Privacy notice

Who is responsible

The controller under the GDPR, the company that decides why and how your data is processed, is:

You can reach us by email at ben [at] slidesgpt [dot com] or through the contact form. The full company details are in the imprint.

Hosting on Vercel

The site is hosted by Vercel Inc., Covina, California, USA (Vercel privacy policy). When you open a page, your browser talks to Vercel's servers, and Vercel writes a server log entry with your IP address, the time, the page you requested, the page you came from, your browser type and the response status. Without this, the site could not be delivered and we could not spot attacks or faults. Legal basis: our legitimate interest in running a secure, working site (Article 6(1)(f) GDPR).

Vercel keeps these logs for a short, plan-dependent period of at most 30 days and then deletes them. We do not keep a copy and we do not forward them anywhere. Vercel serves pages from the location nearest to you, which can be outside the European Union, including the United States. Vercel processes data on our behalf under a data processing agreement that includes the EU standard contractual clauses.

We also use Vercel Speed Insights, which measures how fast pages load for real visitors (the Core Web Vitals). It sends the measurement together with the page path, your browser, operating system and device type, your connection speed and your country to Vercel. It sets no cookie, and Vercel designs it so that the data cannot be tied to you as an individual or to your IP address. We use it to keep the site fast; the legal basis is again Article 6(1)(f) GDPR.

Analytics with PostHog

To see which pages are read, where visitors come from and how fast the site is for them, we use PostHog, a service of PostHog Inc., San Francisco, California, USA (PostHog privacy policy). We run it on PostHog's US cloud, so the data is stored in the United States. PostHog processes it on our behalf under a data processing agreement that includes the EU standard contractual clauses.

The PostHog script loads only once your browser is idle, never before the page is usable. It records page views, the page you came from, campaign parameters in the address (UTM tags), your browser, operating system, device type and screen size, the country derived from your IP address, and page-speed measurements. PostHog receives your IP address with every request in order to derive the country.

What it does not do: no session recording, no surveys, no automatic capture of clicks and keystrokes, no advertising, no sharing of your data with anyone else. PostHog is the only analytics tool on this site.

The requests go to a path on our own domain (private-local.ai/ingest) and are forwarded from there to PostHog's US servers. This first-party path changes where the request is addressed to, not what is collected.

Consent: the site is in a pre-launch phase. It is not listed in search engines, it is not advertised, and the few people who see it are people we invited. In that phase PostHog runs with cookie-based persistence and we do not yet ask you for consent, which is why we tell you here instead. Before the site launches publicly, a consent mechanism will govern PostHog: it will ask you before the script loads, and your consent is then the basis for both the cookie (section 25(1) of the German TDDDG) and the processing (Article 6(1)(a) GDPR). You can block or delete the PostHog cookie in your browser at any time; the site works without it.

Cookies

Exactly one cookie is set on our domain, and it is PostHog's. There is no advertising cookie and no cookie from any other third party.

ph_phc_…_posthog

Set by PostHog on our domain; the middle part of the name is our PostHog project key. It contains a random visitor ID, the current session ID and a few technical flags, and it lives for one year. PostHog stores further details under the same prefix in your browser's local storage. Purpose: analytics as described above.

Contact form and email

When you send us a message through the contact form, we process what you type in (usually your name, your email address and your message) together with the technical data that comes with the request, namely your IP address and the time. We use it to answer you and for nothing else. Legal basis: Article 6(1)(b) GDPR if your request is about an offer or a contract, otherwise our legitimate interest in answering enquiries (Article 6(1)(f) GDPR).

The form has a hidden field that only automated scripts fill in (a honeypot) and a check by Cloudflare Turnstile, a service of Cloudflare, Inc., San Francisco, California, USA (Cloudflare privacy policy). The Turnstile widget loads from challenges.cloudflare.com only on the contact page and only once the page is idle. To tell humans from bots, Cloudflare processes your IP address and technical characteristics of your browser, and our server checks the result once more before it accepts your message. Cloudflare processes this data on our behalf under a data processing agreement that includes the EU standard contractual clauses. Legal basis: our legitimate interest in keeping spam and abuse away (Article 6(1)(f) GDPR).

Our server sends your message as an email to our mailbox through Resend, a service of Resend, Inc., San Francisco, California, USA (Resend privacy policy). Resend sees the content of the email and keeps delivery records for a limited time. It processes the data on our behalf under a data processing agreement that includes the EU standard contractual clauses.

How long we keep it: we keep your message in our mailbox for as long as we need it to deal with your request and any follow-up, and delete it afterwards, unless the law requires us to keep it longer, for example when the exchange becomes part of a contract. The same applies when you email us directly instead of using the form.

Error monitoring with Sentry

When something breaks on our server, for example the contact form failing to send, the error is reported to Sentry, a service of Functional Software, Inc., San Francisco, California, USA (Sentry privacy policy). Sentry runs on our server only: there is no Sentry script in your browser. A report contains the error message, the place in our code where it happened, the time and technical details of the request that failed. It is not designed to identify you, and we do not add your name or email address to it.

Sentry deletes error reports after at most 90 days. It processes the data on our behalf under a data processing agreement that includes the EU standard contractual clauses. Legal basis: our legitimate interest in finding and fixing faults (Article 6(1)(f) GDPR).

Your rights

Under the GDPR you can, at any time and free of charge:

• ask us whether we process personal data about you and get a copy of it (Article 15),
• have wrong data corrected (Article 16),
• have your data deleted (Article 17),
• have the processing restricted (Article 18),
• receive the data you gave us in a machine-readable format (Article 20),
• object to processing that we base on our legitimate interest (Article 21),
• withdraw a consent you gave, with effect for the future (Article 7(3)).

Just write to us at ben [at] slidesgpt [dot com] or use the contact form. We may ask you to confirm your identity before we act on a request, and we answer within a month.

If you think we process your data unlawfully, you can complain to a data protection authority. The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW) in Düsseldorf. You can also complain to the authority where you live.

We do not make automated decisions about you, we do not build profiles of you across websites, and we do not sell your data.