Privacy Policy

This Privacy Policy explains how Get Buyr Inc. d/b/a Decky (“Decky,” “we,” “our,” or “us”) collects, uses, discloses, retains, and protects personal information in connection with our websites, software-as-a-service platform, web applications, browser extensions, application programming interfaces, Model Context Protocol services, integrations, support services, and related products and services (collectively, the “Services”).

Decky provides an AI-powered presentation platform that enables users and organizations to create, edit, manage, review, and govern presentations in Google Slides, Microsoft PowerPoint, and other supported environments.

This Privacy Policy does not apply to third-party products or services that you connect to Decky. Those third parties process information under their own terms and privacy policies.

The Services are provided by:

• Get Buyr Inc. d/b/a Decky
• 3019 SW Hampshire St
• Portland, OR 97205
• United States

Privacy, security, and support inquiries may be sent to support@decky.ai.

Depending on the context, Decky may act as either a controller or processor of personal information. Decky generally acts as a controller when processing website visitor information, account information, billing information, support communications, security information, analytics information, and business contact information for its own purposes.

When Decky processes presentations, documents, prompts, brand materials, connected business data, generated output, or other content on behalf of an organization, Decky generally acts as that organization’s processor or service provider. In those circumstances, the organization determines the purposes for which personal information contained in Customer Content is processed.

Business customers may enter into a separate order form, enterprise agreement, subscription agreement, Data Processing Addendum, Business Associate Agreement, or other written agreement with Decky. To the extent such an agreement conflicts with this Privacy Policy concerning Customer Content, the applicable written agreement will control.

2.1 Account and identity information

We may collect information used to create, administer, authenticate, and secure an account, including:

• Name.
• Business email address.
• Organization name.
• Job title or professional role.
• Account identifiers.
• Workspace membership.
• User role and permissions.
• Profile information.
• Authentication and session information.
• Single sign-on or OAuth identifiers.
• Team invitation and acceptance information.
• Account status.
• Subscription information.

Authentication credentials may be managed by Decky’s authentication providers or by your organization’s identity provider. Decky does not receive your password from third-party single sign-on providers.

2.2 Customer Content

“Customer Content” means content, materials, data, logos, images, brand assets, documents, prompts, and information submitted to, uploaded to, connected to, generated through, or otherwise processed by the Services on behalf of a customer or user.

Customer Content may include:

• Microsoft PowerPoint files.
• Google Slides presentations.
• Individual slides, slide libraries, layouts, and master decks.
• Templates and approved presentation materials.
• Logos, fonts, colors, images, illustrations, and other brand assets.
• Brand guidelines and design standards.
• Prompts, instructions, presentation briefs, and requests.
• Files, attachments, reports, spreadsheets, and business data.
• Information retrieved through customer-authorized integrations.
• Generated presentations, slides, text, images, speaker notes, citations, and other output.
• Review comments, approvals, ratings, and feedback.
• Version histories.
• Presentation titles, owners, creation dates, and file identifiers.
• Information about source materials used to create or update an output.

The Services may extract and store brand assets, including logos, fonts, templates, brand guidelines, images, and similar design elements from presentations or other materials uploaded to Decky. These extracted materials remain Customer Content. Customers retain ownership of their Customer Content, subject to the rights granted to Decky under the applicable Terms of Service or customer agreement.

2.3 Sensitive and confidential information

Customer Content may contain confidential or sensitive business information, including:

• Financial information.
• Strategic plans.
• Board materials.
• Customer information.
• Employee information.
• Healthcare-related information.
• Sales and marketing information.
• Proprietary business information.
• Trade secrets.

Customers and users are responsible for ensuring that they have the rights, permissions, consents, and lawful basis necessary to submit Customer Content to Decky.

Unless Decky has expressly agreed otherwise in writing, the Services are not intended to process protected health information regulated by HIPAA, complete payment-card information, government identification numbers, highly sensitive authentication credentials, or information subject to specialized legal or regulatory requirements that are not addressed by the applicable customer agreement.

Customers must not submit protected health information regulated by HIPAA unless Decky has entered into a Business Associate Agreement with the customer and expressly agreed in writing to process such information.

2.4 Workspace administration and collaboration information

When the Services are used through an organization-managed workspace, we may process:

• Workspace membership.
• Organizational roles.
• User permissions and access levels.
• Account creation, suspension, and deactivation activity.
• Presentation generation history.
• User prompts and presentation requests.
• Uploaded source files and attachments.
• Templates, assets, libraries, and source materials used.
• Generated presentations and other output.
• Review comments.
• Approval and publishing activity.
• Dates and times associated with workspace activity.
• Audit and security logs.
• Usage, storage, credit, and quota information.
• Information about whether content complies with organization-defined standards or workflows.

Authorized organization administrators may view users’ prompts, uploaded source files, generated presentations, review comments, approvals, publishing activity, and usage history. Customer Content uploaded to a shared workspace may also be viewed, edited, exported, or otherwise accessed by other users with appropriate permissions. Organizations are responsible for managing user access, permissions, and administrator roles within their workspaces.

2.5 Integration information

When a user or organization connects a third-party system to Decky, we may receive information authorized through that connection. Depending on the integration and the permissions selected, this may include information from Google Workspace, Google Drive, Google Slides, Microsoft products and services, customer relationship management platforms, document and knowledge-management systems, data warehouses and reporting systems, enterprise search platforms, AI assistants, and other systems selected by the customer.

