Privacy Policy

Effective date: 2 October 2026  ·  Previous version: 1 June 2025

1. Who we are

slideAcross is a trading name of Affirmable Limited, a company registered in England and Wales (company number 14461956). Our registered office is 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ. In this policy, "we", "us" and "our" mean Affirmable Limited.

This policy covers slideacross.com, the slideAcross web app, the dataLayers features inside it, and the emails and support we provide. It applies to visitors, registered users, and people who receive or view presentations shared through slideAcross.

Our role: controller and processor

• We are the controller of the data we need to run your account and our business. This includes your profile, sign-in details, billing records, support messages, security logs and website analytics.
• Your organisation is the controller of the content its members put into slideAcross. This includes presentations, uploaded documents, content libraries, data from spreadsheets and connected sources, and the people it shares them with. We process that content on the organisation's behalf and only to provide the service. Our Terms and Conditions set out our commitments as a processor. Business customers can ask us for a data processing agreement.

If you use slideAcross through an employer or another organisation, you may need to ask that organisation about its own use of your data. We will help them answer you.

2. Information we collect

a. Account and profile

• Your name, email address and password. We store passwords only as a one-way hash, so we can never see them.
• The organisations, departments and teams you belong to, your role in each, and the presentations shared with you.
• Your settings and preferences, such as homepage order, default designs and email choices.
• Organisation settings set by admins, such as brand colours, fonts, logos, time zone, AI supplier choices and data permission rules.

b. Signing in with Google, Apple or LinkedIn

If you sign in with one of these providers, we receive your name, your email address and confirmation that the provider has verified it. We record which sign-in methods you use. We don't receive your password for those accounts, and we don't get access to your contacts, files or posts.

c. Billing

Payments are handled by Stripe. We keep your plan, the number of licences, your subscription status and the Stripe references that link your account to your payments. Stripe holds your card details and billing address. Card details never pass through or get stored on our servers.

d. Content you create or upload

• Presentations, slides, speaker notes, comments, images, designs and slide masters.
• Documents you upload to build slides or content libraries, such as PDF, Word, PowerPoint, Excel and CSV files, along with the text, images and figures we extract from them.
• Web pages you ask us to read. We fetch the page and keep the text we extract from it.
• Restore points, which are earlier versions of your slides kept so you can roll back changes.

This content can include personal data about other people, such as names in a sales report. You and your organisation are responsible for having the right to upload it.

e. dataLayers data

• Rows and columns from spreadsheets you upload, links you import, and connected sources.
• For connected sources, we store the sheet or file reference, the refresh schedule, and a copy of the rows captured at each refresh. That copy builds up history over time.
• Template settings, including which people, departments or organisations receive each refreshed copy, and anyone who has opted out of those emails.
• Data permission rules that decide who can see which rows.

f. Connected Google and Microsoft accounts

When you connect a Google or Microsoft account to dataLayers, we store that account's email address and the access tokens the provider gives us. We use these tokens to read the sheets and files you choose. A connected account always belongs to you, not to your organisation. Section 5 explains more.

g. Conferencing

If you use the built-in video conferencing, the call runs on 8x8's Jitsi as a Service platform. We create the meeting and pass on the display name you join with. 8x8 processes the audio and video to run the call. slideAcross doesn't store the audio or video of calls.

h. Communications

We keep messages you send through our contact form, by email or through support, along with our replies.

i. Technical and usage data

• Server and security logs: IP address, browser and device type, the pages and actions requested, timestamps and errors. We use these to keep the service running, to stop abuse such as repeated failed logins, and to fix problems.
• Website analytics: how visitors find and use our public website. Section 11 explains this.

3. How we use it and why

UK data protection law requires a lawful basis for each use of personal data. The table below sets ours out.

We don't sell personal data, use your content for advertising, or make decisions about you that have legal or similarly significant effects using automated processing alone.

4. AI features

Some features use generative AI to write slide text, summarise documents, create images or describe data. When you use one of these features, we send the relevant input to the AI supplier your organisation has chosen. That input can include your prompt, the slide content, extracts from your content library, or a summary of the data behind a chart.

• Suppliers: OpenAI and Google (Gemini). Organisation and department admins choose which supplier is used for text, images and data, and can decide whether individual presentations may choose differently.
• No training on your content: we use these suppliers through their paid business services. Under those terms, they may not use your inputs or outputs to train their models. They may keep inputs for a short period to detect abuse, under their own retention rules.
• No AI option for data: dataLayers can write chart summaries with its own built-in language engine instead of AI. With this engine, no data leaves our servers to produce the text.
• Check the results: AI output can be wrong. Please review generated content before you rely on it or share it.

5. Google and Microsoft data

dataLayers lets you connect a Google account or a Microsoft account (personal, work or school) so that slides and dashboards can refresh from a spreadsheet you choose.

What we access

• Google: access only to the individual files you choose in Google's file picker (drive.file), plus your Google account email address so you can tell your connected accounts apart. We can't see any other file in your Google Drive.
• Microsoft: read access to files (Files.Read.All), your basic profile and email address (User.Read, openid, email), and the ability to stay connected between visits (offline_access).

We only ever read. We never write to, change or delete anything in your Google or Microsoft account. Microsoft's file permission covers every file you can open, but we only open the spreadsheets whose links you give us.

