Privacy Policy

Last updated 22 October 2026

This policy explains which personal data ExpertSlides processes, why, on what legal basis, for how long, and what rights you have. We process only what the service needs, we sell no data, and we use no tracking.

1. Who is responsible

The controller under the General Data Protection Regulation (GDPR) is:

ES Solutions GmbHBarbarossastraße 6163571 GelnhausenGermanyRepresented by Lukas Kulemeier, managing director (Geschäftsführer)Email: [email protected]

For every question about your data and to exercise your rights, write to [email protected].

2. In short

We process the data you give us (your account, your presentations and uploads, your requests to the AI) to provide ExpertSlides to you.
AI requests go to AI services in the USA; they receive the content of the request, never your name, email address or password.
We use only cookies and browser storage that the service needs. No analytics, no advertising, no tracking pixels.
You can see, export, change and delete your data in your account, and you have the rights described in sections 19 to 27.

3. Visiting the website

When you open a page, your browser sends technical data to our server, which our hosting provider (Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany) runs for us: your IP address, the date and time, the address asked for, the referring page, the amount of data sent, and your browser and operating system.

Purpose and legal basis: delivering the pages and keeping the service secure, for example to limit requests and to stop attacks (Art. 6 (1) (f) GDPR; our legitimate interest is a working, secure website). Counters against guessing passwords are kept under a hash of the address, not the address itself.

Storage: the server logs are kept for 14 days and then deleted, unless an incident must be investigated; then for as long as that takes.

The website's own font (Montserrat) and its icons are served from our own server; the fonts of the slide designs come from Google (section 14).

4. Your account

To create an account we need your name, your email address and a password, which we store only as a salted hash. We also keep your plan, your credits and their use, your preferences (language, web search, newsletter, the look you chose), the time your account was made and confirmed, and when you last signed in. To protect accounts against guessing, sign-in attempts are counted per address and per IP address for 15 minutes to an hour.

Purpose and legal basis: providing the contract you enter with your account (Art. 6 (1) (b) GDPR) and protecting the service and your account (Art. 6 (1) (f) GDPR).

Storage: until you delete your account (Account → Delete account). Then your account and everything in it are deleted at once, except what we must keep by law (section 18); copies in backups are overwritten within nightly backups for 30 days, monthly ones for 12 months.

5. Signing in with Google, ChatGPT, LinkedIn or Figma

If you choose to sign in with one of these providers, you are sent to the provider, sign in there, and the provider tells us your name and your confirmed email address. The provider learns that you use ExpertSlides. We receive no password and no other data of your account there.

Legal basis: Art. 6 (1) (b) GDPR — the way in you chose. The providers (Google Ireland Limited; OpenAI; LinkedIn Ireland Unlimited Company; Figma, Inc.) are controllers of their own for what they do; their privacy policies apply to it.

6. Presentations, uploads and brand kits

We store what you create and upload — presentations, pictures, documents, PowerPoint files, logos, fonts and brand kits — so that you have them in the editor and in your account, on every device.

A PowerPoint file you open is read in your browser and then stored as a presentation of your account. A brand kit can be read from your files and from a website you name; our server then opens that website as a visitor would. Your browser also keeps a copy of your presentations (section 16), so that they open fast and survive a lost connection.

Purpose and legal basis: providing the service you asked for (Art. 6 (1) (b) GDPR).

Storage: until you delete the content or your account; a file goes with the last presentation that uses it. Please upload personal data of others only where you are allowed to.

8. AI features

When you ask the AI to make or change slides, read a document or a brand, or make an image, our server sends what that request needs — your prompt, the slides concerned, the text of attached documents, pictures of uploaded pages and of a website you name for a brand kit — to an AI service, never your name, email address or password. Text and vision requests go to OpenRouter, Inc. (USA), which passes them to the model's maker (OpenAI, Anthropic and Google). A request with web search is answered by Perplexity. Images are made by Atlas Cloud with the model of the chosen maker (Alibaba, Atlas Cloud, Baidu, Black Forest Labs, ByteDance, Google, hidream-o1-1.5, Ideogram, Krea, Luma AI, Microsoft, NVIDIA, OpenAI, Qwen, qwen-image-3.0, qwen-image-3.0-pro, xAI, Youchuan and Z-Image).

Purpose and legal basis: the feature you asked for (Art. 6 (1) (b) GDPR). The services process the requests on servers outside the EU, in particular in the USA (section 17).

Storage: we keep the result in your presentation, not the request. Whether and how long a model maker keeps a request is governed by its terms with OpenRouter or Atlas Cloud. We do not use your content to train models. Please do not enter special categories of personal data (for example health data) or personal data of others into a prompt unless you are allowed to.

The AI's answers are made automatically; they make no decision about you (Art. 22 GDPR).

9. Connecting an AI assistant

You can connect an AI assistant (for example ChatGPT or Claude) to your account, so that it can make a presentation for you. You sign in and confirm the connection; the assistant then holds a token for your account, and sends us the topic, notes and number of slides of what you ask it for. We answer with a link to the presentation. You can end a connection or a personal key in your account at any time.

Legal basis: Art. 6 (1) (b) GDPR. The assistant's provider is a controller of its own for what you tell it.

10. Credits and rewards

We count the credits your requests use, by month. The Free plan's monthly credits and the credits of rewards are given only once your email address is confirmed. If you claim a reward, we keep what the claim names — your name on a network, or the address of your post or video — with the time of the claim, to grant the credits once; we do not visit or analyse the post or the video. So that each person has the Free plan's monthly credits on one account and each reward once, we keep a one-way hash of your email address (in lower case, without a "+" part, at Gmail without its dots) with the reward and your account — it stays after your account is deleted, and cannot be turned back into the address.

If you give feedback on a slide in the editor, we keep it with the slide it is about — the slide as it stood, its pictures by their addresses —, your plan and the time, to improve the product, until you delete your account.

Legal basis: Art. 6 (1) (b) GDPR. Storage: as long as your account.

11. Payments

Paid plans are paid through Stripe. Stripe receives your email address, your name, your billing address, any tax ID and the payment details you enter in its Checkout; we never see your card. Stripe tells us the state of your subscription and your invoices.

Purpose and legal basis: performing the contract (Art. 6 (1) (b) GDPR) and our tax and accounting duties (Art. 6 (1) (c) GDPR with § 147 AO and § 257 HGB). Stripe processes some data as a controller of its own, for example to prevent fraud and under the law on payment services.

Before a Checkout you confirm that the service starts at once and that your right of withdrawal ends with it. We store that confirmation with its time on your account and on the payment, as proof (Art. 6 (1) (c) GDPR with § 356 (4) and (5) BGB, and Art. 6 (1) (f) GDPR).

Storage: invoices and payment records as section 18 says; the confirmation with the payment at Stripe as long as claims under the contract can be made (§§ 195, 199 BGB), on your account until it is deleted.

12. Emails

We send the emails your account needs — confirming your address, resetting your password, invitations to a team — through our account service (Supabase). Legal basis: Art. 6 (1) (b) GDPR.

We also send product news, tips and offers about ExpertSlides to the address of your account through Acumbamail. Acumbamail receives your email address, name, plan, language and the days of your first presentation, your first export, your last visit, a change of your plan, your month's credits running out and credits you claimed as a reward, so that the emails fit where you are. Legal basis: our legitimate interest in direct marketing of our own similar services (Art. 6 (1) (f) GDPR, § 7 (3) UWG).

You can object at any time, free of charge: switch off Newsletter under Account, or use the unsubscribe link in every email. Your address is then removed from the list.

13. Error reports

Where an error service is set up, our server reports errors nobody expected to Sentry: the kind of error, the route's pattern and the time — no email address, no IP address and no content. Legal basis: Art. 6 (1) (f) GDPR (a reliable service). The reports are deleted after the period set in the error service.

14. Fonts of the slides

The website's own font, Montserrat, comes from our own server. The slide designs and your presentations may use other fonts, from Google Fonts. Wherever slides are shown — the design previews on the home page, on Design Templates and beside the prompt, the editor, shared presentations and the previews of brand kits — your browser loads those fonts from Google's servers; on the home page and on Design Templates as soon as you open them. Google receives your IP address, your browser's headers and the font asked for.

Purpose and legal basis: showing the designs and your presentations as they are designed (Art. 6 (1) (f) GDPR). Google may process the data in the USA; Google LLC is certified under the EU–US Data Privacy Framework.

16. What we store in your browser

These are all the cookies and all the browser storage ExpertSlides uses. They stay in your browser; the cookies go back to our server only with your requests.

