Privacy Policy

How we collect, use, and protect your information

Privacy Policy Overview

Last updated: February 26, 2026

At Pong, we're committed to handling your information with care and transparency. This Privacy Policy explains how Pong Enterprise, Corp. ("Pong," "we," "us," or "our") collects, uses, and protects information when organizations use our Slack application, web application, AI platform integrations (such as ChatGPT and Claude, connected via the Model Context Protocol), and related services, and when individuals visit trypong.com (together, the "Service").

This Policy describes our information practices. By using the Service, you acknowledge these practices. If you do not accept them, do not use the Service.

Who We Are & How to Contact Us

Pong Enterprise, Corp.

131 Continental Dr., Suite 305
Newark, DE 19713
USA

Privacy: privacy@trypong.com

General inquiries: contact@trypong.com

Admin operations: support@trypong.com

Scope and Roles

Slack Workspace Content

Slack workspace content you intentionally upload to Pong. Pong does not have general access to your Slack workspace messages. We only store content that users intentionally and manually submit to the Pong Slack application or create through direct interactions with the Pong application (e.g., questions, answers, and follow-ups). For this content, your organization is the controller and Pong acts as your service provider/processor that stores this content on your behalf.

Website, Billing, Support, and Account Administration

For these activities, Pong is the controller.

What We Collect

We collect only what we need to operate, secure, and improve the Service.

A. Account & Workspace Information

Names, email addresses, Slack workspace, and basic profile details needed to provision and secure your account.

B. Content You Intentionally Send to Pong

Questions, answers, follow-ups, and metadata that you submit in the Pong Slack application or web application.
What we don't do: Pong does not have blanket access to Slack Direct Messages (DMs) or channels and does not read or ingest Slack message history. We only store content that a user intentionally and manually submits to Pong.

C. Third-Party Integrations

If a user connects a third-party integration, we process:

Access tokens (stored using AWS KMS envelope encryption) and the specific items the user selects to sync;
Content and metadata from selected items;
Information that respects the third-party platform's existing permissions and access controls.

Users can select or deselect items via include/exclude controls and update sync preferences at any time in the Pong web application.

D. Usage, Device & Diagnostics

Device/OS/browser info, basic event analytics, performance metrics, and error logs to operate and protect the Service.

E. Billing & Transactions

Payments are processed by Stripe. Pong receives limited billing metadata (e.g., subscription status, last four digits, expiration month/year) but not full card numbers.

F. Cookies & Similar Technologies

We use essential cookies and analytics (e.g., Mixpanel, Google Analytics) on our website. You can control non-essential cookies in your browser settings.

G. AI Platform Integrations

Authorized Users may connect Pong to AI platforms such as ChatGPT (OpenAI) and Claude (Anthropic) via the Model Context Protocol (MCP). When a user connects Pong to an AI platform:

The user authenticates via Slack OAuth and explicitly authorizes the connection;
When the user invokes a Pong tool within the AI platform, Pong returns Q&A content (question text, answer text, and metadata such as owner name, topics, and dates) to the AI platform on behalf of the user. This is the same organizational data the user already has access to within their authenticated Slack workspace;
Data returned is scoped to the user's organization — no cross-organization data is shared;
Pong does not proactively push data to AI platforms. Data is only returned in response to user-initiated tool calls;
Certain tools allow users to create or update answers in their organization's Pong library, or ask a question to a colleague via the Pong app in Slack. These write actions are always explicitly initiated by the user within the AI platform and require user confirmation before execution.

When a user disconnects Pong from an AI platform, we revoke the associated access and refresh tokens immediately. Pong does not retain any record of queries made through AI platforms. Any data previously delivered to the AI platform is subject to that platform's own retention and deletion policies.

Each AI platform has its own terms and privacy policy governing how it processes the data it receives. Users should review the applicable AI platform's policies before connecting.

How We Use Information

We use information to:

Provide core functionality and fulfill our contractual obligations to your organization.
Operate, maintain, and secure the Service; detect/prevent misuse.
Provide admin controls, usage analytics, and billing.
Communicate about service changes and, where permitted, product updates and marketing (you can opt out).
Comply with applicable law, legal process, and regulatory obligations.

Legal Bases for Processing

Where applicable (including under the GDPR), we process personal information on the following legal bases:

Performance of a contract — to provide the Service under our agreement with your organization.
Legitimate interests — to operate, secure, and improve the Service, provided those interests are not overridden by your data protection rights.
Consent — for optional activities such as marketing communications (which you may withdraw at any time).
Legal obligation — to comply with applicable laws and regulations.

AI/ML Processing

We use AI models via third-party APIs to help match questions and maintain content quality. Pong does not use your customer content to train models for other customers, and our third-party AI providers do not use your data for training.

When Authorized Users connect Pong to AI platforms (such as ChatGPT or Claude) via the Model Context Protocol, Pong serves your organization's Q&A data to the connected platform in response to user-initiated queries. This data is used by the AI platform to generate responses for the requesting user. See section G of "What We Collect" for details.

