Privacy Policy
This Privacy Policy explains what personal information PivotDeck collects, how we use and share it, and the choices you have.
1. Introduction
PriorityAlpha LLC, a Delaware limited liability company (United States) ("PivotDeck", "we", "us", or "our") operates the PivotDeck presentation platform. This Privacy Policy describes how we handle personal information in connection with the PivotDeck website, applications, and related services (the "Service").
Capitalized terms not defined here have the meaning given in our Terms of Service.
2. Our role: controller and processor
PivotDeck serves two groups of people, and our role differs for each. Which one you are determines how the rest of this policy applies to you.
- Account holders — presenters and administrators — sign in, build Decks, and run Sessions. We determine the purposes and means of processing their account information, and act as the controller (or "business") for it.
- Audience members hold no account. They join a Session and respond to questions. Where a Deck asks for information at join, the presenter's Organization decides what is asked and why: that Organization is the controller, and we act as its processor (or "service provider").
If you took part in someone's presentation and want your join record removed, the fastest route is the organization that ran the Session. You may also write to privacy@pivotdeck.io and we will help you reach them.
3. Information we collect
Information you provide
- Account information: your email address and, where your identity provider supplies it, your name. Sign-in is handled by WorkOS; we do not receive or store your password.
- Content: the Decks, Slides, speaker notes, images, video, audio, and other material you create or upload, together with their version history.
- Organization information: your Organization membership and role, and the invitations you send or accept.
- Communications: the messages you send us, including support and privacy requests.
- Billing information: if your Organization buys a plan or an Event Pass, the purchase is made through our payment provider, Paddle. Paddle collects the name, email address, billing address, and payment details you enter at its checkout; we never receive or store your card number. We receive and keep the identifiers Paddle assigns to your customer record and subscription, the plan or Pass bought, the number of seats, its renewal date and status, and a record of each billing event Paddle reports to us.
- Invite requests: if you ask for an invite while PivotDeck is invite-only, we collect the email address you submit and the optional note about how you would use PivotDeck, and store them only after you click the confirmation link we email you (unconfirmed requests are deleted automatically within 48 hours). We use this information to respond to your request and to email you about availability and your invite — nothing else. Every such email includes an unsubscribe link; unsubscribing deletes your request. We keep a confirmed request until we send you an invite, you unsubscribe, or the invite-only period ends.
Information we collect automatically
- Log and device information: IP address, browser type and version, operating system, referring page, and the date and time of each request.
- Usage information: operational records such as which Decks were presented and when, administrative audit events, and counts of AI feature usage. Prompt and response text is not stored in those records.
- Local storage: data stored in your browser to keep you signed in and to keep your work available while you edit.
Audience participation information
- Responses: votes, reactions, questions, and free-text answers submitted during a Session. They are not displayed or exported with an audience member's name or email address. The Service uses an internal participant identifier to operate the Session and enforce participation limits.
- Join information: where a Deck asks for it, a name, or a name and email address, recorded as attendance for that Session.
- Follow-up opt-in: where a presentation offers it, its closing screen on your device may ask whether you would like the presentation's links by email. If you enter an email address there, it is used to send you one follow-up email for that Session on the presenting Organization's behalf, carrying the presentation's closing links and an optional note from the presenter. The address is collected only for that send, is kept separate from any attendance record, and is never added to any PivotDeck mailing list. The email includes an opt-out link that clears the opt-in and deletes the address. If you enter nothing, no follow-up email is sent.
- Session credential: a short-lived credential held on the participant's device. We store only a hash of it; it is scoped to a single Session and expires 24 hours after it is issued.
4. How we use information
We use personal information to:
- provide, operate, and maintain the Service, including hosting your content and running live Sessions;
- authenticate you and secure your account and our systems;
- generate the output you request from AI features;
- communicate with you about the Service, including transactional email such as invitations and account notices;
- process purchases, apply the plan or Pass your Organization has bought, and manage renewals and cancellations;
- monitor, troubleshoot, and improve the reliability and performance of the Service;
- detect, investigate, and prevent fraud, abuse, and violations of our Terms; and
- comply with legal obligations and enforce our agreements.
