Ok, so quite interesting to look at how all this works:
Top of this page: https://slack.com/privacy-policy
Information we collect and receive
1. Customer Data
Content and information submitted by users to the Services is referred to in this policy as “Customer Data.” As further explained below, Customer Data is controlled by the organization or other third party that created the team (the “Customer”). Where Slack collects or processes Customer Data, it does so on behalf of the Customer. Here are some examples of Customer Data (but keep in mind they are only examples and there may be others): messages (including those in channels and direct messages), pictures, videos, edits to messages or deleted messages, and other types of files. A user may also choose to enter information into their profile, such as first and last name, job, a photo and a phone number.
And somewhat lower down:
Sharing and Disclosure
There are times when information described in this privacy policy may be shared by Slack. This section discusses only how Slack may share such information. Customers determine their own policies for the sharing and disclosure of Customer Data. Slack does not control how Customers or their third parties choose to share or disclose Customer Data.
1. Customer Data
Slack may share Customer Data in accordance with our agreement with the Customer and the Customer’s instructions, including:
With third party service providers and agents. We may engage third party companies or individuals to process Customer Data.
With affiliates. We may engage affiliates in our corporate group to process Customer Data.
With third party integrations. Slack may, acting on our Customer’s behalf, share Customer Data with the provider of an integration added by Customer. Slack is not responsible for how the provider of an integration may collect, use, and share Customer Data.
In short, it pretty much looks like they can do what the heck they want with anything you type in.