How we protect your presentations
We treat every presentation as confidential. Here is exactly where your files go, who can see them, and how AI is involved.
Access to your files
Your decks are stored in a folder that belongs to your account, and you sign in with Google, Apple or a one-time email link to use them. Your files are not shared with other customers. Conversions are automatic. No one at PurposefulDeck opens your files unless you ask: the check by a person is optional and off unless you request it for a deck, and only the founder does it. Founder view opens a deck's files only when its owner asked for a check. Download links expire; anyone with a valid link may be able to use it until it expires, so share links carefully.
Encrypted on Google Cloud
Files travel over encrypted HTTPS connections and are stored encrypted on Google Cloud.
Delete whenever you want
You can delete a conversion from your dashboard; its uploaded deck, previews and output files are removed, and you're told if that couldn't finish. Our policy is to delete a conversion's files 30 days after it finishes. When you start a conversion you can also choose to have its files deleted an hour after you first download it. For confidential or internal decks, zero-retention mode in Settings does that for every deck, converts each without AI, and deletes a deck you never download 24 hours after you start it. Your saved logo, fonts and templates are kept so you can reuse them. If your organisation needs a different retention period, email us before uploading.
How AI is used
Slides are placed into your template by fixed rules, not by AI. If you upload a brand guide, Google's Gemini AI (through Google Cloud Vertex AI) reads it to suggest brand settings. Gemini also reads the printed numbers in bar, column, pie, donut and line chart pictures (a chart is only rebuilt when those numbers match the bars, slices or points in the picture) and, if you choose to rebuild picture slides, the layout of those pictures (their words are only used when a second, offline text reader finds them too). On slides whose words are drawn as shapes rather than typed (so there is no text to copy), Gemini also looks at the slide's picture to check the title's wording, which a second, offline text reader finds first, and to find any charts in it; the rest of such a slide stays a picture. AI never writes your content, and we don't use your files to train AI. You can also convert a deck without AI: tick "Don't use AI on this deck" and nothing in it goes to an AI model. Google Cloud's terms say Google won't use them to train its models without our permission; Google may keep a request only if its automated safety checks flag it as possible abuse, and then for up to 90 days, in the same region, to check it. Links in your original deck can stay in the PowerPoint; we never open them.
Your right to convert
Each time you convert, you confirm the files are yours, your organisation's, or that their owner allowed it, and we record that. Decks your organisation labelled "Confidential" are flagged so you can check its rules first. We never remove passwords, copy restrictions or rights management: protected files are refused before any credit is used.
Choosing from OneDrive, SharePoint or Google Drive
When you choose a deck from OneDrive, SharePoint or Google Drive, you sign in to Microsoft or Google in your own browser and pick one deck. Your browser copies that deck to PurposefulDeck over an encrypted connection, and from then on it is handled exactly like an upload, with the same privacy choices. Microsoft asks you to let PurposefulDeck read your files so you can browse them; Google asks only for the file you pick. Your Microsoft or Google sign-in stays in that browser tab and ends when you leave the page: we never receive or store it, keep no connection to your account, and never change or delete anything there. Only the deck you choose is copied, never the names or contents of your other files. The client template and your brand kit's logo, brand guide and font files can be chosen the same way. Microsoft shows PurposefulDeck as a verified publisher (WisdomDeep Digital); your organisation's IT team may need to approve it once.
Using PurposefulDeck for confidential decks
- Conversions are automatic. There are no outside designers or contractors; the optional check by a person is done only by the founder, and only when you request it.
- Slides are placed by fixed rules, not AI. Gemini AI reads only the parts listed above, and we don't use your files to train AI.
- Your files are stored and converted in Google Cloud's Singapore region, in a folder that belongs to your account.
- Conversion files are deleted 30 days after the conversion finishes, and you can delete them sooner from your dashboard.
- A PowerPoint chart copied across keeps its Excel data, including any other sheets in that workbook, as it does when you copy a chart in PowerPoint. Remove sheets you don't want in the finished deck before uploading.
- We don't yet offer single sign-on, an on-premise version or SOC 2 certification. We do not claim SOC 2. Email [email protected] with the subject "Data processing agreement" if your organisation needs a DPA.
If your client's agreement limits outside services, check it before uploading. Every provider that handles your information is listed below and in our Privacy policy.
Where a deck goes, and when it is deleted
This diagram shows every place your deck travels, from upload to deletion, and what each outside service receives.
Open the diagram full size to save or print it.
Companies that handle your data
These are all the outside companies (sub-processors) that handle customer data. Google Analytics and Microsoft Clarity also run on our public pages, only if you allow them, and never on sign-in, account, deck or payment pages. If your organisation has a data processing agreement with us, we email you at least 30 days before adding a company that would handle your files.
Google Cloud · Singapore
Hosting, file storage, the database and running conversions. Receives: your decks, templates, brand files, results and account records.
Google Vertex AI (Gemini) · Singapore
The limited AI reads described above. Receives: only the pictures or text it reads, never for a deck converted without AI.
Cloudflare · Global network
Delivers and protects the website. Receives: website traffic on its way to Google Cloud.
Amazon Web Services (Simple Email Service) · Mumbai, India
Sign-in, invoice and deck emails. Receives: your email address and the email's text, never your files.
PayPal · PayPal's own locations
Payments. Receives: the pack you buy and its price, never your files.
Razorpay · India
Payments in India. Receives: the pack you buy, its price and your email, never your files.
Google and Apple sign-in · Their own locations
Signing in, if you choose them. Receives: your email address and name.
Certifications, and what we don't have yet
PurposefulDeck runs on Google Cloud, which holds ISO/IEC 27001, 27017 and 27018 certificates and SOC 1, 2 and 3 reports for its infrastructure. Your security team can download Google's certificates and its public SOC 3 report from Google's Compliance Reports Manager. Those cover Google's data centres and services, not PurposefulDeck itself. We don't yet have:
- A SOC 2 report or ISO 27001 certificate of our own
- Single sign-on (SAML)
- Your own encryption keys
- Storage and processing in India, the EU or the US (today: Singapore only)
- An admin switch that turns AI off for a whole organisation (today: per deck, or for every deck of an account)
- An independent penetration test
Security questionnaire and data processing agreement
We have pre-filled answers to the usual security questions (encryption, access, backups, breach response and AI), grouped like the Cloud Security Alliance's CAIQ, and can copy them into your organisation's own form. Email [email protected] with the subject "Security questionnaire".
There is no downloadable DPA on this site yet (a lawyer still has to review it). If your organisation needs one, email [email protected] with the subject "Data processing agreement". What we already do: files stay in Google Cloud Singapore, we do not use them to train AI, conversions are automatic, and only the founder opens a deck, and only when you ask.
Report a security issue
If you find a security problem on purposefuldeck.com, email [email protected] with the subject "Security issue" and the steps to see it. Please don't open other people's files or share the problem publicly before we fix it. A person replies within 2 working days and tells you when it is fixed.
Have a specific security question?
Email [email protected] and a person will reply. We can also discuss data agreements for your organisation. The full details are in our Privacy policy and Terms of service.