Privacy Policy

Last updated: July 22, 2026

Version 2.0 — Effective 22 July 2026

This Privacy Policy describes how Alva AI ApS, Danish company registration no. (CVR) 45 57 35 08, Klostergade 56b, 2., 8000 Aarhus C, Denmark ("Alva AI," "we," "us," or "our") processes personal data when you use the Presentable PowerPoint add-in and related backend services (the "Service").

1. What We Collect

Account information. Your username, email address, and password (stored in hashed form), which you provide when creating an account. We use these to authenticate you and manage your access to the Service.

Conversation threads. When you use the Service, the text, shapes, charts, and other content from your PowerPoint slides is sent to our backend to process your request. We store the full conversation thread — including your prompts and the AI-generated responses. See Section 6 for retention periods.

Uploaded assets. Pictures, presentations, data files, and skills that you upload to the platform are stored on our servers so they can be used in your presentations and conversations.

Voice data (dictation). If you use dictation, your audio is sent to our backend and processed by a speech-to-text model hosted in the EU to produce text. The audio is processed transiently for transcription and is not retained; the resulting text becomes part of your conversation thread.

Payment and billing information. If a subscription is purchased, payments are processed by our payment provider Stripe. Payment card details are provided directly to and stored by Stripe — we do not store full card numbers. We keep records of subscription status, charges, prepaid usage balance, and billing contact details.

Session tokens. A JSON Web Token (JWT) is stored locally on your device to maintain your session. The token is not shared with any third party and is a technically necessary authentication mechanism, not a tracking cookie.

Technical information. IP address, browser/device type, and action logs are used for operations, troubleshooting, and security.

2. How We Use Your Data

• To provide the Service — processing your requests, generating and applying slide edits, and returning results to PowerPoint
• To authenticate you — verifying your identity when you sign in
• To maintain security — detecting unauthorized access and protecting the integrity of the Service
• To support you — handling support requests and error reports
• To transcribe dictation — converting your speech to text when you use voice input
• To send invitations and service emails — for example when you or your organization invites a user
• To process payments — charging subscription fees and managing prepaid usage balances via Stripe

We do not use your data for marketing, profiling, analytics, or advertising. We do not train AI models on your data.

3. Third-Party Processing

Your slide content and conversation threads are sent to an AI Provider to generate AI responses. As of the effective date of this Policy, the Service's default models are provided under Anthropic's Claude API. Anthropic does not use API inputs or outputs to train models. Anthropic retains API inputs and outputs for up to 30 days for trust-and-safety purposes, including fraud detection and enforcement of its usage policies. Data flagged for potential policy violations may be retained for up to 24 months. For details, see Anthropic's Commercial Terms.

The current AI Provider and default model are listed at presentable.so/subprocessors. We may change AI Provider with 30 days' written notice.

Because data passes through a US-based processor, this constitutes an international data transfer under the GDPR. The transfer is based on the European Commission's Standard Contractual Clauses (SCCs, Module 2) pursuant to GDPR Article 46(2)(c). We have carried out a Transfer Impact Assessment (TIA) and implemented supplementary technical and contractual measures; the assessment is available on request via privacy@presentable.so.

We also use Hetzner Online GmbH (Germany) to host the Service's backend and store uploaded assets, and Scaleway SAS (France) to send transactional emails — such as user invitations — and to host the speech-to-text model used for dictation. Both process data within the EU.

Payments are processed by Stripe Payments Europe, Limited (Ireland). Payment card details are collected directly by Stripe and are not stored on our servers. Transfers of payment data to Stripe, Inc. (USA) are covered by the EU–US Data Privacy Framework and/or Standard Contractual Clauses. For certain purposes, such as fraud prevention and regulatory compliance, Stripe acts as an independent data controller — see Stripe's Privacy Policy.

The complete list of sub-processors is publicly available at presentable.so/subprocessors. We use no analytics services, cookie providers, or advertising networks.

4. The Microsoft Office Platform

Presentable operates as a third-party add-in within Microsoft Office. Microsoft may independently collect telemetry and usage data through the Office platform in accordance with Microsoft's own privacy terms. We do not control and do not have access to data collected by Microsoft. Your relationship with Microsoft and the processing Microsoft carries out are governed by the Microsoft Privacy Statement.

