--- title: "Security & Privacy: Where Your Data Lives | Slaide" description: "Where Slaide stores your data, what goes to the USA to create a document, which providers are involved and what you can delete yourself." canonical: https://www.slaide.de/security date_published: 2026-10-04 date_modified: 2026-10-04 source: https://www.slaide.de/llms.txt --- # Where your data lives, and who sees it. > **In short:** Your account, files and documents are stored with Supabase in the EU. For Slaide to create a document, your request and the content it needs go through the routing service OpenRouter to language-model providers in the USA; their use for their own purposes or for training AI models is contractually excluded. You manage documents, files and share links yourself, and when you delete your account the related content is removed irrevocably. The short version of what the privacy policy says: what Slaide stores, what goes abroad to create a document, whom we trust with it and what you control yourself. ### The essentials - **Account, files and documents** are stored with Supabase in the EU - **To create a document**, your request and the content it needs go through OpenRouter to a language model in the USA - **No training:** using your content to train AI models is contractually excluded - **You decide:** you delete documents and files yourself, and you can deactivate share links *The uncomfortable part is here too: the USA is a third country.* ## What goes where, in three stations. From you through Slaide to the AI services, with the place where each step is processed. ### You: Your browser - Request and uploaded files - Edit, export, delete a document - Share links only at your initiative ### Mainly EU: Slaide - Account, documents and files: Supabase (EU) - Hosting, document creation and rendering: Vercel (USA / EU) - Payments: Stripe (Ireland / USA), you enter card details there directly ### USA: AI services - Request and the content it needs: OpenRouter and the language-model providers behind it - Image descriptions for optional image generation: OpenAI - No use for training, contractually excluded **Between the stations:** Request, files → only what is needed to create > In addition there are Resend (account and security emails), Sentry (error reports without content), Pexels (stock photo search) and Brandfetch (logo search). All providers are in the table below and in the [privacy policy](https://www.slaide.de/privacy). ## Who is involved, and where it is processed. We have data processing agreements under Art. 28 GDPR with our processors. | Provider | Purpose | Location | | --- | --- | --- | | Vercel | Hosting, delivery, document creation and rendering, privacy-friendly usage and performance measurement | USA / EU | | Supabase | Database, sign-in, file storage | EU | | OpenRouter and the language-model providers behind it | Routing of request and content to the AI models | USA | | OpenAI | Image generation (optional feature) | USA | | Resend | Account and security emails | USA | | Sentry | Error and stability monitoring, without content; session replay masked | EU (Germany region) / USA | | Stripe | Payments and invoices | Ireland / USA | | Pexels | Stock photo search | USA | | Brandfetch | Logo search | USA | | Google / Apple | Optional sign-in (OAuth) | USA | Source: privacy policy, as of October 2026. For transfers to third countries we rely primarily on the EU-US Data Privacy Framework, otherwise on the EU Commission's Standard Contractual Clauses. ## What you control yourself. ### Documents, files, sharing - You can delete documents and uploaded files yourself at any time. - A share link with a random identifier only exists at your initiative. Anyone who knows the link can see the document; you can deactivate it at any time. - When you delete your account, the related content is removed irrevocably. Payment and invoice records we must keep by law, usually for up to ten years. ### Connecting ChatGPT, Claude and Grok You connect an AI assistant to your account yourself and explicitly grant the permissions (read, write, export) on our consent page. Without that consent an assistant gets no access. - Access tokens last 1 hour, refresh tokens up to 60 days. We only store them as irreversible hashes. - Download and image links last 15 minutes. - An assistant can neither delete documents nor change a plan or buy anything. Every change is saved as a version and can be undone in Slaide. - You disconnect any connection at any time in the settings; the tokens stop working immediately. > What an assistant has received from you then rests with the assistant's provider and is subject to its terms. ### Sign-in, payment, abuse protection - We only store passwords as a hash, never in plain text. - You enter card details with Stripe directly; we do not receive full payment details. - Against abuse we limit how often certain requests can be made. For this limit we only store an irreversible hash of your IP address or account identifier, and only for the relevant time window. ## What we do not promise. To create a document, your content leaves the EU: your request and the content it needs go to AI providers in the USA. We rely on the EU-US Data Privacy Framework or standard contractual clauses for this, but access by US authorities cannot be ruled out entirely. What a language-model provider does internally is outside our control. We contractually exclude use for its own purposes and for training, and we work towards processing without permanent storage. Only upload content you are entitled to process. And AI makes mistakes: check every result before you use it. - [Full privacy policy](https://www.slaide.de/privacy) ### With particularly sensitive material - Check beforehand whether processing in the USA is permitted for you - Start with a non-critical document and see how it works - If in doubt, write to us: **info@slaide.de** *We reply as quickly as we can.* ## Who is responsible, and what you are entitled to. - **Controller:** Nathalie Scholl (sole proprietorship), Im Zukunftspark 4, 74076 Heilbronn, Germany - **Contact for privacy questions:** info@slaide.de - **Data protection officer:** Not appointed, as there is no legal obligation - **Your rights:** Access, rectification, erasure, restriction of processing, data portability and objection; you can withdraw consent with effect for the future - **Supervisory authority:** The State Commissioner for Data Protection and Freedom of Information Baden-Württemberg (LfDI BW), Stuttgart - **Legal texts:** [Privacy policy](https://www.slaide.de/privacy) ## Keep reading - [Privacy policy](https://www.slaide.de/privacy): The full text, as of October 2026. - [Product](https://www.slaide.de/product): Workflow, formats and what Slaide cannot do. - [About Slaide](https://www.slaide.de/about): Who is behind it and what it is built for. ## FAQ ### Does Slaide train on my content? No. Neither we nor our providers use your content to train AI models; this is contractually excluded. For AI assistants that you connect to your account yourself, their own terms apply. ### Where are my documents stored? Account, documents and uploaded files are stored with Supabase in the EU. Document creation and rendering run on Vercel; the free PDF and Word conversions run there in the EU region. ### What goes abroad to create a document? Your request and the uploaded content relevant to it go through OpenRouter to the selected language-model providers in the USA. With optional image generation the image description goes to OpenAI. For PDF pages without a text layer (scans), an image of the page goes to OpenRouter and the model used there for text recognition. ### Do the free PowerPoint tools run on your servers? Not all of them. Compress PowerPoint, extract images, export or remove notes, split slides and replace fonts run entirely in your browser; the file is not transmitted to us. With PDF to PowerPoint and Word to PowerPoint you do upload the file to our file storage. ### Can I delete my account and my data? Yes. You delete individual documents and files yourself. When you delete your account, the related content is removed irrevocably. Records subject to commercial and tax-law retention stay blocked for the statutory period. ### How safe is the connection to ChatGPT, Claude and Grok? The connection only exists if you create it yourself and explicitly grant the permissions. Access tokens last an hour and are only stored as hashes; assistants cannot delete anything, change a plan or buy anything. You disconnect at any time in the settings.