamps and metadata
• Anonymous client identifiers

Session Replay Data (Optional)

When customers enable session replay, our widget records a short snapshot of the end-user's browser session (typically the last ~30 seconds before feedback is submitted) using the open-source rrweb library. This may include:

• DOM structure and visual state of the page
• Mouse movements, clicks, scrolls, and keyboard events on non-input elements
• Console errors and network request metadata (URLs and status codes, not bodies)

Input fields, passwords, and elements marked sensitive by the customer are masked before transmission. Customers using session replay are responsible for disclosing it to their end-users and obtaining any required consent.

To group multiple recordings from the same browser, the widget stores a random anonymous device identifier in your browser's localStorage (not a cookie). This identifier is scoped to the customer's site, is not shared across customers, and is not used for advertising. Clearing your browser storage removes it.

We derive approximate location (country and city) from your IP address at the moment a recording starts. We do not store the IP ourselves.

Identified End-Users (Optional)

If the customer using Usero calls our identify API from their application, we receive and store the customer-supplied user id, and optionally email, display name, and a small set of traits (e.g. plan, signup date). This lets the customer's team see all recordings and feedback from the same end-user across sessions and devices. The customer is responsible for ensuring they have a lawful basis to share this data with us.

Source Code (PR Generation Only)

When a customer triggers AI pull-request generation, the connected repository is temporarily cloned into an ephemeral sandbox so an AI agent can read and edit files. Repository contents are sent to Anthropic for processing for the duration of that job and the sandbox is destroyed when the job completes. We do not retain repository contents after the PR is opened.

GitHub Integration Data

• GitHub OAuth tokens (encrypted)
• Repository information you connect
• Pull request and issue data created through Usero
• GitHub username and profile information

Usage Analytics

• Pages visited and features used
• Time spent on the platform
• Browser type and version
• Device information and screen size
• IP address and general location (country/city level)

Payment Information

• Billing details (processed and stored by Stripe)
• Payment history and transaction records
• We never store full credit card numbers

Infrastructure

• Hosted on Cloudflare Workers and Cloudflare D1 database
• Data encrypted at rest and in transit (TLS/SSL)
• Regular security audits and updates
• Encrypted session cookies for authentication

Security Measures

• Password hashing using industry-standard algorithms
• OAuth tokens stored encrypted
• Rate limiting to prevent abuse
• Regular backups and disaster recovery procedures

Access Controls

Only authorized personnel have access to user data, and all access is logged and monitored.

Stripe (Payment Processing)

Handles all payment transactions. View their privacy policy.

GitHub (OAuth & Repository Integration)

Authenticates users and creates pull requests. View their privacy policy.

Anthropic Claude (AI Processing)

Classifies feedback (category, urgency, sentiment, summary) and powers AI pull-request generation. Feedback content, and for PR generation the cloned repository contents, are sent to Anthropic's API for the duration of each job. Anthropic does not train models on this data. View their privacy policy.

OpenAI (Embeddings)

Generates vector embeddings of feedback text so we can group semantically similar items into clusters. Feedback text is sent to OpenAI's embeddings API; no other data is shared. OpenAI does not train models on API data. View their privacy policy.

Cloudflare (Hosting & CDN)

Hosts our infrastructure and provides DDoS protection. View their privacy policy.

Sentry (Error Monitoring)

Monitors application errors and performance. View their privacy policy.

Free Tier

Feedback data is retained for 30 days. After this period, data is automatically deleted.

Pro Plan

Unlimited data retention while your subscription is active.

Account Data

Account information is retained while your account is active. Upon account deletion, personal data is removed within 30 days, except where required by law.

Billing Records

Transaction records are kept for 7 years for tax and legal compliance purposes.

Session Replay Identity

Anonymous device identifiers and the recordings they group follow the same retention as the customer's plan above. Identified end-user records (created when a customer calls our identify API) persist while that customer's subscription is active, and are deleted with the rest of their data on account closure.

Essential Cookies

• Session cookies for authentication (required for service functionality)
• Anonymous client identification for non-registered users

Analytics Cookies

We use cookies to understand how you use our service. This helps us improve the product and fix issues. You can disable these through your browser settings.

localStorage Identifiers

When session replay is enabled by the customer, our widget stores a random anonymous device identifier in your browser's localStorage. This is technically not a cookie and is not sent to any third-party domain. It is used only to group recordings from the same browser so the customer's team can review them together. Clearing site data removes it.

No Third-Party Advertising

We do not use advertising cookies or sell your data to third parties for marketing purposes.

What usero reads from Slack

usero subscribes to a narrow set of bot events. Slack invokes the app only on these events, and each is scoped to the single message or input the user explicitly directed at usero.

• reaction_added: Filtered to the wrench or pushpin emoji. On a match, usero fetches the single reacted message via conversations.history keyed to that one timestamp, never paged. The wrench reaction additionally queues an AI-drafted pull request against the connected repo; pushpin captures only. Any other emoji is discarded.
• message_action / view_submission (Send to usero shortcut): usero reads only the message the user explicitly right-clicked plus the values they typed into the modal.
• slash_command (/usero): usero reads only the text typed after /usero. It does not look at channel history.
• app_home_opened: Renders the App Home tab. No message content involved.
• app_uninstalled: Triggers the uninstall deletion workflow below.

What usero stores

For every message a user explicitly forwards, usero stores:

• The message text.
• The Slack team id, channel id, and message ts (used together as an idempotency key).
• A Slack permalink to the original message.
• The Slack user id of the message author, so the inbox can attribute the report.
• The Slack user id of the teammate who forwarded it, plus the forward timestamp.
• Display names and email addresses for both author and reactor, resolved via users.info at capture time.

All of the above lives on the existing Feedback row under source = 'slack' and is subject to usero's standard retention (the same retention as feedback captured from the web widget or GitHub).

What usero does not store

• The contents of any message that was not explicitly forwarded by a user.
• The full channel history of any channel the bot is invited to. usero does not page conversations.history and only fetches by single ts.
• File attachments. The files:read scope is not requested.
• The list of channels in your workspace. channels:read is not requested.
• Any user-token data. usero runs entirely off the bot token.

At-rest encryption

The Slack bot token is encrypted at rest with AES-GCM using a 32-byte key. Plaintext bot tokens are never persisted.

Workspace uninstall

When the workspace admin uninstalls usero (app_uninstalled event), usero performs the following within 60 seconds:

1. Revoke the bot token via auth.revoke. The token is non-recoverable after this point.
2. Delete the encrypted bot token from the SlackInstall row.
3. Delete the SlackInstall row itself.
4. Scrub Slack author and reactor user ids from every Feedback row with source = 'slack' belonging to that workspace.

The text content of previously captured feedback rows is retained under the workspace owner's usero account, subject to usero's standard retention and deletion controls. To delete the text content too, the workspace owner can delete the rows individually from the inbox or close the usero account, which triggers full deletion per usero's standard data-deletion policy.

Sub-processors for Slack data

• Cloudflare: Workers and D1 store forwarded Slack messages in the same database as the rest of usero data.
• Anthropic: When a user triggers AI pull-request generation from a Slack forward, the message contents and relevant code context are sent to Anthropic's Claude API for the duration of that job only.

Contact for Slack data requests

Privacy questions and data deletion requests: support@usero.io (use subject "Slack data deletion" for deletion requests).