Privacy Policy
SlideDrop — slidedrop.co
Last updated: 20 September 2026
This policy explains what happens to your data when you use SlideDrop. It is written to satisfy Articles 13 and 14 GDPR, and applies to everyone, wherever you are.
1. Controller
Hung Long Vu, sole proprietor (個人事業主)
4-5-21 Umami-kita, Kōryō-chō
Kitakatsuragi-gun, Nara 635-0831
Japan
Email: info@hunglongvu.com
We have not appointed a Data Protection Officer; we are not required to.
Note on international transfer: we are established in Japan. Japan has been recognised by the European Commission as providing an adequate level of data protection (adequacy decision of 23 January 2019). Data is transferred to us on that basis.
2. What we collect, why, and on what legal basis
2.1 Account data
What: email address, name if you provide one, account settings and preferences.
Why: to create and operate your account.
Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
Kept: until you delete your account.
2.2 Content you provide
What: product names and descriptions, brand assets and images you upload, topics and prompts you enter, characters you create.
Why: to generate slideshows. This data is sent to the AI providers listed in section 3.
Legal basis: performance of a contract (Art. 6(1)(b)).
Kept: until you delete the product or your account.
2.3 Generated content
What: the slideshows we generate for you, including images, text and the source references behind them.
Why: so you can view, edit and export them.
Legal basis: performance of a contract (Art. 6(1)(b)).
Kept: 90 days from creation, then deleted automatically. Generated hook lines are kept per product to avoid repetition, for as long as the product exists.
2.4 Usage and technical data
What: IP address, browser and device type, pages visited, timestamps, error logs, and records of generation runs including their cost and outcome.
Why: to operate the service securely, diagnose faults, enforce usage limits, and prevent abuse.
Legal basis: legitimate interest in a secure and functioning service (Art. 6(1)(f)).
Kept: server logs for 30 days. Run records are kept for as long as your account exists, for billing and support.
2.5 Payment data
This section applies once paid plans are live. Payments are not connected yet, so today we receive no payment data.
What: once paid plans are live, we will receive from Dodo Payments, our Merchant of Record (section 4), for each subscription and payment: the status, plan and billing period of your subscription; the name, email address, billing address and — if you give them — phone number, business name and tax ID you enter at checkout; Dodo Payments' identifiers for you, your subscription and each payment; and the amount, currency, tax and payment method of each payment and a link to its invoice. Dodo Payments' messages also name the card used — its brand, type, issuing country, holder name and last four digits; we delete those fields as each message arrives, before anything is stored. We never store any card details.
Why: to grant access to the plan you paid for, and to match each payment to your account.
Legal basis: performance of a contract (Art. 6(1)(b)). Keeping Dodo Payments' messages for 30 days — to recognise repeated deliveries and to resolve payments that could not be matched to an account — rests on our legitimate interest in correct billing (Art. 6(1)(f)).
Kept: Dodo Payments' messages for 30 days from receipt, then deleted automatically. Your subscription status, your credit grants and the link between your Dodo Payments customer record and your account for as long as your account exists. Deleting your account deletes all of it at once; a message we could not link to your account is deleted after its 30 days. Invoices and the tax records for your purchases are kept by Dodo Payments, the seller, under its own privacy policy.
2.6 Analytics
What: Vercel Web Analytics records page views: the page and referrer, country and region, browser, operating system and device type. A visitor is recognised only by a hash created from the request, and that session is discarded after 24 hours. Vercel Speed Insights collects anonymous page performance measurements.
Why: to understand how the site is used and where it is slow.
Legal basis: for Web Analytics, our legitimate interest in knowing which pages are used (Art. 6(1)(f)). For Speed Insights, your consent (Art. 6(1)(a)). Speed Insights is not loaded before you consent, and you can withdraw consent at any time through the cookie settings link in the footer.
Kept: Web Analytics discards the visitor session after 24 hours and keeps aggregated page-view statistics for the reporting period of our Vercel plan. Speed Insights keeps only anonymous measurements.
3. AI processing — what leaves our systems
This is the part most people want to know, so it is stated plainly.
When you generate a slideshow, the following is sent to third-party AI providers:
- your product name and description
- the topic or prompt you entered
- images you uploaded that the format uses as a reference
- for some formats, text retrieved from public web pages
The providers are:
| Provider | What it does | Where |
|---|---|---|
| Anthropic PBC | writes the slide text, judges generated images and text | United States |
| Google LLC (via Vercel AI Gateway) | generates the images | United States |
| Vercel Inc. (AI Gateway) | routes requests to the image model | United States |
| Google LLC (Gemini API, called directly under a paid Google Cloud project) | writes slide text, suggests angles and characters, generates images and checks them | United States |
What we know about how they handle it, and where that comes from. Anthropic publishes a data processing agreement that includes the EU Standard Contractual Clauses, and its commercial terms exclude training models on our data. Google publishes the same for the paid Gemini API, which is how we call it directly. Image requests through the AI Gateway take a different route: we send them to Vercel, and Vercel passes them to Google. Vercel states that the gateway keeps no prompts or outputs and does not train on them, and it lists Google among the model providers that do not train on requests sent through the gateway. Vercel's data processing agreement, which includes the Standard Contractual Clauses, covers our use of Vercel but does not mention the gateway, and no published document says whether Google's processor terms cover requests that Vercel passes to it.
