Privacy policy

1. Controller

slidewizard.ai GmbH, Zimmermannstr. 5, 70182 Stuttgart, Germany, info@slidewizard.ai.

No data protection officer is currently appointed.

2. Scope

This policy covers the web app at app.slidewizard.ai (and test.slidewizard.ai), the SlideWizard add-in for Microsoft PowerPoint and the related interfaces. For content a customer processes in SlideWizard, the customer is the controller and we act as processor under the data processing agreement (DPA).

3. Purposes and legal bases

• Providing the web app and add-in, sign-in, organization management, creating and editing slides and presentations: Art. 6(1)(b) GDPR.
• Billing, invoices, statutory retention: Art. 6(1)(b) and (c) GDPR.
• Security, abuse prevention, error analysis, stable operation: Art. 6(1)(f) GDPR.
• Proof that the terms and the DPA were accepted: Art. 6(1)(b), (c) and (f) GDPR.
• Optional services only with consent (Art. 6(1)(a) GDPR) when explicitly enabled.

4. Hosting, operation and server logs

We run the database, files, background processing and interfaces on Amazon Web Services (AWS) in Frankfurt (eu-central-1). An independent ledger of deletion requests is kept at AWS in Ireland (eu-west-1).

The web app is delivered through Vercel. Some web app functions may currently run outside the EU (USA). Technical access data and the content of the respective request are processed there.

When you access the service we process technical access data (IP address, date and time, URL, referrer, browser and device information, HTTP status, error and security events) for delivery, troubleshooting and security.

5. Sign-in, account and organizations

We use Auth0 (Okta) for sign-up, sign-in and sessions: Auth0 user ID, email address, name, sign-in times and technical session data. Our database stores account, organization, membership, role, invitation and billing status data.

6. Acceptance of the terms and the DPA

When registering an organization, the registering person accepts the terms (AGB) and the DPA (AVV) on behalf of the organization. We store the document, its version, the time and the accepting person. After material changes we ask for acceptance again.

7. Presentations, prompts, templates and uploads

When users create or edit slides or presentations we process prompts, chat messages, presentation structures, slide content, templates, uploaded files, results, previews, exports, edit history and technical job data. Users must not enter special categories of personal data (Art. 9 GDPR) or confidential third-party data without a legal basis.

8. AI processing

To create and edit content we send the content required for the task (prompts, slide and presentation content, chat history, uploaded references) to AI services:

• OpenAI (OpenAI Ireland Ltd. / OpenAI, L.L.C.): text and image processing.
• Google Cloud (Vertex AI) (Google Cloud EMEA Ltd. / Google LLC): text and image processing.

These providers process the data as sub-processors only to provide the service. Under their contract terms, data sent through their APIs is not used to train their models.

We do not use this content for advertising and do not sell it. There is no automated decision with legal effect within the meaning of Art. 22 GDPR.

9. Agent chat in the PowerPoint add-in

The add-in also saves the Agent chat in the PowerPoint file so it can continue after the file is reopened. The saved chat is encrypted with a key that only the person who had the chat receives. Other people who open the file do not see the chat. Deleting the account deletes that key, after which saved chats can no longer be read. Older chats saved unencrypted before this change are shown only to their original author and are replaced on the next save.

10. Billing and payments

We use Paddle (Paddle.com Market Ltd.) as merchant of record for checkout, subscription, invoices and payment methods. Payment data is processed in the Paddle checkout. We store Paddle customer, subscription and transaction IDs, plan and trial status, usage and billing events.

11. Email and notifications

We send invitations, approvals and operational emails via IONOS (SMTP).

12. Cookies and local storage

The web app and the add-in use strictly necessary cookies and local storage for sign-in, security, checkout and workspace state. Details: /cookies. We do not use analytics or marketing cookies.

13. Recipients and sub-processors

14. Transfers to third countries

Where providers process data outside the EU/EEA, transfers rely on an adequacy decision (in particular the EU-U.S. Data Privacy Framework where the provider is certified) or on EU standard contractual clauses with supplementary measures.

15. Retention and deletion

• Account, organization and presentation data are kept for as long as the service is used.
• Deletion on request: organization owners can request deletion of the organization, members can request deletion of their account in the settings. The request is carried out after a 14-day waiting period and can be withdrawn until then. A copy of the data can be downloaded first (Art. 15, 20 GDPR).
• When an organization is deleted we cancel a running Paddle subscription. We delete content, files, accounts and sign-in identities. We keep only the Paddle customer and subscription IDs, and the invoice records at Paddle, where statutory retention applies (Sec. 147 AO, Sec. 257 HGB, up to 10 years).
• After deletion, data remains in backups for at most 14 days and is then overwritten.
• Technical logs are kept only as long as operation and security require.

16. Your rights

Under the GDPR you have the right of access, rectification, erasure, restriction, data portability, objection and withdrawal of consent with effect for the future. Export and deletion are available in the web app settings. Otherwise an email to info@slidewizard.ai is enough.

17. Right to lodge a complaint

You may lodge a complaint with a supervisory authority, in particular the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart.