Empowia

Privacy Policy

Last updated: October 18, 2026

Empowia (“we”, “us”) publishes the Empowia for Slack app, which backs up your Slack data to your own computer, and operates the empowia.com website. This policy explains which personal data we process, and which we don’t, in the app and on the website, in line with the EU General Data Protection Regulation (GDPR), the UK GDPR where it applies, and the French Data Protection Act (loi Informatique et Libertés).

In short: the app keeps your data on your computer and sends us neither your Slack data nor any telemetry. The website collects the data it needs to reply to your messages, process your purchases, run your account if you create one and prevent abuse, as well as audience-measurement (analytics) data, with your consent where consent is required. We don’t sell your personal data, we don’t share it with any third party other than the service providers listed in section 5, and we use no advertising cookies.

1. Who we are

The data controller is:

  • Name: Empowia
  • Legal status: Sole trader (micro-entrepreneur under French law)
  • Address: 8 rue Boucry, 75018 Paris, France
  • SIRET (French business identification number): 811 758 952 00014
  • Email: support@empowia.com

For any question about your personal data, email us at support@empowia.com.

2. The app: what it does and doesn’t do with your data

Empowia for Slack is a fully local application.

  • Your data stays on your computer. Your backups, your files and your Slack sign-in are kept on your computer and are never sent to us: no Empowia online service receives your Slack data.
  • No telemetry. The app collects no telemetry, no analytics and no crash reports.
  • Offline verification. The app verifies your unlock code offline.
  • Your credentials are encrypted. Your Slack sign-in session and your AI API key are encrypted when they are stored on your computer:
    • on Windows, with Windows’ built-in data protection, tied to your Windows user account: a copied file can’t be read by another user or on another computer;
    • on macOS, with a key the app keeps in its own data folder (~/Library/Application Support/Empowia/Slack), which only your macOS user account can read. Because the key is stored next to the data, a complete copy of that folder could be read on another computer, so keep any backup of that folder private.
  • AI with your own key. When you use the optional AI features, the app sends your prompts and the relevant content of your archive directly to the provider you chose (Google Gemini, Anthropic Claude, OpenAI or OpenRouter), using your own API key and under that provider’s terms, never through Empowia. That provider is not our processor; please read its terms and its privacy policy.

3. What the website collects, why, and on what legal basis

The empowia.com website processes the following data. The legal bases listed are those of the GDPR and, where it applies, the UK GDPR.

  • Contact form
    • Data: name, email address, message.
    • Purpose: to reply to your request and provide support.
    • Legal basis: steps taken at your request, and our legitimate interest in replying to messages sent to us.
  • Product notifications, newsletter and waitlist
    • Data: email address, the tool you’re interested in, where you signed up.
    • Purpose: to send you the information you asked for.
    • Legal basis: your consent, which you can withdraw at any time.
  • Blog comments (moderated before publication)
    • Data: name, comment text.
    • Purpose: to publish your comment.
    • Legal basis: your consent and our legitimate interest.
  • Purchase of the Unlimited unlock
    • Data: email address, unlock code, amount, currency, Stripe session and customer IDs, status, dates.
    • Purposes: to deliver your purchase, provide support and keep our accounts.
    • Legal basis: performance of the contract and compliance with our legal obligations.
  • Optional account
    • Data: email address; password, stored only as a hash; if you use Google sign-in, your Google account ID, your email address and whether that address is verified; verification status; account creation date. When you sign in with Google, we request access to “openid”, “email” and “profile”, but we keep only your Google account ID and your email address (with whether it is verified).
    • Purpose: to provide your account.
    • Legal basis: performance of the contract.
  • One-time links (email verification, password reset)
    • Data: links stored only as hashes, which expire.
    • Purpose: to keep your account secure.
    • Legal basis: performance of the contract.
  • Server logs
    • Data: IP address, browser type, timestamps.
    • Purpose: to run the website and keep it secure.
    • Legal basis: our legitimate interest.
  • Analytics (Google Analytics 4, via Google Tag Manager)
    • Data: pages viewed, device and browser, approximate location, interactions, a pseudonymous identifier stored in a cookie.
    • Purpose: to measure the website’s audience.
    • Legal basis: for visitors in the European Economic Area (EEA), the United Kingdom or Switzerland, your consent; for visitors in other countries, our legitimate interest in measuring the website’s audience, which you can object to at any time (see section 4).
  • Bot protection (Cloudflare Turnstile, on the contact, product-notification and newsletter sign-up, comment, sign-in and sign-up forms)
    • Data: bot-detection signals.
    • Purpose: to prevent spam and abuse.
    • Legal basis: our legitimate interest.

