This DPA describes how PresentSmart AI processes personal data on behalf of institutional customers (Data Controllers) when delivering the AI presentation generation service. It supplements our Terms of Service and reflects the requirements of applicable data-protection law.
PresentSmart AI processes (i) end-user account data — email address and authentication credentials; (ii) source content the user uploads or pastes — text, slides, transcripts, images — solely to generate the requested presentation outputs; and (iii) usage telemetry strictly required to operate the service. Processing lasts for the duration of the customer relationship and ends when the account is closed or the data is deleted at the user's request.
PresentSmart AI relies on a small set of vetted sub-processors, each bound by appropriate data-protection terms: OpenAI (model inference and audio generation); Google Cloud / Vertex AI (image and vision processing); ElevenLabs (voice cloning and text-to-speech, only when the customer opts in); Stripe (payment processing). The current list is published and updated on this page; we will provide reasonable advance notice of any new sub-processor.
All data is encrypted in transit using TLS 1.2 or higher. Uploaded source files are deleted from our servers immediately after the generation pipeline completes — typically within seconds. Account credentials are stored as salted password hashes, never in plaintext. Access to production data is limited to the engineering team on a need-to-know basis under role-based access controls. Security-relevant events are logged and reviewed regularly.
Users can export all data we hold about them at any time via /export-my-data and request permanent deletion via /delete-account. Both endpoints are available from the user's account and complete within minutes. We support the rights of access, rectification, erasure, restriction, portability and objection that apply under the data-protection law of the user's jurisdiction.