We do not use your content or audience responses for advertising, and we do not sell personal information.
5. Legal bases for processing
Where the EU or UK General Data Protection Regulation applies, we rely on the following legal bases: performance of our contract with you, to provide the Service; our legitimate interests in securing the Service, preventing abuse, improving reliability, and communicating with our users, balanced against your rights; compliance with legal obligations; and your consent, where we ask for it.
Where we act as a processor on an Organization's behalf — including for audience join information — that Organization is responsible for establishing the legal basis for its own collection.
7. Cookies and similar technologies
We use cookies and browser storage that are strictly necessary to operate the Service: to sign you in, to maintain your session, and to keep your work available in the editor. We do not use advertising cookies or cross-site tracking, and no third-party analytics provider is enabled. Blocking necessary cookies will prevent sign-in from working.
8. Data retention
We retain personal information for as long as it is needed to provide the Service and for the purposes described in this policy, and afterwards as required to comply with legal obligations, resolve disputes, and enforce our agreements. In particular:
- Account information is retained while your account is active and until you ask us to delete it.
- Deleting a Deck moves it to Trash, from which it can be restored. Organization-level deletions carry a grace period before they take effect and can be cancelled within it.
- Uploaded files that are no longer referenced by any Deck or restorable version are removed by a routine sweep.
- An audience member's Session credential expires 24 hours after it is issued.
- Administrative audit records are retained for security and accountability. Where such a record concerns an account deletion, we store the email domain rather than the address.
- Records of purchases and subscription events are retained for as long as needed for accounting, tax, and dispute purposes. Invoices and payment records are held by Paddle under its own retention rules.
- Copies of deleted information may remain in backups after deletion.
9. Data security
We maintain technical and organizational measures intended to protect personal information, including encryption of data in transit, authentication handled by a specialist identity provider, role-based access controls within an Organization, hashed and short-lived audience session credentials, and validation of uploaded files. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security.
If you become aware of a security issue, please write to privacy@pivotdeck.io.
10. International data transfers
We are based in the United States, and personal information we process is stored and processed there and in other countries where our service providers operate. Those countries may have data-protection laws that differ from the laws where you live. If you access the Service from outside the United States, you understand that your information will be transferred to and processed in the United States.
11. Your privacy rights
Depending on where you live, you may have the right to access the personal information we hold about you, to receive a copy of it, to correct or delete it, to object to or restrict certain processing, and to withdraw consent where processing is based on consent. To exercise a right, write to privacy@pivotdeck.io. We will respond within the time applicable law requires, and we may need to verify your identity before we act.
Account deletion is performed either by anonymizing your account or by erasing it, at your choice.
California residents have the rights described above and will not be discriminated against for exercising them. We have not sold or shared personal information in the preceding twelve months.
If you are in the EEA, the UK, or Switzerland, you also have the right to lodge a complaint with your local supervisory authority.
If you are an audience member, a request about a join record is usually best directed to the organization that ran the Session (see Section 2).
12. Children's privacy
The Service is not directed to children, and account holders must be 18 or older. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, write to privacy@pivotdeck.io and we will delete it.
Where PivotDeck is used in a classroom or another setting in which an audience may include minors, the school or educator running the Session decides what the Deck asks for. Where permitted by applicable law, a school may authorize collection on behalf of a parent when the Service is used solely for a school-authorized educational purpose. Schools and educators are responsible for notices and authorizations required of them, and PivotDeck remains responsible for obligations that apply to us as the operator of the Service.
We do not ask audience members to create accounts. In addition to responses and information requested by the Deck, we process the limited device, request, and session information described in Section 3.
13. Third-party links and embedded content
A Deck may link to or embed material hosted by third parties. This policy does not apply to those sites and services, and we are not responsible for their privacy practices. Review their policies before providing them with information.
14. Changes to this policy
We may update this policy from time to time. When a change is material, we will revise the version identifier and effective date shown at the top of this page and notify account holders, and where required we will ask you to review and accept it again. The version your account accepted is recorded, so what you were shown remains knowable later.
15. Contact us
PriorityAlpha LLC. Privacy questions and data requests: privacy@pivotdeck.io. Questions about our Terms of Service: legal@pivotdeck.io.