Privacy Policy

Introduction

This Privacy Policy explains how Deckary ("we", "us", "our") collects, uses, and shares information when you use the Deckary add‑ins and supporting services such as deckary.com (collectively, the "Services"). We are based in the Netherlands and process personal data in accordance with the EU General Data Protection Regulation (GDPR).

Scope and Service Description

Deckary provides add‑ins for Microsoft PowerPoint (Microsoft 365) and Google Slides (Google Workspace), a browser-based presentation builder, and an MCP connector for external AI agents. Content in an Office or Google file remains in that environment unless you use a feature that sends selected content to Deckary or another provider. Saved Web Builder presentations and slide-library content are stored by Deckary. When you explicitly share a live PowerPoint presentation through MCP, presentation state and rendered slide images pass through Deckary's services for the active session. The website also provides account management, billing, and support.

Policies on Personal Information

Personal information is only collected for clearly defined purposes, stored using industry‑standard security practices, and deleted or anonymized when it is no longer required. We do not use personal information for advertising or sell it to third parties. Access to production data is restricted to staff who need it to operate Deckary or billing systems, and all processors are bound by written agreements.

Who We Are

Deckary is a productivity suite for consultants. For questions about this policy or your data, please contact us via the contact form at deckary.com/contact or email [email protected].

What We Collect

We collect information in the following contexts:

Website

• Contact details you submit via forms (e.g., name, email, message).
• Usage data such as pages viewed, device/browser information, and approximate location derived from IP address.
• Cookies and similar technologies to remember preferences and improve performance.

Add‑in

• Account identifiers to authenticate and authorize your access.
• Subscription status to determine feature access.
• Content-free product events such as a successful chart insertion or completed AI action, and separate operational error logs.
• AI prompts and instructions you provide when using AI features (not stored by Deckary — see AI Features section).
• Selected Excel cell data and source details when using Excel linking (optional — see Excel Linking section).
• Saved slide content when using the slide library (optional — see Slide Library section).

Helper Application

• The helper is a desktop app that registers keyboard shortcuts. It communicates with the add‑in via a WebSocket relay.
• Account identifiers for authentication.
• Diagnostics and error logs to maintain reliability and security.

Web Builder and MCP Connector

• Saved Web Builder presentation content, themes, assets, restore points, and rendered or exported artifacts.
• Account identifiers and OAuth permissions used to authorize saved-deck and live-PowerPoint access.
• MCP tool arguments and results needed to list, read, inspect, render, or edit the presentation you select.
• For a live PowerPoint session, presentation structure, editable object data, and requested slide images after you turn on MCP sharing in the add‑in.

Data Retention

MCP Connector Data Handling and Retention

Deckary's MCP connector lets an external AI agent you choose work with presentations in your Deckary account. The connector receives only the tool calls that the agent sends to Deckary; it does not receive the agent's unrelated conversation history, memory, or files. The external agent receives the presentation data and images returned by the tools you authorize, and that provider's privacy and retention terms apply to its copy of that data. Deckary's MCP server does not select or invoke an AI model for these tool calls.

Saved Web Builder presentations

MCP can read, render, and edit owner-scoped Web Builder presentations. Their slide content, themes, assets, restore points, and generated artifacts are stored with your Deckary account. Changes made through MCP are saved in the same way as changes made in the Web Builder and remain available for the duration of the account. Deleting a presentation removes it from active use; all associated account data is purged within 30 days after account deletion.

Live PowerPoint presentations

Live PowerPoint tools work only after you sign in to the Deckary add‑in, turn on MCP sharing, and keep the sharing session connected. Deckary relays the requested presentation state, editable object data, commands, and slide renders between the external agent and the add‑in. The relay holds live-session and pending-command state in memory and removes it when the connection ends. The MCP connector does not persist this live presentation content or its renders as a saved Web Builder presentation.

MCP analytics

When analytics consent applies, Deckary records a bounded product event for an MCP tool call: the tool name, duration, outcome, bounded error code, result byte counts, and image counts. These events do not include deck identifiers, presentation titles, prompts, authoring programs, slide content, rendered images, or raw errors.

AI Features

If you use AI features, your prompts and requested source material are sent through OpenRouter over an encrypted connection to the model provider selected for that feature. We do not store prompts or responses.

• Training restriction: For text, vision, and research requests, Deckary asks OpenRouter to route only to endpoints whose published data policy denies data collection. Image-generation retention follows the selected endpoint's published policy.
• OpenRouter prompt logging: Deckary does not opt in to OpenRouter input/output logging.
• Model providers: The selected provider processes the request for inference and its endpoint-specific retention policy applies.

