DeckShift Logo
privacy policy

Privacy policy

How Hekaton Labs, LLC collects, uses, shares, and protects personal data when you use DeckShift. Data controller: Hekaton Labs, LLC (Minnesota, USA).

1. Introduction

This Privacy Policy explains how Hekaton Labs, LLC ("Hekaton," "we," "us") collects, uses, shares, and protects personal data when you use DeckShift (the "Service"). It covers users in the United States and in the European Economic Area (EEA) and United Kingdom (UK). For most personal data, Hekaton is the controller. Where we process content a business customer uploads on behalf of its own end users, we may act as a processor for that customer under a separate data processing agreement.

2. Information we collect

  • Account data: name, email, password, organization, billing details. Payment card data is handled by our payment processor and is not stored by us. If you sign in with Google, Google shares your name, email address, and profile picture with us (Section 14).
  • Input content: the presentation files and materials you upload or import from Google Drive or Google Slides (Section 14), pages you send from the Chrome extension (Section 13), and what you enter or share into the phone app (Section 16), which may contain personal data you choose to include.
  • Generated output: the slides we produce for you.
  • Usage and device data: log data, IP address, browser and device information, and interactions with the Service, collected through cookies and similar technologies.

3. How we use information

  • To provide the Service: process your input content through AI models and return generated output to you.
  • To operate, secure, troubleshoot, and improve the Service.
  • To manage accounts, trials, subscriptions, and billing.
  • To communicate with you about the Service.
  • To develop and improve our models, insights engine, and sales-presentation trend analytics using de-identified and, where feasible, aggregated data, as described in Section 5.
  • To comply with law and enforce our Terms.

4. Legal bases (EEA/UK users)

Where GDPR or UK GDPR applies, we rely on: performance of a contract, to provide the Service you request; legitimate interests, to secure and improve the Service and derive anonymized insights, balanced against your rights; consent, where required (for example certain cookies, or where local law requires consent for training uses); and legal obligation, where we must process data to comply with law. Where we rely on consent, you may withdraw it at any time.

5. Anonymized training and trend analytics

We analyze uploaded content to improve our models and to identify trends in how presentations are structured and how people sell. We design this use to protect your identity and your confidential information:

  • Separation: your identity is separated from content before it enters our training and analytics environment.
  • De-identification: content may not be used for training or analytics until direct and indirect identifiers, such as names of people and companies, logos, contact details, and figures tied to identifiable deals, have been removed or masked.
  • Aggregation: trend insights are produced across many users' content and are not derived from, and are not intended to reveal, any single user's content, customers, or deals.
  • Purpose limits: our analytics concern presentation structure and selling techniques, never the identity of any person or company and never the substance of any specific transaction.
  • Google content excluded: content you import from Google Drive or Google Slides, and any other data we receive from Google, is never used for training or trend analytics (Section 14).
  • Opt-out: you can opt out of having your content used for model training and trend analytics at any time in account settings. Opting out stops future training and analytics use and does not affect the processing needed to deliver your output. Anonymized or aggregated data already incorporated into models or trend datasets may be retained.

6. How we share information

We do not sell your personal data for money. Where "sale" or "share" has a broad meaning under U.S. state laws, we honor opt-out rights as described in Section 9. We share information with:

  • AI model providers and infrastructure vendors that process content to deliver the Service. We never sell your content or give it to anyone to train AI models. A current subprocessor list is available from privacy@deckshift.app.
  • Service providers for hosting, analytics, payments, and support.
  • Legal and safety disclosures where required by law or to protect rights and safety.
  • Business transfers in connection with a merger, acquisition, or sale of assets, subject to this Policy.

7. International data transfers

We are based in the United States and process data there and in other countries where our providers operate. Where we transfer personal data from the EEA or UK to countries not deemed adequate, we use appropriate safeguards such as the European Commission's Standard Contractual Clauses and the UK Addendum.

8. Data retention

We keep account data for as long as your account is active and as needed for legitimate business and legal purposes. We retain raw input content only as long as needed to deliver generated output to you and for a limited period thereafter, after which we delete it or reduce it to de-identified or aggregated form. De-identified and aggregated data used for training and trend analytics may be retained on an ongoing basis. Backups are cycled on a rolling basis.

9. Your rights

EEA/UK (GDPR): you have the right to access, correct, delete, restrict, or object to processing of your personal data, to data portability, and to withdraw consent where processing is based on consent. You may also lodge a complaint with your local supervisory authority.

United States (including California): depending on your state, you may have the right to know, access, correct, and delete your personal data, to opt out of "sale" or "share" and certain profiling, and to be free from discrimination for exercising these rights. California residents may exercise these rights, including through an authorized agent.

To exercise your rights: manage your training and analytics preference in account settings. For other requests, contact privacy@deckshift.app. We verify and respond within the timeframes required by law.

10. Security

We use administrative, technical, and organizational measures designed to protect personal data, including encryption in transit, access controls, and separation of identity from content in our training environment. No system is perfectly secure, and we cannot guarantee absolute security.

11. Children

The Service is not intended for anyone under 16, and we do not knowingly collect personal data from children under 16. If we learn we have done so, we will delete it. If you believe a child has provided us personal data, contact privacy@deckshift.app.