Cookies
Name	Purpose	Stays
`es_session`	Keeps you signed in (signed, not readable by scripts).	12 hours, or 30 days with "Keep me signed in"
`sb-…-auth-token`	The same, where accounts run on Supabase.	12 hours, or 30 days with "Keep me signed in"
`sb-…-code-verifier`	Proves that the browser that set out to sign in with a provider is the one that comes back.	10 minutes
`es_in`	Tells the pages that somebody is signed in, so the header shows the right buttons. Grants nothing.	As the session
`es_keep`	Remembers that "Keep me signed in" was off.	The browser session
`es_pending`	Holds the link of an email (confirmation, password reset) until you press its button.	15 minutes
`es_hold`	Holds the sign-in a confirmation link began in another browser until you press "Continue as …" (signed, not readable by scripts).	15 minutes
`es_reg`	Remembers the account this browser just registered, to sign it in after the confirmation.	24 hours
`es_back`	Prevents a loop when going back after signing out.	10 seconds
`es_consent`	Your choice in the cookie settings.	12 months

Browser storage
Name	Purpose	Stays
`expertslides-editor, expertslides-stash`	Your presentations and their pictures in the editor (IndexedDB), so they open fast and survive a lost connection; a prompt waiting for a sign-in.	Until you delete the presentation or clear the site's data
`es-files-`	The service worker's cache of the app's own files (fonts, icons, design previews), for speed.	Until a new version replaces it
`es.prompt`	A prompt, its options and the chosen look while you sign in or come back.	Until it is used
`es.look`	The look chosen before signing in.	Until it is used
`es.signup`	The address a confirmation email went to, while you wait for it.	The tab
`es.known`	That this browser has an account, so the sign-in is offered first.	Until you clear the site's data
`es.kits`	Which brand kits you have, so the prompt shows them at once.	Until you sign out or clear the site's data
`es.owner`	Whose presentations the editor's local copy holds.	Until another account signs in
`es.ai.apiKey`	An OpenRouter key of your own, where you enter one in the editor's AI settings.	The tab
`es.editor`	Small notes of the editor (a hint shown once).	The tab
`es:import-note`	The note on an opened PowerPoint file, until it is shown.	The tab
`es.credits`	Your last credit count, to show it before the page has asked.	Until it changes
`es.who`	Your initials, to show your avatar before the page has asked.	Until you sign out
`es.gift`	That the free-credits gift was shown.	Until you clear the site's data
`es.offer`	When the rewards were offered.	Until you clear the site's data
`es.rewards`	Rewards claimed that wait to be shown.	Until shown
`es.share-presses`	Which share buttons you pressed for a reward.	Until you clear the site's data
`es.brand`	A brand kit's pictures that wait to be uploaded.	Until uploaded
`es-celebrated`	That your first export was celebrated.	Until you clear the site's data
`es.admin, esDesign`	The admin area's last section and list (the admin alone).	The tab
`es.session`	When the page last reloaded itself after another sign-in.	The tab

17. Who receives data, and transfers outside the EU

We use the following services, each bound by a data processing agreement (Art. 28 GDPR) where it processes data on our behalf, and only for the purposes above. Where data goes to a country outside the EU/EEA, the transfer rests on an adequacy decision of the European Commission (Art. 45 GDPR) — for the USA the EU–US Data Privacy Framework, for companies certified under it — or on the EU Standard Contractual Clauses (Art. 46 (2) (c) GDPR); you can ask us for a copy.

Beyond these, we pass data on only where the law obliges us to (for example to tax authorities or on a court's order).

Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany

Purpose: Runs the website and the app's server. Always.
Data: Every request: the IP address, date and time, the page asked for, the referring page, the browser's headers, and what the request carries.
Legal basis: Art. 6 (1) (b) GDPR for what a request asks for; Art. 6 (1) (f) GDPR for the delivery and security of the website.
Where: As the hosting contract says; a data processing agreement under Art. 28 GDPR.

Cloudflare, Inc. (USA)

Purpose: Stands in front of the server: delivers the website, keeps attacks and abusive traffic away, and keeps static files in its cache. Always.
Data: Every request passes it: the IP address, date and time, the page asked for, the browser's headers, and what the request carries.
Legal basis: Art. 6 (1) (f) GDPR: the secure and fast delivery of the website.
Where: Its data centres worldwide, the one nearest the visitor; the adequacy decision for the EU–US Data Privacy Framework (Art. 45 GDPR) where the recipient is certified under it, otherwise the EU Standard Contractual Clauses (Art. 46 (2) (c) GDPR).
Privacy policy: cloudflare.com/privacypolicy

Supabase Pte. Ltd., 65 Chulia Street #38-02/03, OCBC Centre, Singapore 049513

Purpose: Accounts and sign-in, the database, the stored presentations, files and brand kits, and working together live; it hands the account emails to Resend. Always, once accounts run on Supabase.
Data: Name, email address, password (hashed), plan, credits, preferences, presentations, uploaded files, brand kits, team memberships, sign-in times and the IP address of a sign-in.
Legal basis: Art. 6 (1) (b) GDPR; Art. 6 (1) (f) GDPR for the protection of accounts.
Where: In the region of our project (EU (Ireland)); support and sub-processors may reach the data from outside the EU — the EU Standard Contractual Clauses (Art. 46 (2) (c) GDPR).
Privacy policy: supabase.com/privacy

