Privacy Policy
1. Scope & Definitions
This Privacy Policy describes how Deckly ("we," "us," or "our") collects, uses, and protects your information when you use our pitch deck management services, web applications, and related APIs (the "Service").
By accessing the Service, you consent to the data practices described in this policy. We prioritize data minimization, meaning we only collect what is strictly necessary to provide a functional and high-performance content experience.
2. Information Collection
A. Information You Provide
Includes account registration details (Email, Name), payment information (handled by third-party processors), and any content you upload, such as PDF assets, metadata, and data room configurations.
B. Automatically Collected Data
We collect technical data to ensure Service stability, security, and to provide analytics. This includes browser types, device identifiers, and interaction events (pages viewed, duration, saves).
- IP Addresses & Location: IP addresses are used for security (rate limiting), approximate geographic location, and fraud prevention. Raw IP addresses are not stored in our analytics database beyond what is necessary for these purposes. When viewers access shared documents, we collect approximate geographic location data (country and city) derived from IP addresses to provide location analytics to document owners.
- Viewer Email Collection: When document owners require email verification for access, we collect the viewer's email address and associate it with their viewing session for reporting to the document owner.
- Visitor Tracking: We use a randomly generated identifier stored in your browser's local storage to distinguish unique document views and prevent analytics inflation. This identifier is not linked to your identity unless you provide your email address.
3. Data Sharing & Third Parties
We do not sell data. Information is shared only as described below under strict confidentiality agreements:
Document Analytics Sharing
Viewing data including pages viewed, time spent, approximate location, and email address (if provided) is shared with the owner of the document being viewed. By accessing a shared document, viewers consent to this data collection and sharing.
4. Your Global Rights (GDPR/CCPA)
Users have administrative controls to manage their privacy:
- Access & Portability: Request a copy of all data stored in your account profile.
- Correction: Modify your account information at any time via Settings.
- Deletion: Delete your account and associated documents permanently from our systems.
5. Retention & Security
Account Data: We retain data only as long as an account is active. Upon account deletion, we purge user-specific data from production databases within 30 days.
Analytics Data: Analytics data (page views, engagement metrics) is retained for the lifetime of the associated document. When a document is deleted, all associated viewing data is permanently removed within 30 days.
Security: Data is protected via database-level Row Level Security (RLS) policies, encrypted storage volumes, and strict environment isolation.
6. Cookies & Analytics (PostHog)
We use PostHog, a third-party analytics suite, to collect information about how you interact with our platform to improve Service stability and feature development.
PostHog is configured in cookieless mode using memory-only persistence. This means we avoid tracking you across different browsing sessions with persistent non-essential cookies. We do not use this analytics data for cross-site behavioral advertising. Local storage is used minimally for functional session continuity within the application.
7. Children's Privacy
Our Service is not directed to individuals under the age of 18 (or the applicable legal age in your jurisdiction). We do not knowingly collect personal data from children. If we become aware of an unauthorized registration by a minor, we will delete their information immediately.
8. International Data Transfers
Your information is processed on servers located in various global jurisdictions, primarily in India and the United States. We rely on our infrastructure providers' (Supabase, Vercel) data transfer mechanisms and Data Processing Agreements (DPAs) to ensure appropriate safeguards for international transfers.
9. Compliance & Updates
Data Breach Notification: In the unlikely event of a security breach involving your personal information, we will notify you and relevant regulatory authorities without undue delay, typically within 72 hours of discovery.
Changes to Policy: We may update this policy periodically to reflect changes in our Service or legal environment. Significant updates will be communicated via email or a prominent notification within the application.
Contact
For data requests, privacy concerns, or questions regarding our privacy standards, please contact our team.
privacy@deckly.space