12. Cookies and how we measure this site

We measure this site in two layers, and the difference matters to you.

The first layer stores nothing on your device. Our own server counts each page view under a random identifier built from your network address and browser, salted with a secret that changes every day. Because the salt changes daily, the same visitor tomorrow is a different identifier, and nothing in this layer can be traced back to you or built into a profile. We keep the country, not the address. This runs for everyone and needs no cookie, so there is nothing to consent to.

The second layer is the detailed one, and it does use cookies and similar storage to recognize a returning browser and follow a journey across pages. It includes recordings of how pages are used, with anything you type hidden. The same identifier carries into the DeckShift app, and if you sign up, this history is linked to your account by its account number, never by your name or email address. In the EEA, the UK, and Switzerland we ask before any of it starts, and nothing is stored until you agree. In the United States it runs unless you turn it off, which you can do below or at any time from the footer of any page. Everywhere else we ask first, the same as in Europe.

We honor Global Privacy Control and Do Not Track. If your browser sends either signal, the detailed layer stays off and no choice below can override it.

When you arrive through an affiliate link, a cookie lets the person who referred you get credit if you sign up. It lasts 90 days and follows the same choice as the detailed layer: where we ask first, it is only stored after you agree, and turning measurement off removes it. We also keep your choice below, so we do not have to ask again.

your choice

Detailed analytics on this site

Checking your current setting.

13. The DeckShift Chrome extension

The DeckShift extension for Google Chrome reads a web page only when you click its toolbar icon on that page. It reads the page's visible text, title, and address. It skips form fields, passwords, scripts, and content the page hides. If you highlight part of the page, it reads that part alone.

Nothing leaves your browser until you press the send button in the extension's popup. When you do, the extension sends the page's text, title, and address to your DeckShift account, where it becomes the prospect notes for a new deck. We handle that text as input content under this Policy.

The extension keeps two things on your computer, in Chrome's extension storage: your signed-in session, and a list of the pages you have sent, by site, time, and size. Signing out removes the session. The extension does not record your browsing history, does not run on pages you have not clicked it on, and does not sell or share what it reads with anyone other than the providers in Section 6 that run the Service.

14. Google user data

DeckShift connects to your Google account in two ways, and asks Google only for what each one needs.

  • Sign in with Google: Google shares your name, email address, and profile picture with us. We use them to create your account, recognize you when you sign in, and show who you are inside DeckShift.
  • Google Drive and Google Slides: when you import a deck from Google or save one to Google, we ask for Google's drive.file permission. It lets DeckShift open only the files you choose in Google's file picker and the files DeckShift creates for you. We cannot see anything else in your Drive. We use this access only to import the deck you chose and to save the deck you asked us to save.
  • No stored Google credentials: each import or save uses a short-lived access token that expires within an hour. We do not request offline access, and we do not store your Google tokens.
  • Imported decks: a deck you import from Google becomes input content in your DeckShift account, handled under this Policy, including Section 8 on retention.

15. Limited Use of Google data

DeckShift's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. In particular:

  • We use Google user data only to provide the features you use, as described in Section 14.
  • We do not use Google user data, or content imported from Google Drive or Google Slides, to develop, improve, or train generalized AI or machine learning models, including the training and trend analytics in Section 5.
  • We do not sell Google user data, use it for advertising, or use it to determine creditworthiness or for lending.
  • We transfer Google user data only to the providers in Section 6 that run the Service and only as needed to provide the feature you used, or where the law requires it.
  • Our staff do not read Google user data unless you ask us to, it is needed for security purposes such as investigating abuse, the law requires it, or it has been aggregated and anonymized for internal operations.
  • You can remove DeckShift's access to your Google account at any time at https://myaccount.google.com/permissions.

16. The DeckShift phone app

The DeckShift app for iPhone and Android uses the same account as the website. You can sign in with Apple, Google, or Microsoft. If you sign in with Apple and choose to hide your email address, Apple gives us a private relay address that forwards to you, and we use that address as your account email.

The app sends us what you give it: the prospect website or notes you type or share into it from another app, the deck you pick or upload, and the email addresses you ask it to send a deck to. When you upload a deck, your phone's own file picker shows you your files, and the app receives only the file you choose. We handle all of this as input content under this Policy.

If you allow notifications, the app gives us a push token for your device so we can tell you when a deck is ready. Signing out of the app removes that token from your account. We do not use notifications for advertising.

The app keeps your signed-in session in your phone's secure storage. It does not read your contacts, photos, location, or browsing history, and it contains no advertising or third-party tracking code.

You can delete your account in the app: tap Sign out at the bottom of your deck library, then Delete account. Deleting closes the account and signs you out. For 90 days, signing back in restores it. After 90 days we permanently delete your decks, uploads, and account. Billing records stay with our payment processor, because tax law requires them. If you want your data gone sooner, email privacy@deckshift.app.

17. Changes to this policy

We may update this Policy from time to time. For material changes, we will provide notice, for example by email or in-app, before they take effect. We will not apply materially new uses of previously collected personal data retroactively without a lawful basis or, where required, your consent.

18. Contact us

Hekaton Labs, LLC, Minnesota, USA. Privacy questions: privacy@deckshift.app.