Privacy Policy

1. Who Is Responsible for Your Data

The controller of personal data processed through DeckRage is:

Momentum Ventures s.r.o.
Jičínská 226/17, 130 00 Prague, Czech Republic
Registered with the Municipal Court in Prague, file C 282366
Company ID (IČO): 06448798
VAT ID (DIČ): CZ06448798
Email: support@deckrage.com

When a company buys DeckRage and invites employees or contractors into a workspace, that company typically decides why decks are uploaded and who may see them. In that situation we act as a processor for the content and workspace data the company instructs us to process, and as a controller for our own account, billing, security, and product-operation data. Business customers can request a Data Processing Agreement (DPA) at the email above.

2. Data We Collect

• Account and profile data — email address, name (if provided), password (stored as a hash), account settings, and language or region preferences.
• Workspace and team data — organization or workspace name, seat assignments, roles (admin or member), invitations, and which workspace an analysis belongs to.
• Uploaded files and extracted content — presentation files and context documents you upload (for example PPTX or PDF), and the text, images, structure, and thumbnails we extract for analysis.
• Analysis results — AI-generated feedback, scores, speaker notes, and related artifacts tied to an account or workspace.
• Billing data — plan, purchase and invoice history, payment status, tax location, and billing email. Card details are collected and stored by Stripe, not by us.
• Usage and security logs — IP address, browser or device information, timestamps, and actions taken, used for security, debugging, quota enforcement, and abuse prevention.
• Support communications — emails and attachments you send to support@deckrage.com.

Without an email and the files you want reviewed, we cannot provide the core Service.

3. Why We Process It and Legal Bases

• Performance of a contract (Art. 6(1)(b) GDPR) — creating and securing your account, storing and analyzing files, showing results, managing seats and quotas, processing payments, and providing support.
• Legitimate interests (Art. 6(1)(f)) — keeping the Service secure, preventing fraud and abuse, diagnosing errors, understanding feature use in aggregate, and establishing, exercising, or defending legal claims. You may object to processing based on legitimate interests.
• Legal obligation (Art. 6(1)(c)) — tax and accounting records, and responding to lawful requests from authorities.
• Consent (Art. 6(1)(a)) — only where we ask for it. We do not use advertising cookies and do not currently run marketing emails as part of the core product.

We do not use your content or personal data for advertising. We do not sell personal data. The Service is not designed for systematic processing of special-category data. If you upload sensitive material, you must have a lawful basis to do so.

4. Team Workspaces

• Admins can see member lists, roles, usage against the shared analysis quota, and content stored in that workspace.
• Members can upload decks that other authorized workspace users may be able to open, depending on permissions offered at the time.
• Inviting someone shares their email with us so we can deliver the invite and attach them to the workspace.
• Removing a member ends their access. It does not automatically delete files or results they uploaded. The workspace owner must delete that content if they want it removed.
• The organization that owns the workspace is responsible for telling its users that DeckRage is used, and for only inviting people it is allowed to invite.

As between you and your employer, ownership of a work deck is a matter for that relationship. As between you and DeckRage, the Terms apply: you keep intellectual property in what you upload; we receive only a license to process it to provide the Service.

5. Where Your Data Is Stored

Account data, uploaded files, and analysis results are stored on servers located in the United States, on infrastructure rented from Vultr (The Constant Company, LLC). The operator of DeckRage remains Momentum Ventures s.r.o. in the Czech Republic.

Personal data transferred outside the EEA (and, where relevant, the UK) is safeguarded with the European Commission’s Standard Contractual Clauses and technical measures such as encryption in transit and access controls. Other US-based providers are listed in Section 6. UK transfers rely on the UK International Data Transfer Addendum or another UK-approved mechanism used by the relevant provider.

6. Service Providers (Subprocessors)

We share personal data only with these providers, strictly to operate the Service:

We may replace a provider with another that performs the same function. For a material change to who processes uploaded deck content, we will update this Policy and, where required, notify customers in advance.

