01Scope and roles

This Policy applies when Prestilla determines why and how personal data is processed, including for individual accounts, our public website, billing, support, referrals, and product analytics. When an organization uses Prestilla and controls Customer Content about other people, that organization may be the controller and Prestilla may process the data on its behalf. An applicable enterprise agreement or data processing addendum may further govern that processing.

This Policy does not govern third-party websites, applications, or services that you access independently, even when they integrate with Prestilla.

02Data we collect

Account and workspace data

We receive identifiers and account information such as your name, email address, authentication identifier, organization or workspace membership, subscription plan, account settings, referral attribution, and usage-credit balances. Authentication information is primarily managed by our identity provider.

Customer Content

We process prompts, instructions, source documents, presentations, themes, templates, images, charts, data, speaker notes, comments, edits, generated output, shared-deck recipient addresses, and other material you choose to submit, create, import, store, share, or export through the Services.

AI interaction and diagnostic data

To operate and troubleshoot AI features, we may record prompts, model inputs and outputs, tool calls, token counts, model identifiers, timing, status, and error information. If you submit product feedback, we may collect your note together with the relevant deck prompt, slide content, theme information, and rendered slide snapshots so we can reproduce and address the issue.

Billing data

Our billing and payment providers process payment method and transaction details. Prestilla receives subscription, plan, entitlement, billing status, usage, and limited transaction information. We do not intend to store complete payment-card numbers.

Device, log, and referral data

We may collect IP address, browser and device type, operating system, user-agent, referring page, requested URLs, dates and times, session identifiers, error logs, security events, and referral codes. The application also uses browser storage for functional preferences, such as your last-opened deck and selected theme.

Shared-presentation analytics

When someone views a presentation through a Prestilla share link, we may collect a session identifier, recipient identifier or email associated with a recipient-specific link, visit timestamps, slides viewed, time spent per slide, visit counts, referrer, and browser information. The presentation owner may receive aggregate engagement statistics and, for recipient-specific links, the recipient identity associated with the link. We do not rely on a viewer merely typing an identity into the page; identified analytics come from the link configured by the sender.

Communications

We collect information you send us through support requests, legal or privacy inquiries, surveys, feedback, and other communications.

03How we use data

We use personal data and Customer Content to:

• provide, personalize, render, store, share, export, and improve the functionality of the Services;
• authenticate users and administer accounts, organizations, subscriptions, entitlements, and usage limits;
• process prompts and content through selected AI and infrastructure providers;
• provide presentation owners with requested sharing and engagement analytics;
• respond to support, feedback, legal, and privacy requests;
• monitor reliability, diagnose failures, secure the Services, prevent abuse and fraud, and enforce our terms;
• understand aggregate product usage and referral performance; and
• comply with law and protect the rights, safety, and property of Prestilla, our users, and others.

We do not use Customer Content to train or improve general-purpose or customer-shared AI models. We may improve the software, prompts, workflows, evaluation methods, and reliability of the Services using operational information, feedback, and de-identified or aggregated data, provided that activity does not train a model on Customer Content.

04How we disclose data

We may disclose relevant personal data and Customer Content to the following categories of recipients:

• Infrastructure and hosting providers, including providers of cloud computing, databases, object storage, networking, logging, and security services.
• AI and content-processing providers, including OpenAI, Anthropic, and Google, depending on the feature, configuration, and model selected.
• Identity, workspace, billing, and payment providers, including Clerk and its payment-processing partners.
• Professional advisers and vendors that support security, legal compliance, accounting, customer support, and business operations under appropriate obligations.
• Other users and presentation recipients when you direct us to share a workspace, presentation, asset, or link. Presentation owners receive the viewer analytics described above.
• Authorities or other parties when reasonably necessary to comply with law, legal process, enforce agreements, prevent harm or fraud, or protect rights and security.
• Transaction participants in connection with a merger, financing, acquisition, reorganization, bankruptcy, or sale of all or part of our business, subject to appropriate safeguards.

We do not sell personal data for money. We do not share personal data for cross-context behavioral advertising or use it to serve targeted advertising. If these practices change, we will update this Policy and provide legally required choices before the new use begins.

05AI providers and model training

Prestilla sends relevant portions of Customer Content to commercial AI APIs to perform requested tasks such as planning, composing, editing, extracting themes, researching, or generating images. We configure and use those services under commercial data terms that do not use API inputs or outputs for model training by default, and Prestilla does not opt in to such training.

AI providers may process and retain content for limited periods for service delivery, security, abuse prevention, or legal compliance under their commercial terms and our available account controls. Provider handling can vary by feature and configuration. Contact us if your organization requires a data processing addendum or specific retention controls.

06Cookies and browser storage

Prestilla and its identity provider use cookies or similar technologies that are necessary to authenticate users, maintain sessions, remember settings, prevent fraud, and operate the Services. We also use local browser storage for functional preferences and session state.

We do not currently use cookies to sell personal data or serve targeted advertising. Most browsers let you block or delete cookies, but disabling necessary storage may prevent sign-in or other features from working. Where applicable, we recognize legally required opt-out preference signals for processing covered by those signals; because we do not currently sell data or conduct targeted advertising, there is no such processing to opt out of.

07Retention

We retain personal data and Customer Content for as long as reasonably necessary to provide the Services, maintain your account, satisfy the purposes described in this Policy, comply with legal and contractual obligations, resolve disputes, enforce agreements, and protect security. Retention depends on the type of data, workspace settings, account status, sensitivity, and operational or legal requirements.

When you delete content or close an account, data may remain for a limited period in backups, security records, diagnostic traces, fraud-prevention systems, or legally required archives before deletion or de-identification. Third-party providers retain data according to their applicable terms and configured controls.

08Security

We use administrative, technical, and organizational safeguards designed to protect data, including access controls, authenticated workspaces, encryption provided by our infrastructure, and restricted administrative access. No system is completely secure, and we cannot guarantee that unauthorized access, loss, alteration, or disclosure will never occur. You are responsible for protecting account credentials and configuring share links appropriately.

09Your privacy rights

Depending on where you live and subject to legal exceptions, you may have the right to confirm whether we process your personal data; access or obtain a portable copy; correct inaccuracies; delete data; withdraw consent; and opt out of sale, targeted advertising, or certain profiling. Prestilla does not currently sell personal data, use it for targeted advertising, or profile individuals to make decisions producing legal or similarly significant effects.

To exercise a right, email legal@prestilla.com with the subject “Privacy Request” and identify the account or interaction involved. We may verify your identity and authority before acting. Authorized agents may submit requests where permitted by law, subject to verification. We will respond within the period required by applicable law.

If we deny a request, you may appeal by emailing legal@prestilla.com with the subject “Privacy Appeal” and describing the decision. We will review and respond as required by applicable law. You may also contact the appropriate regulator or attorney general.

We will not discriminate against you for exercising applicable privacy rights.

10International data transfers

Prestilla is based in the United States, and we and our providers may process data in the United States and other countries. Those countries may have different data-protection laws. Where required, we use contractual or other lawful transfer mechanisms.

11Children

The Services are not directed to children under 18, and we do not knowingly collect personal data directly from children. If you believe a child has provided personal data to Prestilla, contact us so we can investigate and take appropriate action.

12Changes to this Policy

We may update this Policy as our Services or legal obligations change. We will post the revised Policy and update the effective date. If changes materially affect how we use personal data, we will provide additional notice or obtain consent where required.

13Contact

Questions, complaints, privacy requests, and appeals may be sent to legal@prestilla.com.