Privacy Policy

Effective: April 14, 2026

Niklas Rosenqvist ("we", "us") operates Lixir, a Slack application for structured async decision-making, and the lixir.app website. This policy explains what data we collect and how we handle it.

1. Data Controller

Niklas Rosenqvist
Mullbärsstigen 5, 196 34 Kungsängen, Sweden
contact@lixir.app

2. Data We Collect

2.1 Slack Workspace Data

When you install Lixir to your Slack workspace, we receive and store:

Workspace (team) ID and name
Bot token (encrypted at rest — see Section 3)
Installer user ID (Slack user ID, stored in plaintext)
Channel IDs where Lixir is used

We use this data solely to operate the Lixir service within your workspace.

Lawful basis: Performance of contract (Art. 6(1)(b) GDPR).

When a user submits a question via the /ask command, question content (title, context, question text) is posted to Slack and optionally synced to Google Sheets. It is not stored in our database. We store only the following metadata:

Question status (pending, approved, rejected, backlog)
Channel ID and message timestamp
Author and resolver Slack user IDs (stored in plaintext)
Vote records: voter Slack user ID, vote type, and timestamp (stored in plaintext)

Slack user IDs are opaque identifiers (e.g. U01ABC2DEF) that do not directly reveal a person's name or email. However, they can be resolved to a user profile within that Slack workspace and are therefore considered pseudonymous personal data under GDPR.

Lawful basis: Performance of contract (Art. 6(1)(b) GDPR).

2.3 Google OAuth Tokens

Google Sheets integration is entirely optional. If you choose to connect it, you are redirected to Google's OAuth consent screen where you explicitly grant Lixir access to create and update spreadsheets. This redirect constitutes your explicit consent under Art. 6(1)(a) GDPR.

We store OAuth access and refresh tokens for the connected Google account. These tokens are encrypted at rest (see Section 3) and are used solely to create and update spreadsheets on your behalf. When syncing, Lixir writes question metadata (title, author, status, timestamps) to your Google Sheet. We do not access any Google data beyond Sheets.

You can withdraw consent at any time by disconnecting Google Sheets in Lixir's settings or revoking access via your Google account permissions. Upon withdrawal, stored tokens are deleted.

Lawful basis: Explicit consent (Art. 6(1)(a) GDPR).

2.4 Billing Data

Upgrading to a paid plan redirects you to Stripe Checkout. By proceeding to checkout, you consent to Stripe processing your payment details under Stripe's privacy policy. We do not store credit card numbers or full payment details.

Stripe provides us with the following, which we store in our database:

Stripe customer ID and subscription ID (stored in plaintext)
Subscription status and billing period

Lawful basis: Performance of contract (Art. 6(1)(b) GDPR); legal obligation for accounting records (Art. 6(1)(c) GDPR).

3. Encryption at Rest

Sensitive data is encrypted at rest using AES-256-GCM with per-tenant encryption keys. Keys are derived via HKDF-SHA256 from a master key combined with the workspace (team) ID, ensuring that one tenant's data cannot be decrypted with another's key.

Encrypted fields:

Slack bot tokens
Google OAuth access and refresh tokens

Not encrypted (stored in plaintext):

Slack user IDs (installer, question author, resolver, voters) — opaque identifiers, pseudonymous personal data
Stripe customer ID and subscription ID — opaque identifiers with no direct personal information
Metadata: workspace ID, channel IDs, message timestamps, vote types, question status

These plaintext fields are opaque identifiers or operational metadata that do not contain names, emails, or other directly identifying information. All database queries are scoped by workspace (team) ID to enforce tenant isolation.

4. Cookies & Tracking

The lixir.app website does not use cookies, tracking pixels, analytics scripts, or any form of client-side tracking.

5. Infrastructure & Sub-Processors

Lixir relies on the following infrastructure providers as data sub-processors:

Cloudflare — Workers (compute), D1 (database), KV (cache/state), Queues (async jobs). Cloudflare may process IP addresses as part of standard CDN and DDoS protection. (Privacy Policy, DPA)
Slack (Salesforce) — Workspace integration, message posting, interactive components. (Privacy Policy, DPA)
Google — Sheets API (optional backlog sync, only when explicitly connected by user). (Privacy Policy, DPA)
Stripe — Payment processing for paid subscriptions. (Privacy Policy, DPA)

6. Data Retention & Deletion

Workspace and question data: Retained for the duration of your Lixir installation. When you uninstall Lixir from your Slack workspace, all associated data (installation record, questions, votes, tokens) is automatically cascade-deleted within 30 days.
Google OAuth tokens: Retained while the integration is active. Deleted when you disconnect Google Sheets or uninstall Lixir.
Billing records: Retained for 7 years after the end of the fiscal year in which the transaction occurred, as required by the Swedish Bookkeeping Act (Bokföringslagen, SFS 1999:1078).

Where personal data is retained to comply with a legal obligation, it will not be used for other purposes during the extended retention period and will be deleted once the obligation expires.

6.1 Individual User Erasure (Art. 17)

If you are an individual user within a Slack workspace, you may erase your personal data from Lixir via the "Delete my data" button in Lixir's App Home tab in Slack. This will:

Delete all your vote records from the workspace
Anonymize your Slack user ID on questions you authored or resolved (set to null — the question record is preserved for the team's decision history)
Delete any Google OAuth tokens linked to your user ID

This operation is scoped to the workspace you are in and does not affect the workspace installation itself or other users' data. You may also request erasure by contacting us at contact@lixir.app.

If you are located in the EU/EEA, you have the following rights:

Right of access (Art. 15): You may request a summary of the personal data we hold about you. For individual users, this includes your Slack user ID as stored in question and vote records. For workspace administrators, this also includes the installation record and any connected integration tokens.
Right to rectification (Art. 16): You may request correction of inaccurate data.
Right to erasure (Art. 17): You may request deletion of your personal data. See Section 6.1 for how individual user erasure is handled without affecting the workspace.
Right to restrict processing (Art. 18): You may request that we restrict processing of your data in certain circumstances.
Right to data portability (Art. 20): Lixir stores only question metadata and Slack user IDs. Question content lives in your Slack workspace (accessible via Slack's workspace export) and, if connected, in Google Sheets that you own directly. Given this, the portability obligation for data held exclusively by Lixir is minimal. You may still request a copy of the metadata we hold.
Right to object (Art. 21): You may object to processing of your personal data.
Right to withdraw consent: Where processing is based on consent (Google Sheets integration), you may withdraw consent at any time by disconnecting the integration. Withdrawal does not affect the lawfulness of processing before withdrawal.
Right to lodge a complaint: You may file a complaint with the Swedish Authority for Privacy Protection (IMY).

To exercise any of these rights, contact us at contact@lixir.app. We will respond within 30 days.

8. Changes

We may update this policy from time to time. The effective date at the top of this page will be updated accordingly.

9. Contact

Niklas Rosenqvist
contact@lixir.app