7. AI Processing, No Grounding, and No-Training Commitment

To generate feedback we send extracted text and related content from your uploads to Google’s paid Gemini API on a billed Google Cloud project.

What DeckRage does

• We do not use your uploads, extracted content, or analysis results to train DeckRage models.
• We use only Gemini Paid Services. We do not use the unpaid Gemini / Google AI Studio quota for customer analyses.
• We do not enable Google AI Studio log contribution or dataset sharing.
• We do not enable Grounding with Google Search, Grounding with Google Maps, or comparable web-retrieval tools. Deck analysis is performed against the uploaded file, not by searching the public web. That means the extra 30-day grounding store described in Google’s Search-grounding terms does not apply to the Service as configured.

What Google may still do on Paid Services

Google’s published paid-API terms state that prompts and responses are not used to improve Google’s products. Google may still log prompts and responses for a limited period to detect abuse and to meet legal duties. Data may be processed or cached in countries where Google operates. Those activities are Google’s, under Google’s terms.

What we cannot promise

We cannot guarantee that Google (or a future AI provider) will never train on or retain your content if Google changes its terms, suffers a breach, or if you separately submit the same material to a consumer Gemini product. Those risks are inherent in using a third-party model. By uploading a file you accept that extracted content will be processed by the AI provider. If your organization forbids that, do not upload the file.

Business customers who need a stricter written commitment (for example Vertex AI and a customer DPA) should contact support@deckrage.com before sending highly sensitive IP.

8. How Long We Keep Your Data

Limited copies may remain in encrypted backups until those backups are overwritten.

9. Your Rights

Under the GDPR (and UK GDPR where it applies) you may have the right to access your data, have it rectified or erased, receive it in a portable format, object to or restrict processing based on legitimate interests, and withdraw consent where processing is based on consent.

Email support@deckrage.com to exercise these rights. We may need to verify the request. If you use a company workspace, some requests (especially deletion of shared decks) may need to go through the workspace admin, because that company may be the controller of that content.

You may lodge a complaint with the Czech data protection authority — Úřad pro ochranu osobních údajů (UOÚ), uoou.gov.cz — or with the supervisory authority in your country of residence.

10. Account and Workspace Deletion

Request deletion of your account and associated personal data at support@deckrage.com. We complete deletion within 30 days, except data we must keep by law (such as invoices) until that period ends.

Deleting your personal account removes you from workspaces you belong to. It does not delete the company’s workspace or content other members still need. A workspace admin can request deletion of the whole workspace.

11. Cookies and Local Storage

We do not use analytics or advertising cookies. The Service uses only strictly necessary storage: your authentication session in the browser (Supabase Auth), and Cloudflare Turnstile tokens to protect signup and login from bots. If we later add non-essential cookies, we will update this Policy and request consent where required.

When Turnstile is used, Cloudflare processes client-side signals such as IP address, TLS fingerprint, user-agent, sitekey, and origin to distinguish humans from bots, and may use those signals to improve Turnstile. See Cloudflare’s Turnstile Privacy Addendum.

12. Security

We protect data with encryption in transit (TLS), private storage buckets that are not publicly accessible, role-based access controls, hashed passwords, and continuous error and security monitoring. No system is perfectly secure. If a breach is likely to result in a high risk to your rights, we will notify you and the competent authority as required by law.

13. Children

The Service is intended for users aged 18 and over. We do not knowingly collect personal data from children. If you believe a child has created an account, contact us and we will delete it.

14. Automated Decisions

AI scores and feedback are tools for you to review. They are not used to make legal or similarly significant decisions about you (Art. 22 GDPR) such as credit, hiring, or access to essential services. Do not use DeckRage output as the sole basis for such a decision about another person.

15. Changes to this Policy

We may update this Privacy Policy from time to time. For material changes we will notify you by email or an in-app notice before they take effect. The “Last updated” date at the top of this page shows the current version.

16. Contact

Momentum Ventures s.r.o., Jičínská 226/17, 130 00 Prague, Czech Republic — support@deckrage.com.

Privacy requests, DPA requests, and security notices can use the same address.