Privacy Policy

This Privacy Policy explains how Supaslides (“we”, “us”) collects, uses, and protects your information when you use our website and app at supaslides.app (the “Service”). By using the Service, you agree to this policy.

Information we collect

• Account information. Your email address and authentication details, used to create and secure your account.
• Content you provide. The URLs, briefs, text, and images you submit, and the brands, carousels, and posts generated from them.
• Payment information. If you subscribe, payments are processed by Stripe. We do not store your full card details; we keep your plan, status, and billing identifiers.
• Connected account tokens. If you connect social accounts for publishing, we store the access tokens those platforms issue, in encrypted form.
• API keys. If you create an API key for agent or API access, we store it hashed; the full key is shown to you once and cannot be read back by us.
• Usage and device data. Logs, approximate location from IP, browser and device information, and product analytics about how the Service is used.
• Cookies and similar technologies. Essential cookies for sign-in and security, analytics (PostHog), and, on our marketing pages, an advertising pixel (TikTok) that reports conversion events such as sign-ups and purchases.

How we use your information

• To provide, maintain, and improve the Service.
• To generate brands, carousels, and posts from the inputs you submit.
• To publish the content you explicitly schedule to accounts you connect.
• To process payments, manage subscriptions, and enforce plan limits.
• To communicate with you about your account, security, and product updates.
• To measure how the product and our marketing perform.
• To detect, prevent, and address abuse, fraud, or technical issues.

Legal bases

Where the GDPR applies, we process your data on these bases: performance of a contract (providing the Service you signed up for), legitimate interests (securing the Service, preventing abuse, understanding product usage, promoting the Service), consent where we ask for it, and legal obligation (for example, accounting records we must keep under Polish law).

AI processing

To generate themes, ideas, and copy, we send the inputs you provide (such as a URL, brief, or image) to our AI provider, Anthropic, through its API. We do not use your content to train models, and under Anthropic’s API terms your content is not used to train their models either.

Connected social accounts

If you connect an Instagram, Facebook Page, TikTok, X (Twitter), Threads, Pinterest, LinkedIn, or YouTube account to schedule or publish content, we access only what is needed to do that: your account’s basic profile (such as your username, name, and avatar), the list of Pages or accounts you authorize, and permission to publish the posts you schedule. We store the access tokens these platforms issue in encrypted form and use them solely to publish and manage the content you explicitly schedule. We never post without your action, and we do not read your private messages or your existing posts.

You can disconnect an account at any time from Settings, which deletes its stored tokens, and you can also revoke access to Supaslides from within Instagram, Facebook, TikTok, X, Threads, Pinterest, LinkedIn, or your Google Account. When you disconnect, remove the app, or request deletion, we delete the connected account and its tokens. Our use and transfer of information received from the Meta APIs (Instagram, Facebook, and Threads) and the TikTok API follows the Meta Platform Terms and TikTok’s Developer Terms, including their limited-use requirements; our use of the X API follows the X Developer Agreement, our use of the Pinterest API follows the Pinterest Developer Guidelines, our use of the LinkedIn APIs follows the LinkedIn API Terms of Use, and our use of YouTube API Services follows the YouTube API Services Terms of Service and the Google Privacy Policy. You can revoke Supaslides’ access to your YouTube data at https://myaccount.google.com/permissions.

API keys and AI agents

You can connect AI assistants (for example Claude or Cursor) to your account through our MCP server, authenticated with a personal API key. Anything an agent does with your key acts on your account, is subject to the same plan limits, and is logged like normal app usage. Keep your keys secret; you can revoke a key at any time in Settings, which disconnects every client using it.

Share links

If you create a share link for a carousel, the shared page is public to anyone who has the link (links are unguessable and excluded from search indexing), and we count its views. You can revoke a share link at any time, which deactivates the page.

Analytics and advertising

We use PostHog for product analytics (events such as sign-ups, generations, and exports) to understand and improve the product. On our public marketing pages we also use the TikTok pixel, which reports conversion events (such as completed registrations and purchases) to TikTok to measure our advertising. We do not sell your personal information, and we do not use advertising tools inside the logged-in app beyond the analytics described here.

Service providers

We share data only with providers that help us run the Service, under appropriate safeguards: Supabase (authentication, database, storage), Stripe (payments), Anthropic (AI generation), Vercel (hosting), Google Cloud (rendering and export processing), PostHog (analytics), Meta, TikTok, X, Pinterest, LinkedIn, and Google/YouTube (publishing to the accounts you connect), and TikTok (advertising measurement on marketing pages).

Data retention

We keep your account data and content for as long as your account is active. Export files (image and video downloads) are stored for 48 hours and then deleted automatically. Tokens for connected social accounts are deleted when you disconnect the account. If you delete your account, we delete or anonymize your personal data within a reasonable period, except where we are required to keep it for legal, accounting, or security reasons.

Your rights

Depending on where you live, you may have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing. To exercise these rights, contact us using the details below. You can also delete content and your account from within the app. If you are in the EU/EEA, you also have the right to lodge a complaint with a supervisory authority; in Poland this is the President of the Personal Data Protection Office (PUODO).

Data security

We use industry-standard measures to protect your data, including encryption in transit and access controls. No method of transmission or storage is perfectly secure, so we cannot guarantee absolute security.

International transfers

Your data may be processed in countries other than your own, including the United States, where some of our providers operate. Where required, we rely on appropriate safeguards such as the EU Standard Contractual Clauses or the EU-U.S. Data Privacy Framework.

Children

The Service is not intended for anyone under 16, and we do not knowingly collect personal data from children.

Changes to this policy

We may update this policy from time to time. We will post the new version here and update the date above. Significant changes may also be communicated by email.

Contact us

Questions about this policy or your data? Reach us at support@supaslides.app or through our contact page.