Privacy Policy

This Privacy Policy explains what information Slides VC, Inc. ("Slides.vc," "we," "us") collects when you use slides.vc and related services (the "Service"), how we use it, who we share it with, and the choices you have.

The Service has two main kinds of users:

• Founders and team members ("Account holders") who upload documents, create share links and data rooms, and see who viewed them.
• Viewers (usually investors) who open a link or data room that an Account holder shared with them.

If you are a viewer, the Account holder who shared the link decides what the link asks you for (for example, your email) and sees the information described in "View analytics" below. We process that information on the Account holder's behalf and for running the Service.

1. How encryption works, and who can open your files

Slides.vc is built so that the contents of your uploaded files are encrypted in your browser before they reach us.

• Files are encrypted in the browser. When you upload a document, your browser encrypts it (AES-GCM) before upload. We store only the encrypted file.
• The key lives in the link. The decryption key is placed in the part of the share link after the # (the "fragment"). Browsers do not send the fragment to our servers when a viewer opens the link.
• Your account keeps a copy of the link key so you can reopen and copy your own link from any device. That copy is stored with your account on our servers. It is returned only to logged-in members of your team, and to a viewer's browser when a data room you set up authorizes that viewer to open a document in it. Access to it is restricted, our code does not use it to decrypt your files, and no one on our team opens your documents. Because that key is stored on our servers, though, we describe our encryption as protecting your files from anyone who does not have the link, not as making them technically impossible for us to read.
• Passwords. If you password-protect a link, the password is used in your browser to wrap the key. We do not store the password itself, only values derived from it that let us check a correct password.

Some information is not protected by link encryption. It is stored encrypted at rest by our database and storage provider, with keys that we and that provider hold, so we can read it:

• Page-1 image. When you upload a document, your browser creates an image of its first page and uploads it without link encryption. We use it as the thumbnail in your document and room lists, and it may become your team's default thumbnail (see below).
• Team logo and team thumbnail. Images you set in Team Settings (or that we set automatically from your first upload or your company website) are stored the same way. The team thumbnail is shown as the background of your share page's access screen and as the link preview image when a share link is pasted into apps like Slack, iMessage, email, or social networks. Anyone who has the link, including people it is forwarded to, can see this image without the key.
• AI summary (TLDR) and document details. Document titles, company names, file names, page counts, the TLDR summary (including round, raise amount, valuation, highlights, and founder names, titles, and social links found in the document), and data room names and folder labels are stored the same way.
• Account and analytics data described below.

2. Information we collect

From Account holders

• Account information: email address, name, optional profile photo, and the company or team name, website, color, logo, and profile details you add.
• Team information: names and email addresses of people you invite to your team.
• Content: encrypted documents and their versions; the items listed in Section 1 that are not link-encrypted; founder photos, links, and media you add to a TLDR or team profile; video links (YouTube, Vimeo, Loom) you add as documents.
• Sharing information: email addresses you enter when sharing a link or data room by email, and the link and room settings you choose.
• Login information: one-time login codes and login links (stored only as hashes, and they expire).

From viewers

Depending on what the Account holder requires on the link or data room:

• Email address, first name, and last name entered at the access screen.
• A random viewer ID stored in your browser's local storage for each link, so a returning visit counts as the same viewer. It is not tied to other links.
• Viewing activity: when you opened the document, which version, which pages you viewed, how long you spent on each page, and whether you opened it from a data room.
• Company logo and name for your email domain. If your email uses a company domain (not a personal provider like Gmail), we look up that domain's logo and company name (see logo.dev below) and show it to the Account holder next to your email. We send only the domain, never your full email address or name.

Viewers who enter an email get a Slides.vc account. When you enter your email at an access screen, we create a basic Slides.vc account for that email (or link the view to your existing one) so you can find documents shared with you later. We may send you a one-time welcome email with a login link, and an email when a new document is saved to your account. You can ask us to delete this account at any time (Section 9).

