Privacy Policy

This Privacy Policy explains how MSW Digital LLC(“we,” “us,” or “our”) collects, uses, shares, and safeguards information in connection with Cake Day, a Slack app that posts birthday and work anniversary shout-outs in Slack workspaces (the “Service”). It applies to our website at cakeday.io, the Cake Day Slack application, and any related services that link to this policy.

By installing Cake Day into your Slack workspace, creating an account, or using the Service, you acknowledge that you have read and understood this policy.

1. Who we are

Cake Day is operated by MSW Digital LLC, a Delaware limited liability company. For privacy questions or to exercise your rights, contact us at info@cakeday.io.

If you are an individual user whose workspace administrator has installed Cake Day, your employer or the organization operating the Slack workspace is the “data controller” for your personal information under laws like GDPR. We process that information on their behalf as a “data processor.”

2. Information we collect

2.1 Information you or your workspace provide

• Slack account information. When an administrator installs Cake Day, we receive your Slack workspace ID, workspace name, channel IDs, and a bot token that lets Cake Day post and read information necessary to run the Service.
• Member information.To figure out who to celebrate, we store each roster member's Slack user ID, display name, and (if the member opts in) their birth month and day and/or their work start date (year, month, day).
• Administrator preferences. Channel choices, post time, timezone, pause state, and other configuration you enter through our setup modal or slash commands.
• Billing information. If your workspace subscribes to a paid plan, you provide payment details directly to our payment processor, Stripe, Inc. We do not see or store full card numbers. We store billing identifiers (Stripe customer ID, subscription status, plan tier, invoice history) and your billing email address.
• Support communications. If you email us, we retain the content of that email and your contact details so we can respond and improve the Service.

2.2 Information we collect automatically

• Log data. IP address, user agent, request timestamps, and minimal error information from our servers and the Slack events our app receives.
• Cookies and similar technologies. Our marketing website uses a minimal set of essential cookies needed to keep the site working. If we introduce analytics or non-essential cookies, we will ask for consent where required.

2.3 Information we do NOT collect

• We do not ask for or store birth years for birthday celebrations.
• We do not track your activity across third-party websites.
• We do not sell personal information.
• We do not use your Slack workspace content to train AI models.

3. How we use information

We use the information described above to:

• Provide the Service — generate and post birthday and work anniversary shout-outs.
• Administer your account, subscription, and billing.
• Respond to your support requests.
• Monitor, debug, and secure the Service.
• Send you operational communications (e.g., billing receipts, incident notices).
• Comply with legal obligations and enforce our agreements.

4. How shout-out text is generated (AI / LLM use)

Cake Day uses a large language model — Google's Gemini API (model: gemini-2.5-flash)— to generate the celebration message text that gets posted in the workspace channel. End users do not chat with the LLM directly and cannot send free-form prompts; they only see the LLM's output in the form of generated birthday and work-anniversary shout-outs.

For each celebration, we send only a minimal context to Gemini: the celebrant's first-name handle (e.g., “Maya”), the kind of celebration (birthday or work anniversary), the timing framing (today / tomorrow / weekend-shifted), and (for anniversaries) the year count. Workspaces on the Pro plan can optionally configure a custom AI tone string in the dashboard, which is appended to our system prompt. We never send Slack tokens, member emails, message history, roster contents, or organization- identifying information beyond the celebrant's first-name handle.

Tenancy.Each Gemini call is a single, isolated API request scoped to one workspace's celebration event. There is no persistent session, no fine-tuning, and no shared inference state across workspaces or tenants.

Residency. Gemini API requests are processed in the United States. Cake Day uses the default global Gemini API endpoint, which Google routes to U.S.-based processing per their published infrastructure policies.

Retention & training.Per Google's paid Gemini API terms, prompt and response content are not retained beyond the operational window required to serve the request and are not used for model training. Cake Day uses the paid commercial tier of the Gemini API, not the consumer Gemini product. Cake Day itself does not store the raw prompt sent to Gemini; we only retain the resulting shout-out text in our own database for posting and idempotency, deleted within 30 days of workspace uninstall along with the rest of your roster data.

