Draft for review. Not in effect, and not legal advice. Bracketed text is a placeholder.

Privacy policy

Last updated: [DATE OF FIRST PUBLICATION]

HeySlide lets a creator publish a deck that people, and the AI assistants they use, can ask questions. This policy explains what HeySlide collects, why, who sees it and how long it is kept. HeySlide is operated by [COMPANY LEGAL NAME], [REGISTERED ADDRESS] (“we”).

What we collect

  • Account details: your email address and name. If you continue with Google, Google tells us your name, email address, whether Google verified it and, for a Google Workspace account, its company domain. We never receive your Google password or access to your Google files.
  • What creators upload: decks (PPTX or PDF) and supporting documents, the slide and page images we make from them, and what our models read from them (text, facts, table and chart data, topics).
  • Questions and answers: each question asked about a deck, the answer given, the sources it cited, how it was decided (the rule and checks applied), and any message sent to the deck’s author.
  • Voice questions: the recording is sent for transcription and deleted as soon as the transcript comes back. We never store the audio; we keep only the transcript, as the question text, once you ask it.
  • Viewing activity: which slides were viewed on a shared deck and for how long. Only that deck’s author sees it.
  • Assistants: when you use HeySlide inside ChatGPT, Claude or another assistant, we receive only what the assistant sends to a HeySlide tool (for example, your question and the deck it is about), plus a conversation reference if the assistant provides one. We never receive the rest of your conversation.
  • Technical data: IP addresses, kept only as one-way hashes for rate limits; browser cookies (below); and logs and traces of how requests were handled, which leave out question and answer text by default.
  • Payments: handled by Stripe. We keep the Stripe customer and subscription identifiers and the plan, never card numbers.

Cookies

We use only the cookies HeySlide needs to work. There are no advertising or third-party tracking cookies.

  • hs_session: keeps you signed in (up to 30 days).
  • hs_recipient: lets you see your own questions and answers without an account.
  • hs_draft: lets you return to a deck you dropped before making an account (7 days).
  • hs_human: remembers that a bot check passed, for a few hours.
  • hs_oauth: used for a few minutes during Continue with Google.

Bot checks use Cloudflare Turnstile, which looks at signals from your browser to tell people from automated traffic. Cloudflare processes that data under its own privacy policy.

How we use it

  • To read decks and answer questions about them from the deck and its sources only.
  • To send a question to the deck’s author when the deck can’t answer it, and the reply back.
  • To sign you in, keep your file of questions, and send the emails you asked for or need.
  • To show a deck’s author what was asked and viewed on their decks.
  • To prevent abuse: rate limits, bot checks, spending limits and blocking throwaway email addresses.
  • To improve answer quality, using questions and answers to test changes. [CONFIRM SCOPE]

We do not sell personal information, and we do not use it for advertising.

Who sees what

  • The deck’s author sees the questions asked on their decks, the answers given and slides viewed. They see your name and email only if you signed in or opened a personal link sent to you.
  • The person a question is sent to sees that question, the answer you were shown and your message.
  • You see your own questions and answers in your file. Other recipients never see them.
  • Everyone, including search engines and AI crawlers: decks their creators choose to feature in the HeySlide Gallery, and the approved answers shown on those public pages, are public and may be indexed and used by search engines and AI systems. Featuring is off unless the creator turns it on.

Service providers

We share data with these providers only to run HeySlide:

  • Amazon Web Services: hosting, storage and email (United States).
  • Anthropic: reading decks and writing and checking answers (Claude).
  • OpenAI: search indexing of deck content (embeddings) and transcribing voice questions.
  • Stripe: payments.
  • Google: sign-in, if you choose Continue with Google.
  • Cloudflare: bot checks (Turnstile).

We use these model providers through their business APIs. [CONFIRM EACH PROVIDER’S CURRENT API DATA TERMS, INCLUDING TRAINING AND RETENTION, BEFORE PUBLISHING.]

How long we keep it

  • Accounts, decks, questions, answers and transcripts: kept until you ask us to delete them. We don’t yet delete them automatically after a set time; a retention schedule will replace this, and this policy will say so.
  • Voice recordings: deleted right after transcription; never stored.
  • Decks dropped without an account: deleted after 7 days if nobody claims them.
  • Rate-limit records: about two days.
  • Backups: up to 30 days, so deleted data can remain in backups for that long.

Your choices and rights

Email support@heyslide.example to get a copy of your data, correct it, or delete your account and what you asked or uploaded. Deletion is done by hand for now; we confirm when it is done, within [30] days. Depending on where you live you may have further rights, including to object or complain to a data protection authority. [ADD REGION-SPECIFIC SECTIONS AS ADVISED: GDPR/UK GDPR, CCPA/CPRA.]

If you are a recipient, the deck’s author also holds the questions you asked them. For a question about what an author did with your question, contact them, or us.

Security

Data is encrypted in transit and at rest. Sign-in links, codes, session and access tokens are stored only as one-way hashes. HeySlide has no passwords to leak.

Children

HeySlide is for work use and isn’t meant for anyone under [16].

Changes and contact

We will post changes here and, for significant ones, email account holders first. Questions: support@heyslide.example.