Automatically

• Cookies and similar storage (Section 6).
• Technical and log data: IP address, browser type (user agent), pages requested, and timestamps, collected by our hosting providers and in our server logs. We use it to run, secure, and debug the Service. For rate limiting and abuse prevention, we store IP addresses only as one-way hashes in our database. Requests we block for abuse may be logged with the IP address and user agent.
• Bot checks: Cloudflare Turnstile runs on signup, login, upload, and viewer access screens to tell people from bots.

3. How we use information

• To provide the Service: store and deliver documents, run share links and data rooms, enforce access settings, and show Account holders who viewed what.
• To send service emails: login codes and links, welcome emails, sharing emails you ask us to send, and notifications such as "a new viewer opened your document."
• To draft AI summaries (Section 4).
• To find logos and company names for teams and viewers.
• To keep the Service secure: detect abuse, spam, and attacks; rate-limit requests; block disposable or invalid email addresses.
• To understand usage of our public website in aggregate (Plausible).
• To operate the business: internal alerts about new signups and new documents, support (we look into your account only with your permission, as described in Section 5), and complying with law.

We do not sell personal information, and we do not use your documents or viewer data for advertising.

4. AI summaries (TLDR)

Our AI drafts your TLDR from your document's text and the links in it, never from the file itself, and only in these three cases. In each, your browser reads the text and sends it to our server outside the link encryption (it is still protected by HTTPS in transit), and our server passes it to Anthropic (the Claude API).

• "Auto-populate my TLDR." On the onboarding TLDR step and on a document's TLDR page, the text is read and sent only when you click this button. The suggestions fill only empty fields, and nothing is saved until you save your TLDR.
• New Document. When you add a document from your account, its text is sent at upload unless you turn on "Don't auto-populate my TLDR". The AI draft is held apart from your TLDR and is not shown to viewers. It fills in empty fields for you to review, and it is deleted when you save your TLDR.
• The Black Flag application form. When you apply through it, your deck's text is sent at upload to draft highlights and any round, raise, or valuation the deck names.

Uploads from the slides.vc homepage and new versions of a document send nothing from the document to an AI provider. We never send file names to an AI provider: the document type comes from the file's extension. When you upload, our server may also fetch your company's public homepage to fill in a description, social links, and a color; that uses nothing from your document.

Nothing from your document is kept. We do not store or log the text: it is passed to Anthropic and dropped. We store only your TLDR, which you can edit, and which is shown to viewers of your link. Anthropic processes the text under its standard commercial API terms: it does not use API inputs to train its models, and it keeps them only for a short period as set out in its terms. If our AI provider changes, we will update this section.

You can skip it. If you do not click "Auto-populate my TLDR", and you turn on "Don't auto-populate my TLDR" when you add a document from your account, none of your document's text is sent to an AI provider and you fill in the TLDR yourself. Use this if your document contains material you cannot send to an outside service, such as export-controlled information.

5. Our relationship with Harpoon Ventures and Black Flag

Slides VC, Inc. is affiliated with Harpoon Ventures and Black Flag, which are venture investors. We do not use Account holders' documents, TLDRs, data rooms, or view analytics to make investment decisions or to find deals. Only our founder, Mat Vogels, can access production data, and only with the account owner's permission, except where needed to keep the Service secure, investigate abuse, or comply with the law.

6. Cookies and local storage

We use a small number of cookies and browser storage items, all needed for the Service to work. We do not use advertising or cross-site tracking cookies.

Our public homepage uses Plausible Analytics, which does not use cookies and does not collect personal information. Cloudflare Turnstile may set or read its own data to perform its bot check. Embedded video players (YouTube via youtube-nocookie.com, Vimeo with "do not track," and Loom) may set their own cookies when you play a video.

7. Who we share information with

We share information only as described here.

With the Account holder. Viewer emails, names, logos, and viewing activity are shown to the team that shared the link. Team members can see the team's documents, rooms, and analytics.