How we use it

• We read the rows from the sheet, or the tab of the file, that you choose. We do this when you add the source, when you press "Refresh now", and on the schedule you set.
• We store those rows in your organisation's dataLayers library so they can be charted, summarised and drilled into by people your organisation allows to see them.
• If your organisation uses an AI supplier for data summaries, a summary of the chart data is sent to that supplier to write the text. This is described in section 4. It is used only to produce the text you asked for.

What we never do

• We don't use Google or Microsoft user data for advertising, and we don't sell it.
• We don't use it to develop, improve or train AI or machine learning models, whether ours or anyone else's.
• We don't let people read it, except with your permission, for security purposes, to comply with the law, or where the data has been aggregated and anonymised for internal operations.

slideAcross's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Disconnecting

You can disconnect a connected account at any time under "Connected accounts" on your Account page. When you do, we delete the stored tokens and ask Google to revoke our access. Any sources that used the account stop refreshing. You can also remove our access from your Google account settings or your Microsoft account settings. Data that was already captured stays in your organisation's library until someone deletes the source or the library.

6. Who we share it with

Inside your organisation

Content is visible to the people your organisation and its admins allow, based on organisation, department and presentation permissions and any dataLayers permission rules. Organisation admins can see members' names, email addresses and roles. When a presentation is shared with you, or a template sends you a refreshed copy, the sender and other recipients may see your name.

Our service providers (sub-processors)

We use the following providers to run slideAcross. Each one may only use personal data to provide its service to us.

Other sharing

• Legal reasons: we may disclose data if the law requires it, or to protect the rights, property or safety of our users, the public or us.
• Business changes: if Affirmable Limited is involved in a merger, acquisition or sale of assets, data may transfer to the new owner under this policy. We will tell you before that happens.

7. International transfers

We store your data in the UK. Some providers listed above process data outside the UK, mainly in the US and the EU. When they do, we rely on UK adequacy regulations, the UK Extension to the EU-US Data Privacy Framework, or the UK International Data Transfer Agreement or Addendum to protect it. You can ask us for details.

8. Storage and security

Data is hosted on Amazon Web Services in the UK, encrypted in transit with HTTPS (TLS) and encrypted at rest. Other protections include:

• one-way hashed passwords and hardened session cookies;
• limits on repeated sign-in and other sensitive requests;
• separation between organisations, plus role- and department-based access controls;
• checks on uploaded files and on slide content to block harmful code;
• access keys and secrets kept out of our code;
• regular backups.

No system is completely secure. If a breach affects your personal data and is likely to put you at risk, we will tell you and the Information Commissioner's Office (ICO) as the law requires. Our Data Security & Integrity page has more detail.

9. How long we keep it

Deleting your account

You can delete your account from your Account page. This removes your profile, your personal organisation and its content, your memberships, your sharing permissions and your connected accounts. Any Google access is revoked. If you own an organisation that has other members or an active subscription, you'll first need to pass ownership to someone else or cancel the subscription. Presentations you created inside someone else's organisation belong to that organisation, so they stay with it.

10. Your rights

Under UK data protection law, you have the right to:

• access the personal data we hold about you and get a copy;
• correct data that is wrong or incomplete. You can update most of it yourself on your Account page;
• delete your data, including by deleting your account;
• restrict or object to how we use your data, including for direct marketing at any time;
• port your data, which means receiving it in a common machine-readable format. You can also export presentations as PowerPoint or PDF;
• withdraw consent at any time, where we rely on consent.

To use any of these rights, contact us. We'll reply within one month. We may ask you to confirm your identity first. Where your organisation controls the data, such as content in a company workspace, we'll pass your request on to them and help them respond.

11. Cookies and similar technologies

When you first visit, a consent banner lets you accept or reject non-essential cookies. You can change your choice at any time with the cookie icon in the bottom-left corner of our public pages.

You can also block or delete cookies in your browser settings. Blocking essential cookies will stop you signing in.

12. Processing in your browser

Some work happens on your own device, not on our servers:

• PowerPoint import and export and chart drawing run in your browser. The finished slides, and chart images where needed, are then saved to your account.
• Voice commands use your browser's built-in speech recognition. We only act on the recognised words, and we never receive or store audio. Some browsers, such as Google Chrome, send audio to their own service to recognise speech. Your browser maker's privacy policy covers that. Voice commands only listen while you have switched them on.
• Presentations you've already opened can keep working offline. A copy stays in your browser's storage until it's cleared.

PDF and Word documents, web pages and spreadsheets are processed on our servers.

13. Emails we send

• Service emails are needed to run your account. Examples include password resets, security alerts, share invitations and billing notices.
• Template refresh emails tell you when a new copy of a dataLayers template has been shared with you. Each one has its own unsubscribe link. That link stops the emails for that template but keeps your access to it.
• Product news and tips can be switched off with the unsubscribe link in any of these emails.

Emails are sent through Amazon SES in the UK.

14. Children

slideAcross is a business and education tool. It isn't intended for children under 13, and accounts for anyone under 18 must be created or approved by a school, organisation, parent or guardian. If you think a child has given us personal data without that approval, contact us and we will delete it.

15. Changes to this policy

We may update this policy as the service changes. We will post the new version here and update the effective date. If a change materially affects how we use your data, we will email account holders before it takes effect.

16. Contact and complaints

If you're unhappy with how we've handled your data, please talk to us first. You also have the right to complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.