Privacy and your content
SlideSay is being built by Bairat Labs. Google sign-in, AWS storage, and brand planning are available. Stripe handles subscription payments.
Google sign-in
Google is the only sign-in method. The authentication flow uses Amazon Cognito and requests your name, email address, and account identifier. SlideSay does not ask for access to your Gmail, contacts, calendar, or Google Drive. An essential, HTTP-only session cookie keeps you signed in.
Agency teams
Agency includes an owner and up to two invited members, each using a separate Google login. We store invitation email addresses, membership identifiers and access history on AWS. Invitations expire after seven days and can only be accepted by the named Google account. Invitation tokens are stored as hashes. A separate essential cookie remembers your selected workspace. The invitation page temporarily keeps the link in browser session storage during Google sign-in and clears it on acceptance.
Members can access the agency's campaigns, slides, account analysis, publishing and supported comment replies. Billing, social connections and access management remain with the owner. Members share the owner's plan allowance. Removing a member blocks new requests; work already submitted or scheduled remains in the workspace. Team access pauses if the owner's Agency plan ends. Team access history is scheduled for deletion after 90 days; database cleanup can take additional time. Emails, invitation tokens and membership identifiers are not sent to Google Analytics.
Brand details and slides
Your brand details, audience, goals, approved facts, and suggested plans are stored in your account on AWS. Generated and saved workspaces use private S3 storage. Do not include confidential personal information in your brief. SlideSay does not automatically scan the website you enter in your brief.
If you choose to start from your website, SlideSay fetches that one public page once at your request. We do not follow its links or read other pages. Its visible text is sent to our AI provider on AWS to draft your brand details, which you can edit. The drafted details for that address are kept for up to 24 hours so a repeat request for the same page is not processed again, and are saved in your account with your plan.
Onboarding files and brand assets
Optional onboarding assistance accepts typed context, Markdown or text handoffs, brand instructions and design reference notes. When you choose Suggest my answers, that text is sent to Amazon Bedrock to extract suggested fields. We do not execute document instructions, open links, or send the documents to Google Analytics. Review suggestions before applying them. Confirmed answers, brand instructions, design notes and an optional logo are saved with your plan. Original uploaded text files are not stored separately. Logos are resized in your browser and used as editable slide layers; they are not sent to the text extraction model.
Research attached to a post
If you choose a reviewed research finding as inspiration, its source links, observation, dates and limitations are saved with your private post brief. During slide generation, this context is sent to Amazon Bedrock separately from your brand facts to guide the experiment. Remove the finding before saving if you do not want it used. Opening a source link takes you to that third-party site, whose own privacy practices apply. We do not automatically fetch that page from your browser or collect your browsing history.
Optional voice notes
Recording starts only when you choose Record a voice note and allow microphone access. You can listen to or discard the recording before sending it. Choosing Transcribe sends up to 60 seconds of audio to Amazon Transcribe through private AWS storage. Temporary audio and transcript files are scheduled to expire after one day; AWS lifecycle deletion can take additional time. Job metadata has a one-day expiry in our database and is removed asynchronously. AWS may retain service job metadata under its own retention settings. The transcript is added to your editable brief or slide-assistant message. It is not automatically saved as an approved fact or sent to Google Analytics. Microphone access is optional.
Optional slide assistant
When you ask the slide assistant, your selected slide’s headline and body, recent conversation, approved brand facts and writing rules are sent to Amazon Bedrock to suggest an edit or answer your question. Conversation history stays in the current editor session and is not saved as a chat archive. Only edits you apply and save become part of your workspace. Messages and suggestions are not sent to Google Analytics. Optional spoken replies use a local device voice when one is available; playback starts only when you choose it.
AI agent connections
You can create an expiring token for a trusted external agent. We store a cryptographic hash, your chosen permissions, name, expiry and revocation status. The token is shown once. Depending on permissions, the agent can read saved slide text, request AI suggestions, and submit proposed edits. Sharing a token lets that agent access this content; its own privacy terms apply. Tokens cannot manage billing or publish. Proposals include original and suggested text, an explanation and connection identifier. They expire after 24 hours and are removed asynchronously. Only your signed-in approval can save a proposed edit. Revoke a connection in AI agents to stop further access.
OpenAI recommendations and cover images
Subscriber recommendations send your brand description, audience, approved facts, selected writing directions and relevant research notes to OpenAI GPT-6 Astra. The free planning preview uses Amazon Bedrock. AI slideshow creation sends the slideshow topic, cover headline, brand color and design-reference notes to OpenAI GPT Image 2.5 to create a cover image. We do not send your uploaded logo or supporting pictures to this image-generation endpoint. Generated images are saved privately with your workspace on AWS. Text, logos and layouts remain editable.
We disable OpenAI Responses storage for recommendation calls. This is not a promise of zero provider retention; OpenAI's API data policies apply. We record model identifiers, token totals and estimated costs for usage limits, without placing prompts or API keys in application logs or Google Analytics. Review AI outputs before publishing.