5. Where Your Data Is Stored

Our backend server is hosted in the European Union (Hetzner, Germany). Your account information, conversation threads, and uploaded assets are stored there. Dictation audio and transactional emails are processed by Scaleway in the EU (France). Transfers outside the EU/EEA occur only as described in Section 3.

6. How Long We Keep Your Data

• Account information and action logs — retained for as long as your account is active. Deleted upon account deletion, and no later than 30 days after the underlying subscription ends.
• Conversation threads — retained for as long as your account is active, so you can return to previous conversations. You can delete individual threads at any time via the Service's settings or by contacting us. Deleted upon account deletion, and no later than 30 days after the underlying subscription ends.
• Uploaded assets — retained for as long as your account is active. Deleted upon account deletion, and no later than 30 days after the underlying subscription ends.
• Dictation audio — processed transiently for transcription and not stored after the text has been produced.
• Anthropic retention — API inputs and outputs are retained by Anthropic for up to 30 days; flagged material for up to 24 months.
• JWT tokens — stored locally on your device and expire automatically. Cleared when you sign out.
• Billing records — retained for 5 years from the end of the relevant financial year, as required by the Danish Bookkeeping Act (bogføringsloven).

7. Personal Data Breaches

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Danish Data Protection Agency (Datatilsynet) without undue delay and no later than 72 hours after becoming aware of the breach, in accordance with GDPR Article 33. Where the breach is likely to result in a high risk, we will also notify the affected individuals without undue delay, in accordance with GDPR Article 34.

8. Legal Basis (GDPR Article 6)

• Contract (Art. 6(1)(b)). Processing account information and slide content is necessary to provide the Service you have requested.
• Legitimate interest (Art. 6(1)(f)). Maintaining the security of the Service, detecting unauthorized access, and sending user invitations at your or your organization's request.
• Legal obligation (Art. 6(1)(c)). Retention of billing records under the Danish Bookkeeping Act.

For users who access the Service through an employer or organization account, that organization is the data controller and Alva AI is the data processor. The legal basis for the content itself is assessed by the data controller.

9. Automated Decision-Making

The Service generates AI-based suggestions and edits in response to your requests, but no automated decisions are made about you that have legal effects or similarly significantly affect you, cf. GDPR Article 22. All AI-generated material requires your approval before use.

10. Your Rights

Under the GDPR, you have the right to:

• Access the personal data we hold about you (Art. 15)
• Rectify inaccurate data (Art. 16)
• Delete your account and associated data (Art. 17)
• Restrict processing (Art. 18)
• Object to processing based on legitimate interest (Art. 21)
• Data portability — receive your data in a structured, commonly used, machine-readable format (Art. 20)
• Lodge a complaint with the Danish Data Protection Agency (Datatilsynet, Borgergade 28, 5., 1300 Copenhagen K, Denmark, dt@datatilsynet.dk) or your local supervisory authority

You can exercise your rights by contacting privacy@presentable.so. We respond within one month, in accordance with GDPR Article 12(3).

11. Children

The Service is not directed at individuals under the age of 18. We do not knowingly process personal data of children. If you believe a child has provided us with personal data, contact privacy@presentable.so and we will delete it promptly.

12. Cookies and Local Technologies

We do not use tracking cookies, analytics cookies, or marketing cookies on presentable.so or in the Service. We use only technically necessary authentication mechanisms (JWT), which are not subject to consent requirements under the ePrivacy Directive. During checkout, our payment provider Stripe may set strictly necessary cookies for payment processing and fraud prevention.

13. Data Protection Officer (DPO)

We have not designated a formal DPO, as we do not meet the criteria in GDPR Article 37 (we do not carry out regular and systematic large-scale monitoring and do not process special categories of data on a large scale). For data protection inquiries, contact privacy@presentable.so, where inquiries are handled by our GDPR lead.

14. Changes

We may update this Privacy Policy to reflect changes in the Service or applicable law. Material changes will be communicated through the Service or by email, with a revised effective date.

15. Contact

Alva AI ApS
CVR no. 45 57 35 08
Klostergade 56b, 2., 8000 Aarhus C, Denmark
Privacy: privacy@presentable.so
General: hello@presentable.so