Privacy Policy

1. Who we are

Decks Studio (Decks.Studio) is provided by Omni Media & Tech Ltd, registered in England & Wales. For users in the Kingdom of Saudi Arabia, the service is operated by Omni Media And Tech LLC (Commercial Registration No. 7054312215). Together we are the controller of your personal data.

This policy explains what personal data we handle when you use Decks Studio, why, and the choices and rights you have. Your decks and documents remain yours — this policy is about the limited personal data we need to run the service.

Questions, or to exercise your rights: [email protected].

2. The personal data we collect

From you, when you create an account and use the service:

• Account data: your email address, your name, and — if you provide them — your phone number and company/organisation name.
• Profile data: optional onboarding answers (role, team size, primary work, referral source) and, for résumé documents, a profile photo you upload.
• Authentication data: a securely hashed password, or — if you use Google or Apple Sign-In — the verified email (and name) those providers return.
• Consent record: the date/time you accepted the Terms and this Privacy Policy, the policy version, and whether you opted in to marketing email.
• Content you submit: the text, links and files you provide; the decks/documents we generate; their PDFs; and logos/images you upload. This content can contain third-party personal data — where it does, you are the controller and we process it on your instructions.
• E-signatures: when you send a document for signature, we collect the signer's name, email, typed or drawn signature, and — for the audit trail — their IP address and browser user-agent at signing.
• Billing data: your plan, subscription status, and the customer identifiers Paddle issues. We do NOT collect or store your card details — Paddle does.
• Technical data: access logs for decks and documents (including a hashed viewer IP to count and rate-limit views), device/browser info, and security logs.

3. Why we use it, and our legal basis

We process your personal data for these specific, clear and explicit purposes:

• Create your account and provide the service — Performance of a contract
• Generate, store, render and share your decks/documents — Performance of a contract
• Capture e-signatures and keep a signing audit trail — Contract / legitimate interests
• Process subscriptions and invoices (via Paddle) — Contract / legal obligation
• Keep the service secure, prevent abuse, fix problems — Legitimate interests
• Measure view activity on shared decks/documents for the sender (opens, time, per-slide, coarse country; salted IP hash anonymised after 90 days) — Legitimate interests
• Send service emails (verification, reset, receipts) — Performance of a contract
• Send product/marketing email — Consent (opt-in; withdraw any time)

4. Who we share it with (processors)

We share personal data only with the service providers we need to run Decks Studio, each under contract and only for the purposes above:

• Anthropic (Claude) — AI generation/refinement of your content (United States).
• Google (Gemini) — AI generation/translation/refinement (United States).
• OpenAI — speech-to-text (Whisper) for voice input (United States).
• Paddle — billing & merchant of record (payments, invoices, tax).
• Resend — sends our transactional and service emails.
• Cloudflare (R2) — object storage for your files, images, logos, profile photos and rendered PDFs.

5. International transfers

Decks Studio is hosted in the European Union (Frankfurt, Germany), where your account data and content are stored at rest. To generate and refine your content, we send the relevant content to our AI providers in the United States (Anthropic, Google, OpenAI).

Where we transfer personal data outside the Kingdom of Saudi Arabia, the UK or the EU, we rely on appropriate safeguards (such as Standard Contractual Clauses and the providers' data-protection commitments) and on any applicable adequacy decisions.

6. How long we keep it

We keep personal data only as long as we need it:

• Account & content: for as long as your account is active.
• Deck & document access logs and raw IP addresses: 90 days, then deleted.
• Transactional email bodies: 90 days, after which we null the body but keep the minimal metadata row.
• E-signature signer IP and user-agent: 12 months, then purged. The signer's name, email and signed status are kept for as long as the document exists, because they evidence the validity of the signed contract.
• Orphaned data (rows whose owner has been removed): swept daily.
• Billing records: kept as required by applicable tax/accounting law.
• After you delete your account or we erase your data: we permanently delete your personal data, including files and PDFs in storage, within 30 days. Share links you've already distributed may stop working.

7. How we protect your data

All traffic between you and Decks Studio is encrypted over HTTPS. Passwords are stored only as salted hashes, never in plain text. Access to personal data is restricted to what's needed to run the service.

If a personal data breach occurs, we will notify the relevant authority (SDAIA within 72 hours under PDPL, and the ICO where UK GDPR applies) and affected users where required.

8. Your rights

Subject to applicable law (Saudi PDPL and UK/EU GDPR), you can:

• Access the personal data we hold about you — download it yourself any time from Account → Privacy → Export my data, or ask us.
• Correct inaccurate data (edit your profile, or ask us).
• Delete / erase your data — from Account → Delete account, which triggers permanent deletion within 30 days.
• Restrict or object to certain processing.
• Receive a portable copy of your data (our export is machine-readable JSON).
• Withdraw consent where we rely on it — turn off marketing email any time from Account → Privacy, with no effect on the service.

9. Complaints

If you're unhappy with how we handle your data you can complain to your regulator:

• Saudi Arabia: the Saudi Data & AI Authority (SDAIA) — sdaia.gov.sa.
• United Kingdom: the Information Commissioner's Office (ICO) — ico.org.uk.

10. Cookies & local storage

Decks Studio keeps you signed in using browser local storage (a sign-in token), not advertising cookies. We also store one strictly-functional preference in local storage — your interface language (decks_studio.ui_lang). We do not use third-party advertising cookies. View analytics on shared decks/documents needs no cookie: it runs under legitimate interest with only a salted, anonymised IP hash.

11. Children

Decks Studio is not intended for children under 16, and we do not knowingly collect their personal data.

12. Changes to this policy

We may update this policy from time to time. If a change materially affects your rights we will give reasonable notice (by email and/or an in-app notice) before it takes effect, and update the version below. The "Last updated" date always reflects the current version.

13. Contact

Omni Media & Tech Ltd / Omni Media And Tech LLC — [email protected].