With people you share with. Viewers see what your link shows: the document, TLDR, team logo and thumbnail, and the founder details and links you add.

With service providers (subprocessors) who process data for us:

For legal reasons. We may disclose information if required by law, subpoena, or court order, or to protect the rights, safety, or property of our users, the public, or Slides.vc. Because we hold your link key (Section 1), we could be compelled to provide it; we will notify you of such a request where the law allows.

Business transfers. If we are involved in a merger, acquisition, or sale of assets, information may be transferred as part of that deal, subject to this Policy.

8. How long we keep information

• Documents, versions, links, and their view analytics: until you delete the document. A deleted document is unavailable at once: its link stops working and it leaves every list and room. We keep its encrypted files, page images, links, and views for 7 days so it can be restored if you ask us, then delete them for good.
• Data rooms: until you delete the room.
• Team logos and thumbnails: until you replace them or your team is deleted.
• Accounts (including viewer accounts): until you ask us to delete them.
• Viewer logo lookups: refreshed about every 30 days; kept until the viewer's account is deleted.
• Sessions: 30 days. Data room access: 24 hours. Login codes: 10 minutes. Login links: 7 days.
• Server and hosting logs: 30 days.
• Backups: deleted data may remain in backups for up to 7 days after it is deleted for good, before it is overwritten.

9. Your choices and rights

• Delete a document or room yourself at any time in the app. Email hello@slides.vc within 7 days to restore a deleted document.
• Access, correct, or delete your account by emailing hello@slides.vc. We will verify the request comes from the account's email address and respond within 30 days. Deleting an account deletes its documents, rooms, and analytics, subject to backup retention.
• Viewers can ask us to delete their viewer account and the views tied to their email. You can also ask the Account holder who shared the document with you.
• Emails: login and security emails are required to use the Service. You can ask us to stop non-essential emails at hello@slides.vc.
• Do Not Track and Global Privacy Control: we do not sell or share personal information for cross-context advertising, so there is nothing to opt out of.

Depending on where you live (for example, the EU, UK, or California), you may have additional rights, such as to access, correct, delete, or port your data, to object to or restrict processing, and to complain to a data protection authority. Email hello@slides.vc to exercise them. We will not discriminate against you for doing so.

Legal bases (EEA/UK users): we process data to perform our contract with you (running the Service), for our legitimate interests (security, abuse prevention, internal alerts, improving the Service), with your consent where required, and to comply with law. For viewer data collected through an Account holder's link, the Account holder is generally the controller and we are its processor.

10. International transfers

We are based in the United States, and we and our providers store and process data in the United States. If you use the Service from elsewhere, your information will be transferred to and processed in the United States. Where required, we rely on appropriate safeguards such as the EU Standard Contractual Clauses offered by our providers.

11. Security

We use browser-side encryption for document files, HTTPS for all traffic, secure HTTP-only cookies, hashed login codes, links, and session tokens, rate limits, and bot checks. No system is perfectly secure. Anyone who has a full share link (including its key) can open that document, so share links only with people you trust and turn off links you no longer need. Items described in Section 1 as not link-encrypted are protected by our access controls, not by link encryption: only our founder can access production data, under the limits in Section 5. If we learn of a breach affecting your personal information, we will notify you as required by law.

12. Children

The Service is for business use by adults. You must be at least 18 to use it. It is not directed to anyone under 18, and we do not knowingly collect their personal information. If you believe someone under 18 has given us information, contact hello@slides.vc and we will delete it.

13. Information about other people

Documents and TLDRs often contain information about other people, such as co-founders, employees, and advisors. Account holders are responsible for having the right to upload and share that information. Anyone named in a document can contact us at hello@slides.vc, and we will work with the Account holder to address the request.

14. Changes to this Policy

We may update this Policy. If we make material changes, we will notify Account holders by email or in the app before they take effect. The "Effective date" above shows when it last changed.

15. Contact

Slides VC, Inc.
10033 Silver Maple Rd
Littleton, CO 80129
United States
hello@slides.vc