AI generation and billing
After an active paid or complimentary plan is verified, the generation worker sends your brand brief and planned ideas to a model through Amazon Bedrock. Generated content can make mistakes and needs your review. Stripe handles checkout and billing. SlideSay stores subscription identifiers and access status, not your complete payment-card details.
For complimentary access, we store the plan, grant date, expiry, usage, an internal reason and the administrator who granted or revoked it. A hashed email lookup links grants to your verified Google sign-in. Complimentary access does not create a payment or automatic renewal.
Guarantee and usage records
We store payment dates, subscription identifiers and AI usage counts to administer the seven-day money-back guarantee. It covers the first subscription payment only and requires less than 10% of the monthly AI allowance used: at most 1 slideshow on Starter or 5 on Creator or Agency. Manual edits, library creations and repeat exports do not count. No reason is required for a qualifying refund request. See the full refund terms and request instructions.
Saving and exports
Use Save changes in the editor to save to your account. The editor no longer restores the old anonymous browser workspace. Downloaded images and backups remain separate files on your device.
Connected TikTok accounts (setup preview)
TikTok connections are optional and separate from Google sign-in. When enabled for an invited account, we store the account identifier, display name, permission expiry and encrypted access and refresh tokens on AWS. We use those tokens to read the account’s current posting settings and renew the connection. We do not receive your TikTok password or request direct-message access. Private TikTok photo publishing is enabled for the pilot. Public post counters require separate Display API permission and availability; private posts may not return metrics.
Disconnect in TikTok connections to remove the active stored tokens. We also request revocation from TikTok; if that request fails, the screen asks you to remove SlideSay in TikTok’s app permissions. Disconnecting does not remove content already posted on TikTok. For removal of retained connection records, follow our data deletion instructions.
Connected Instagram accounts (private pilot)
Instagram publishing is being tested with invited accounts. Connecting an account is optional and separate from Google sign-in. If you connect, we store your Instagram account identifier, username, permission expiry and encrypted access token on AWS. We do not receive your Instagram password. We request basic account and content-publishing access. Analytics and comment management request additional permissions when available. We do not request direct-message access.
When you prepare a post, we store a separate copy of the selected slides. After you approve the images, captions, accounts and timing, we send those images and captions to Instagram to publish on your behalf. Publishing copies are scheduled for removal from active storage after 37 days; saved editor workspaces are separate. AWS backup and object version retention can keep recovery copies longer. We keep publishing history and delivery results to show what happened to your posts.
Disconnect an account in Publishing to remove its active stored token and stop pending deliveries for that connection. A post already being sent may finish; disconnecting does not delete posts already on Instagram. You can also revoke SlideSay in Instagram's app permissions. For connected-account data removal, contact bairatlabs@gmail.com. Follow our data deletion instructions to request removal of connected-account records or your saved content.
Post analytics and comment replies
With your authorization and platform approval, we retrieve metrics for posts published through SlideSay. We keep up to 180 daily snapshots per post. Missing or unsupported metrics stay unavailable. Disconnecting stops future collection; contact us through the data deletion page to remove retained records.
Instagram comment access lets you read comments on your published posts and send a public reply that you approve. If you select Draft with AI, the selected comment and post title are sent to Amazon Bedrock to prepare a suggestion. Review it before sending. Reply tone is selected in the editor. We retain a reply identifier, a content hash and delivery status for up to 180 days to prevent duplicate sends. We do not send comment text to Google Analytics. TikTok comment replies require separate Business API approval and are not enabled.
Connected account review
After you connect an account, SlideSay can review up to 60 accessible posts from the last 90 days, including captions, dates and available engagement totals. For Instagram, we may sample up to 10 comments on each of three recent posts. We do not retrieve private messages or TikTok comment text for this review. Captions and comment samples are processed by Amazon Bedrock to suggest writing patterns and topics. Only directions you choose are offered for new campaign briefs.
Imported account history and findings expire after 90 days and can be removed from Account review. Raw comment samples are discarded when analysis finishes or fails; interrupted samples expire with the review. A disconnect makes the review unavailable. Writing rules you select for a campaign stay with that campaign until it is deleted. Source captions, comments and findings are not sent to Google Analytics.
Website analytics preferences
Optional Google Analytics is enabled only after you choose Allow analytics. It receives sanitized page paths, static interface identifiers, plan and access type, feature counts, processing times and success/error categories. This helps us understand beta usage and improve onboarding, generation, editing and downloads. We do not send slide content, comments, form values, account handles, email addresses or authentication URL parameters. We do not use session replay or advertising personalization. You can decline or withdraw consent using Analytics preferences. We honor Global Privacy Control and Do Not Track. Before public launch, we will publish the verified support/privacy contact, retention periods, and account deletion process, and complete the live service checks. The development build is excluded from search indexing.