Resend, Inc. (USA)

Purpose: Sends the account emails: confirming an address, a new password, an invitation, a changed address. When an account email is sent.
Data: The email address and name of the recipient, and the email itself with its link.
Legal basis: Art. 6 (1) (b) GDPR.
Where: Sent from the EU (Ireland); the adequacy decision for the EU–US Data Privacy Framework (Art. 45 GDPR) where the recipient is certified under it, otherwise the EU Standard Contractual Clauses (Art. 46 (2) (c) GDPR).
Privacy policy: resend.com/legal/privacy-policy

Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland, with Stripe, Inc. (USA)

Purpose: Payments: Checkout, the subscription, invoices and tax. When you buy or manage a paid plan.
Data: Email address, name, billing address, tax ID, the payment details you enter at Stripe (we never see your card), the plan bought and your consent to an immediate start.
Legal basis: Art. 6 (1) (b) GDPR; Art. 6 (1) (c) GDPR for tax and accounting duties. Stripe is in part a controller of its own (fraud prevention, payment services law).
Where: EU and USA; the adequacy decision for the EU–US Data Privacy Framework (Art. 45 GDPR) where the recipient is certified under it, otherwise the EU Standard Contractual Clauses (Art. 46 (2) (c) GDPR).
Privacy policy: stripe.com/privacy

OpenRouter, Inc. (USA)

Purpose: The text and vision models of every AI request: writing slides, edits, commands, reading documents and brand files, web search. OpenRouter passes a request to the model's maker. With every AI request.
Data: What you type, the slides concerned, the text of documents you attach, pictures of the pages you upload and of a website you name for a brand kit — never your name, email address or password.
Legal basis: Art. 6 (1) (b) GDPR: the feature you asked for.
Where: USA, and the countries of the model makers; the EU Standard Contractual Clauses (Art. 46 (2) (c) GDPR).
Privacy policy: openrouter.ai/privacy

Atlas Cloud

Purpose: The image models: pictures made or changed for a slide. When a picture is made or changed.
Data: The description of the picture, and a picture you ask to be changed — never your name or email address.
Legal basis: Art. 6 (1) (b) GDPR: the feature you asked for.
Where: Outside the EU, with the model's maker; the EU Standard Contractual Clauses (Art. 46 (2) (c) GDPR).
Privacy policy: atlascloud.ai

Acumbamail (Spain)

Purpose: The newsletter and the product emails. While the newsletter is on for your account.
Data: Email address, name, plan, language, and the days of your first presentation, your first export, your last visit, a change of your plan, the month's credits running out and credits claimed as a reward.
Legal basis: Art. 6 (1) (f) GDPR with § 7 (3) UWG: direct marketing of our own similar services; you can object at any time.
Where: EU.
Privacy policy: acumbamail.com/en/privacy-policy

Cloudflare, Inc., USA (Turnstile)

Purpose: A check before an account is made that the sign-up is a person's, not a script's — without a puzzle as a rule. Only while you sign up, and only where the check is set up.
Data: Your IP address, your browser's properties and how the page was used while the check ran; no email address, no content.
Legal basis: Art. 6 (1) (f) GDPR: keeping accounts — and the credits each one is given — from being made by scripts.
Where: USA; the adequacy decision for the EU–US Data Privacy Framework (Art. 45 GDPR) where the recipient is certified under it, otherwise the EU Standard Contractual Clauses (Art. 46 (2) (c) GDPR).
Privacy policy: cloudflare.com/turnstile-privacy-policy

Functional Software, Inc. (Sentry), USA

Purpose: Reports of errors nobody expected, to fix them. Only where an error service is set up.
Data: The error, the route's pattern and the time — no email address, no IP address, no content.
Legal basis: Art. 6 (1) (f) GDPR: a reliable service.
Where: USA, or the region of the Sentry project; the adequacy decision for the EU–US Data Privacy Framework (Art. 45 GDPR) where the recipient is certified under it, otherwise the EU Standard Contractual Clauses (Art. 46 (2) (c) GDPR).
Privacy policy: sentry.io/privacy

Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, with Google LLC (USA)