AI image generation uses the same OpenRouter path. Only the text description and image options you provide are sent for a new image; slide content is not added unless it is part of that description.

Excel Linking (Optional)

If you use Excel‑to‑PowerPoint chart linking:

• When you create or refresh a link in Excel, the selected source range's cell values and source details (including workbook name, sheet name, and range address) are stored on our servers for use in PowerPoint charts.
• Data is encrypted in transit (TLS) and at rest (AES‑256).
• Published data remains available after Excel closes and does not expire automatically. Cell edits are published when you refresh the link in Excel.
• Only accessible to your account.
• Deleting a link stops future linked updates but does not automatically erase its stored source details or cell data. Contact us to request deletion of stored data.
• Unlinking a PowerPoint chart does not delete the source stored by Deckary. Existing chart data remains in your presentation after unlinking or deleting its source link.

If your data policies prohibit this, you can use Deckary without Excel linking — charts can be created with manual data entry instead.

Slide Library (Optional)

Users can save slides to a personal library for reuse across presentations. If you use this feature:

• Slide content (shapes, text, images) is stored on our servers linked to your account.
• Data is encrypted in transit (TLS) and at rest (AES‑256).
• Only accessible to your account.

If your data policies prohibit this, the slide library feature can be disabled. All other Deckary features work without it.

Google API Services User Data Policy

Deckary's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

The use of raw or derived user data received from Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements.

Google Slides Charts (Optional)

If you use the Deckary Google Slides add‑in to insert or edit charts:

• Deckary creates a single private Google Sheets file in your Google Drive (using the drive.file scope) to hold the chart's data ranges and chart specification. The file stays in your Drive under your account.
• Deckary writes chart data and configuration to that Sheets file (using the spreadsheets scope) so the chart embedded in your slide stays linked and editable.
• Deckary only accesses the Sheets file it creates. It does not read, modify, or list any other Sheets, Docs, or Drive files in your account.
• You can delete the backing file at any time. Charts that depended on it will display their last‑rendered state.
• Chart data values you include in AI prompts (e.g., "Jan 100, Feb 120") are also processed by the selected model provider through OpenRouter as part of the prompt — see the AI Features section.

Purposes of Processing

• Provide, operate, and improve the Services.
• Authenticate users and secure accounts.
• Process payments and manage subscriptions.
• Deliver AI‑powered features you request.
• Communicate with you, including support and service notices.
• Analyze usage to improve performance and usability.
• Detect, prevent, and investigate fraud, abuse, and security incidents.
• Comply with legal obligations.

Legal Bases (GDPR)

• Performance of a contract (to provide the Services you request).
• Legitimate interests (to secure, improve, and market our Services in a proportionate manner).
• Consent (for optional cookies/analytics or certain AI processing where required).
• Legal obligation (to meet compliance and tax requirements).

Cookies

We use necessary cookies to operate the site and, where consented, optional cookies for analytics and performance. You can manage cookie settings in your browser and, where applicable, in our cookie banner.

Analytics

With your consent, we use PostHog Cloud EU for pseudonymous website and product analytics. We record bounded page, acquisition, product-entry, and successful-value events under an account identifier; we do not send email addresses, prompts, document content, filenames, local paths, or raw errors. Session replay, broad click autocapture, and stored IP addresses are disabled.

Data Sharing and Subprocessors

We share data with trusted service providers who process data on our behalf:

These providers are engaged under data processing agreements and are obligated to handle data securely and only according to our instructions. We do not sell your personal data.

International Transfers

Where personal data is transferred outside the European Economic Area, we rely on appropriate safeguards such as the EU Standard Contractual Clauses and implement additional measures where necessary.

Your Rights (GDPR)

• Access your personal data and obtain a copy.
• Rectify inaccurate or incomplete data.
• Erase data (right to be forgotten) where applicable.
• Restrict or object to certain processing.
• Data portability.
• Withdraw consent where processing is based on consent.
• Lodge a complaint with a supervisory authority, including the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

To exercise your rights, contact us via the form at deckary.com/contact or email [email protected]. We may need to verify your identity before responding to your request.

Security

We implement technical and organizational measures designed to protect personal data, including encryption in transit (TLS 1.2+) and at rest (AES‑256), OAuth 2.0 authentication, and access controls based on the principle of least privilege. A full security brief is available on request — email [email protected].

Children

Our Services are not directed to children under 16. If you believe a child has provided personal data to us, please contact us to request deletion.

Changes to This Policy

We may update this policy from time to time. Material changes will be communicated via the website or by email where appropriate.

Contact

Questions or requests? Contact us via the form at deckary.com/contact or email [email protected].