Do not enter personal data of third parties, health information about identifiable people, or confidential business information into SlideDrop. It will be transmitted to the providers above.
4. Other processors
| Processor | Purpose | Where |
|---|---|---|
| Supabase | database and file storage | Germany (Frankfurt, eu-central-1) |
| Vercel Inc. | hosting and content delivery | Germany (primary), global edge network |
| Dodo Payments Inc ("Dodo Payments") | Merchant of Record and reseller: checkout, payment processing, invoicing, sales tax and refunds, once paid plans are live | United States and United Kingdom, among other group countries; hosted at AWS, region not published |
| Vercel Inc. | Web Analytics and Speed Insights: page-view and performance statistics | United States |
| Inngest Inc. | background job execution | United States |
| Jonathan Geiger d/b/a PostPeer | connects TikTok and Instagram accounts and publishes slideshows to TikTok | Israel |
TikTok and Instagram connections. When you connect a TikTok or Instagram account, you sign in to that platform through PostPeer. We never receive the access tokens for that account; PostPeer holds them, and it publishes to TikTok on our behalf. We store only PostPeer's identifiers for your profile and connection, the account's username, the time you connected it, your posting settings, and the result of each post. When you publish to TikTok, the slide images and caption are sent to PostPeer, which uploads them to TikTok. Nothing is published to Instagram. Disconnecting the account in settings, or deleting your SlideDrop account, removes the connection at PostPeer. PostPeer does not publish where it stores these credentials or how long it keeps uploaded media.
Data processing agreements. Supabase, Vercel, Anthropic, and Google for the directly called Gemini API publish data processing agreements that apply to our use and include the EU Standard Contractual Clauses. Inngest and PostPeer do not publish a data processing agreement. Once paid plans are live, Dodo Payments will act as Merchant of Record. Its published data processing agreement makes it an independent controller for the data you enter at checkout, which it processes under its own privacy policy, and our processor for anything it processes on our behalf. Transfers to Israel (PostPeer) rely on the European Commission's adequacy decision for that country. For transfers outside the EEA and the UK, Dodo Payments' data processing agreement names the EU Standard Contractual Clauses, the EU–US Data Privacy Framework where the Dodo Payments entity holds a valid certification, or another mechanism under Art. 46 or a derogation under Art. 49 GDPR.
5. Cookies
We use:
- Strictly necessary cookies — to keep you logged in, to secure the session, and to remember your cookie choice. These are set without consent because the service cannot work without them.
- A bot-protection cookie from Supabase's storage network — when the preview images on the home page load, Cloudflare sets
__cf_bmon supabase.co for 30 minutes to tell browsers from bots.
We set no analytics or advertising cookies. Vercel states that Web Analytics uses no third-party cookies. In our own testing with a fresh browser profile, neither Web Analytics nor Speed Insights set any cookie. Speed Insights is loaded only after you consent.
You can change or withdraw your choice at any time through the cookie settings link in the site footer. Refusing does not restrict any function of the service.
6. Who else sees your data
Nobody, except:
- the processors listed above, to which we send your data only for the tasks shown there. Supabase, Vercel, Anthropic, and Google for the Gemini API publish data processing agreements that limit them to those tasks. Inngest and PostPeer publish no such agreement, so only their own terms govern what they do with the data we send them. For Google behind the AI Gateway, see section 3.
- authorities, where we are legally required to disclose
- a purchaser, if the business is sold — in which case you will be informed in advance
We do not sell your data and we do not share it for advertising.
7. Your rights
If the GDPR applies to you, you have the right to:
- access the data we hold about you (Art. 15)
- rectify inaccurate data (Art. 16)
- erase your data (Art. 17)
- restrict processing (Art. 18)
- data portability — receive your data in a machine-readable format (Art. 20)
- object to processing based on legitimate interest (Art. 21)
- withdraw consent at any time, without affecting processing before the withdrawal (Art. 7(3))
To exercise any of these, email info@hunglongvu.com. We respond within one month.
You can delete your account yourself at any time in your settings. Deletion removes your account, your products, your uploaded files, your generated slideshows and the payment data described in section 2.5. Invoices and tax records for your purchases stay with Dodo Payments, the seller, under its own privacy policy.
Right to complain: you can lodge a complaint with a supervisory authority in your country of residence, place of work, or where you believe a violation occurred.
8. Automated decision-making
We do not make automated decisions that produce legal effects concerning you or similarly significantly affect you within the meaning of Art. 22 GDPR.
Automated systems do decide what content your slideshows contain and whether a generation can proceed. These decisions affect the output you receive, not your legal position.
9. Security
Data is transmitted over TLS. Database access is restricted by row-level security so that you can only reach your own records. Access to production systems is limited to the controller.
No system is perfectly secure. If a breach occurs that is likely to put your rights at risk, we will inform you and the competent supervisory authority as required by Art. 33 and 34 GDPR.
10. Children
SlideDrop is not intended for people under 18 and we do not knowingly collect their data. If you believe a minor has created an account, write to info@hunglongvu.com and we will delete it.
11. Changes
We may update this policy. Material changes are announced by email at least 30 days in advance. The date at the top always shows the current version.