5. Service providers and sub-processors

We share information only with service providers who help us operate Cake Day and only to the extent needed for them to perform their services. The current sub-processor list is also published at cakeday.io/sub-processors and updated whenever it changes.

We may also disclose information (a) to comply with a lawful subpoena, court order, or legal obligation, (b) to protect our rights, property, or the safety of users or the public, (c) in connection with a merger, acquisition, or sale of all or part of our business (you will be notified of any change of data custodian), and (d) with your consent.

6. Legal bases (for users in the EEA and UK)

• Performance of a contract. Processing necessary to provide the Service to your workspace.
• Consent. Where you have opted in — for example, adding your birthday or work anniversary to the roster.
• Legitimate interests. Securing the Service, preventing fraud, maintaining quality, and basic analytics. We balance these against your privacy rights.
• Legal obligation. Tax, accounting, and regulatory compliance.

7. International transfers

We are based in the United States, and our primary service providers operate in the United States. If you access the Service from outside the United States, your information may be transferred to, stored, and processed in the United States or other countries where our providers maintain facilities. Where required, we rely on mechanisms such as the EU Standard Contractual Clauses or the EU–US and UK–US Data Privacy Framework for lawful cross-border transfers.

8. Data retention

• Active workspace data. Retained for as long as your workspace has Cake Day installed.
• After uninstall. We delete workspace roster and configuration data within 30 days of uninstall, except where we need to retain records to resolve disputes, comply with legal obligations, or enforce our agreements.
• Billing records. Retained for up to 7 years to comply with U.S. tax and accounting requirements.
• Server logs. Retained for up to 30 days.
• Broadcast audit logs. Retained for up to 12 months to audit opt-in campaigns.

9. Your rights

Depending on where you live, you may have the following rights with respect to your personal information:

• Access. Request a copy of the personal information we hold about you.
• Correction. Ask us to fix information that is inaccurate.
• Deletion. Ask us to delete your personal information. You can also self-serve by running /cakeday me→ “Remove me entirely” in Slack.
• Portability. Receive a copy of your data in a structured, machine- readable format.
• Objection and restriction. Object to or request restriction of certain processing activities.
• Withdraw consent. Withdraw any consent you gave us at any time, without affecting prior processing.
• Complain. Lodge a complaint with your local data protection authority.

To exercise these rights, email info@cakeday.io. If you are a workspace member, we may direct your request to your workspace administrator where they act as the data controller.

10. Your California privacy rights

If you are a California resident, you have the rights described in Section 9, plus rights under the California Consumer Privacy Act (“CCPA”) including the right to know the categories and specific pieces of personal information collected, the right to request deletion, the right to opt out of the “sale” or “sharing” of personal information, and the right not to be discriminated against for exercising these rights.

We do not sell personal information, and we do not share personal information for cross-context behavioral advertising.

11. Security

We use commercially reasonable technical and organizational measures to protect information from unauthorized access, disclosure, alteration, or destruction. These include:

• Encryption in transit. All connections to and from Cake Day use TLS.
• Encryption at rest. Our hosted Postgres database (Supabase) encrypts all data at rest using AES-256.
• Defense-in-depth for Slack tokens.Workspace bot tokens — the most sensitive credential we hold — receive a second layer of application-level encryption via Postgres pgcrypto's pgp_sym_encrypt, keyed by an encryption secret stored only as a deployment environment variable. Plaintext bot tokens never exist outside the encrypt/decrypt boundary in our installations repository module.
• Multi-tenant isolation. Every database query filters onworkspace_id; row-level security is enabled on every multi-tenant table as a defense-in-depth layer. An automated integration test verifies tenant isolation on every code change.
• Access controls and audit. Least-privilege access for production systems, logging of all administrative access, regular software updates.
• Backups. Automated daily backups with 7-day point-in-time recovery on Supabase.

No method of transmission over the Internet is 100% secure, so we cannot guarantee absolute security.

12. Children

The Service is not directed to children under 16, and we do not knowingly collect personal information from children under 16. If you believe we have collected information from a child, please contact us and we will delete it.

13. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify workspace administrators by email or by posting a notice in the Service. The “Last updated” date at the top of this policy indicates when it was last revised. Continued use of the Service after a change means you accept the updated policy.

14. Contact

MSW Digital LLC
info@cakeday.io