Payments. Card details are handled by Stripe; we never receive your full card number.

No advertising. We use no advertising cookies and we don’t sell your personal data. Google Analytics runs with its advertising features turned off: ad storage is denied and ads data redaction is on.

HTML Tweak. Files you edit with the free HTML Tweak tool are processed locally in your browser and are not uploaded.

4. Cookies and similar technologies

The website uses the following cookies and similar technologies:

  • emp_session: keeps you signed in to your account (only if you sign in). Duration: 30 days. Category: necessary.
  • g_oauth_state: secures Google sign-in. Duration: 10 minutes. Category: necessary.
  • NEXT_LOCALE: remembers the website language when it differs from your browser’s. Duration: the session (until you close your browser). Category: necessary.
  • emp_consent: remembers your cookie choice. Duration: 6 months. Category: necessary.
  • Cloudflare Turnstile: anti-bot check on forms. Duration: set by Cloudflare. Category: necessary.
  • _ga and _ga_7Z24ZX9QL0: Google Analytics (audience measurement). Duration: up to 2 years. Category: analytics, subject to your consent where consent is required.

The admin_token cookie is used only by the website’s operator for moderation; it doesn’t concern visitors.

Necessary cookies are essential for the website to work or to provide a service you asked for, so they don’t require your consent.

Your choice about analytics

  • EEA, United Kingdom and Switzerland: when you visit, a banner asks for your consent. Google Analytics loads only after you click “Accept”; if you decline or make no choice, it doesn’t load.
  • Other countries: Google Analytics loads by default, on the basis of our legitimate interest (the GDPR applies to our processing because we are established in France). You can object at any time, as explained below.
  • Everyone: you can change or withdraw your choice at any time using the “Cookie settings” link in the website footer.

5. Who receives your data

Your personal data is intended for Empowia. We don’t sell it, and we don’t share it with any third party other than the following service providers, which process it on our behalf as processors or, for certain processing (in particular payments at Stripe and Google sign-in), as independent controllers under their own privacy policies:

  • Vercel: website hosting;
  • Neon: database;
  • Stripe: payment processing;
  • Resend: sending transactional emails, such as the email containing your unlock code;
  • Cloudflare: protecting forms against bots (Turnstile);
  • Google: audience measurement (Google Analytics) and, if you use it, Google sign-in.

The AI providers you use with your own key in the app are not our processors: you deal with them directly.

We may also disclose your data where the law requires us to, in particular at the request of an authorised judicial or administrative authority.

6. International transfers

Some of these providers process data in the United States or in other countries outside the European Union. These transfers rely on appropriate safeguards, such as the Standard Contractual Clauses adopted by the European Commission or, where applicable, the EU–US Data Privacy Framework.

7. How long we keep your data

  • Purchase records: for as long as needed to manage your licence, and for the period required by accounting and tax law;
  • Account: until you ask us to delete it;
  • Data sent through forms and comments: until it is no longer needed for the purpose for which you sent it, or until you ask us to delete it;
  • Server logs: a short period;
  • Google Analytics event data: 14 months at most;
  • Cookie choice: 6 months.

8. Your rights

Under the conditions set by the GDPR (and, where it applies, the UK GDPR) and the French Data Protection Act, you have the following rights:

  • the right to access your data;
  • the right to have it corrected (rectification);
  • the right to have it erased;
  • the right to data portability;
  • the right to object;
  • the right to restrict processing;
  • the right to withdraw your consent at any time, where processing is based on consent;
  • under French law, the right to give instructions about what happens to your data after your death.

To exercise these rights, email us at support@empowia.com; we’ll reply within the time allowed by law. You can also withdraw your consent to analytics at any time using the “Cookie settings” link.

You also have the right to lodge a complaint with a data protection supervisory authority, in particular the one in your country of residence. In France, this is the Commission nationale de l’informatique et des libertés (CNIL, www.cnil.fr); in the United Kingdom, it is the Information Commissioner’s Office (ICO, ico.org.uk).

9. No sale or sharing of personal information

We do not sell or share your personal information, as those terms are used in US state privacy laws such as the California Consumer Privacy Act (CCPA), and we do not use it for targeted advertising.

10. Children

Empowia is not directed at children and is not intended for anyone under 16.

11. Changes to this policy

We may change this policy, in particular to reflect changes to our products. When we do, we update the “last updated” date shown on this page.

12. Contact

For any question about the protection of your personal data: support@empowia.com.

13. Language

This policy was written in French. This document is an English version of the French original. In case of any discrepancy, the French version prevails.