Where We Process Data

We operate primarily in the United States:

Application hosting: Railway (US West)
Web application hosting: Vercel (US East)
Key management: AWS KMS (US East) for integration tokens
Vector database: Pinecone (US East via AWS)

If your organization is outside the U.S., your information may be transferred to and processed in the U.S. Where required by applicable law, we use appropriate safeguards for international data transfers.

How We Share Information

We don't sell personal information and we don't share it for cross-context behavioral advertising.

We share information only as follows:

Within Your Organization

Content submitted to Pong may be visible to other authorized users according to your Slack workspace settings.

Service Providers/Subprocessors

We use trusted vendors to help deliver the Service. Current providers include:

Railway (Slack application hosting)
Vercel (web application hosting)
AWS KMS (key management for integration tokens)
Pinecone (vector database)
OpenAI API (AI processing, MCP platform integration)
Anthropic API (MCP platform integration)
Stripe (payments)
Loops (product/marketing email)
Salesforce (CRM)
Mixpanel and Google Analytics (analytics)

We may update these providers over time. Material changes will be reflected in updates to this Policy.

Legal & Compliance

We may disclose information if we reasonably believe disclosure is required by applicable law, regulation, legal process, or enforceable governmental request; to protect the rights, property, or safety of Pong, our users, or the public; or to detect, prevent, or address fraud, security, or technical issues.

Business Transfers

If Pong is involved in a merger, acquisition, reorganization, or sale of assets, information may be transferred as part of that transaction. We will notify affected customers before their information becomes subject to a different privacy policy.

At Your Direction

We share information at the direction of Authorized Users — for example, when a user connects Pong to an AI platform via MCP, they are directing Pong to share Q&A data with that platform.

Security

We implement safeguards intended to protect information, including:

Encryption in transit (HTTPS/TLS) and storage on SOC 2–aligned platforms;
AWS KMS envelope encryption for third-party integration tokens;
Secure database connections, environment variable isolation, and least-privileged access;
Authentication via Slack's OAuth 2.0 system; organization-level data isolation; no cross-organization data sharing;
OAuth 2.1 with PKCE for AI platform integrations (MCP), with short-lived access tokens and encrypted refresh tokens.

No method of transmission or storage is perfectly secure, but we continuously work to protect the Service.

Incident Response

If we become aware of a security breach that affects your personal information, we will notify affected customers without undue delay and in accordance with applicable law. Notifications will describe the nature of the breach, the data affected, steps we are taking, and steps you can take to protect yourself. We will provide notification via email to the Customer's Admin on file.

Retention

Pong Data

Retained until your organization or an authorized user deletes it or your organization terminates the Service.

Logs & Diagnostics

Web application logs: retained ~24 hours
Slack application logs: retained ~3 months

We may keep limited information as required by law, to resolve disputes, and to enforce agreements.

Your Choices & Rights

Your rights depend on your location and your organization's policies. Subject to applicable law, you may request to:

Access the personal information we hold about you;
Correct inaccurate personal information;
Delete your personal information;
Export your personal information in a portable format;
Object to or restrict certain processing;
Withdraw consent where processing is based on consent.

To make a request, email privacy@trypong.com. We will respond within 30 days (or as required by applicable law). If you are in the EEA or UK and are unsatisfied with our response, you have the right to lodge a complaint with your local data protection authority.

Marketing Communications

You can opt out from Loops-powered product/marketing emails using the unsubscribe link in the message or by contacting us.

Cookies

Manage non-essential cookies via your browser settings.

AI Platform Connections

You can disconnect Pong from any AI platform at any time through that platform's settings. Disconnection immediately revokes Pong's access tokens for that connection.

California Privacy Notice (CPRA)

We do not sell personal information and do not share it for cross-context behavioral advertising. We do not intentionally collect sensitive personal information.

California residents may exercise rights to know, access, delete, correct, and limit the use of their personal information. We will not discriminate against you for exercising these rights. To submit a request, email privacy@trypong.com. We may take reasonable steps to verify your identity.

Children's Privacy

The Service is intended for users 18 and older. We do not knowingly collect personal information from anyone under 18. If you believe a minor provided information to us, contact privacy@trypong.com and we will take appropriate steps to delete it.

Admin Controls: Export & Deletion

Workspace administrators can request export or deletion of their Pong data by emailing support@trypong.com (or by using in-product controls if available). We may require proof of identity and authority before acting on a request.

Changes to This Policy

We may update this Policy from time to time. If we make material changes, we'll post the updated version and update the "Last updated" date above. Your continued use of the Service after the changes take effect means you accept the revised Policy.

How to Reach Us

Pong Enterprise, Corp.

131 Continental Dr., Suite 305
Newark, DE 19713
USA

privacy@trypong.com | contact@trypong.com | support@trypong.com