Purpose: The fonts of the slide designs and of a presentation other than Montserrat: loaded wherever slides are shown — the design previews on the home page, on Design Templates and beside the prompt, the editor, shared presentations, and the previews of brand kits. When a page shows a slide or a design in such a font — the home page and Design Templates at once, on the first visit.
Data: Your IP address, your browser's headers and the font asked for.
Legal basis: Art. 6 (1) (f) GDPR: showing the designs and your presentations as they are designed.
Where: EU and USA; the adequacy decision for the EU–US Data Privacy Framework (Art. 45 GDPR) where the recipient is certified under it, otherwise the EU Standard Contractual Clauses (Art. 46 (2) (c) GDPR).
Privacy policy: policies.google.com/privacy

Google, OpenAI (ChatGPT), LinkedIn, Figma — when you sign in with one

Purpose: Signing in without a password. Only when you choose one.
Data: The provider tells us your name and email address; it learns that you signed in to ExpertSlides.
Legal basis: Art. 6 (1) (b) GDPR: the way in you chose.
Where: As each provider's own privacy policy says; the providers are controllers of their own.

18. How long we keep data

We delete personal data as soon as it is no longer needed for its purpose and no law obliges us to keep it. In detail:

Server logs: 14 days.
Counters of sign-in attempts: 15 minutes to an hour.
Sessions: 12 hours, or 30 days with "Keep me signed in"; ended when you sign out.
Your account, presentations, files, brand kits, credits, rewards and preferences: until you delete them or your account.
Backups: overwritten within nightly backups for 30 days, monthly ones for 12 months.
Invoices and booking records: 8 years; books, annual accounts and the documents needed to understand them: 10 years; business letters: 6 years (§ 147 AO, § 257 HGB) — each from the end of the calendar year; in that time they are blocked for any other use.
The confirmation that the service starts at once: with the payment at Stripe until claims under the contract are time-barred, as a rule three years from the end of the year the contract ended (§§ 195, 199 BGB).
Newsletter data at Acumbamail: until you object or delete your account.
Your cookie choice: 12 months.

19. Your right of access (Art. 15 GDPR)

You may ask whether we process personal data about you and, if so, receive a copy of it and the information Art. 15 GDPR names: the purposes, the categories, the recipients, the storage period, the source and your rights.

20. Your right to rectification (Art. 16 GDPR)

You may have incorrect data corrected and incomplete data completed. Your name and preferences you can change yourself under Account.

21. Your right to erasure (Art. 17 GDPR)

You may have your data deleted where it is no longer needed, where you withdraw a consent or object, or where it was processed unlawfully — unless a law obliges us to keep it. You can delete your presentations and your whole account yourself.

22. Your right to restriction (Art. 18 GDPR)

You may have the processing of your data restricted, for example while its accuracy is being checked, or where you need it kept for a legal claim.

23. Notification of recipients (Art. 19 GDPR)

Where we correct, delete or restrict data at your request, we tell every recipient we disclosed it to, unless that is impossible or would take disproportionate effort; on request we tell you who they are.

24. Your right to data portability (Art. 20 GDPR)

You may receive the data you gave us on the basis of the contract or a consent in a structured, commonly used, machine-readable format, and have it sent to another controller where that is technically feasible. Your presentations you can export yourself at any time (for example as PowerPoint or PDF).

25. Your right to object (Art. 21 GDPR)

Where we process data on the basis of our legitimate interest (Art. 6 (1) (f) GDPR), you may object at any time for reasons arising from your particular situation. We then no longer process it, unless we show compelling legitimate grounds that override your interests, or the processing serves legal claims.

You may object to direct marketing (our newsletter) at any time and without giving reasons; we then no longer use your data for it. Switch off Newsletter under Account, use the link in every email, or write to [email protected].

26. Withdrawing a consent (Art. 7 (3) GDPR)

Where processing rests on your consent, you may withdraw it at any time with effect for the future, as easily as you gave it — for cookies in the cookie settings. What was done before stays lawful.

27. Your right to complain (Art. 77 GDPR)

You may complain to a data protection supervisory authority, in particular in the EU member state where you live, work or where the infringement took place. The authority responsible for us is: Der Hessische Beauftragte für Datenschutz und Informationsfreiheit (HBDI), Gustav-Stresemann-Ring 1, 65189 Wiesbaden, Germany.

28. Whether you must provide data, and automated decisions

You are not obliged by law to provide personal data. Without your email address and a password (or a sign-in provider) we cannot create an account, and without payment details no paid plan. We make no decisions based solely on automated processing, including profiling, that have legal effects on you or affect you similarly (Art. 22 GDPR).

29. Security

Every connection to ExpertSlides is encrypted (TLS). Passwords are stored only as hashes, sessions are signed and cannot be read by the page's scripts, and every request is checked on the server for who may make it (Art. 32 GDPR).

30. Changes

We update this policy when the service or the law changes; the date at the top shows the current version. The Terms of Service and the Legal Notice are on their own pages.