Decky processes integration data to provide requested functionality, such as:

• Finding approved content.
• Retrieving presentation templates.
• Accessing customer-authorized business data.
• Creating or updating a presentation.
• Generating citations.
• Saving output to a customer-selected location.
• Returning presentation status or metadata.
• Supporting customer-configured workflows.

Decky does not access a third-party account or system unless that access has been authorized by the user, customer, or relevant administrator.

2.6 Usage, device, and technical information

We may automatically collect technical and usage information, including:

• IP address.
• Browser type.
• Device type.
• Operating system.
• Application or extension version.
• Pages and features accessed.
• Dates and times of access.
• Referring pages.
• Authentication and session events.
• API requests and response status.
• Product interaction information.
• Clicks and navigation activity.
• Performance information.
• Error reports.
• Diagnostic logs.
• Security events.
• Suspected fraud, abuse, or unauthorized activity.

2.7 Website, sales, and support information

We may collect information when you request a demonstration, contact customer support, submit a website form, communicate with our sales or customer-success teams, participate in a survey or customer interview, attend an event, or subscribe to product or marketing communications.

This information may include:

• Name.
• Business contact information.
• Company.
• Job title.
• Communication history.
• Support requests.
• Product feedback.
• Information you choose to provide.

We may also receive limited professional contact information from referrals, business partners, event organizers, service providers, and publicly available business sources.

2.8 Billing and transaction information

When paid Services are purchased, Decky and its payment providers may process:

• Billing contact information.
• Subscription details.
• Transaction history.
• Payment status.
• Tax information.
• Invoice information.

Payment-card information is processed by Decky’s third-party payment provider. Decky does not store complete payment-card numbers.

Decky may use information to:

• Create and administer accounts and workspaces.
• Authenticate users.
• Support single sign-on and access controls.
• Provide presentation generation, editing, management, and export functionality.
• Analyze customer-provided materials.
• Extract and organize brand assets.
• Create organization-specific templates, libraries, and brand configurations.
• Retrieve customer-authorized information from connected systems.
• Generate presentations, slides, text, images, speaker notes, citations, and related content.
• Save or deliver output to customer-selected destinations.
• Provide workspace collaboration.
• Provide enterprise permissions and governance.
• Provide presentation review and approval workflows.
• Maintain version histories and audit trails.
• Apply customer feedback and configuration to the applicable customer workspace.
• Provide APIs, Model Context Protocol services, browser extensions, and integrations.
• Measure usage and manage storage, subscriptions, seats, credits, and generation limits.
• Process payments.
• Provide support.
• Respond to inquiries and requests.
• Maintain, troubleshoot, test, evaluate, and improve the Services.
• Secure the Services.
• Prevent fraud, abuse, and unauthorized access.
• Investigate security incidents.
• Enforce our agreements.
• Comply with legal obligations.
• Communicate about account, service, security, and product matters.
• Send marketing communications where permitted by law.
• Create aggregated or deidentified information that does not reasonably identify an individual.

Decky does not use Customer Content to create advertising profiles or target advertisements to individual users. Decky does not make decisions about individuals that produce legal or similarly significant effects solely through automated processing.

Decky uses artificial intelligence, machine-learning services, and large language model technologies to provide presentation generation, image generation, content analysis, document understanding, and related functionality.

Decky may transmit portions of Customer Content to third-party artificial intelligence providers solely to generate requested output and provide AI-powered functionality. Information provided to an artificial intelligence service provider may include prompts, presentation content, brand assets, templates, documents and attachments, connected business data, user instructions, and other information reasonably necessary to complete the requested task.

Neither Decky nor its third-party artificial intelligence providers use Customer Content, Confidential Information, or Customer-generated output to train, fine-tune, or improve artificial intelligence models. Decky requires its third-party artificial intelligence providers to disable training on Customer Content processed through the Services.

Artificial intelligence providers may temporarily retain information where necessary for service operation, security, abuse prevention, or legal compliance, subject to their agreements with Decky and Decky’s applicable configurations.

AI-generated content may be inaccurate, incomplete, biased, misleading, inappropriate, or non-unique. Users are responsible for reviewing, verifying, editing, and validating generated output before publishing, distributing, or relying upon it.

Decky accesses authorized Google Workspace data through OAuth. When a user or organization authorizes Decky through Google OAuth, Decky may receive access to Google user data covered by the permissions presented during the authorization process.

Depending on the authorized permissions and requested feature, this may include:

• Google Slides presentations.
• Google Drive files.
• File and folder metadata.
• Presentation titles.
• File owners.
• File identifiers.
• Authorized presentation content.
• Information necessary to search, create, update, organize, or save presentations.

Decky uses Google user data only to provide or improve user-facing features requested or authorized by the user or organization, including:

• Reading an authorized presentation or template.
• Analyzing slide structure and brand formatting.
• Extracting authorized brand assets.
• Creating or updating a presentation.
• Searching authorized presentation materials.
• Saving generated content to an authorized location.
• Displaying authorized file or presentation information.
• Supporting customer-authorized presentation workflows.

Decky limits its access and use of Google user data to the permissions authorized by the user or organization. Decky does not use Google user data for advertising, retargeting, determining creditworthiness, or training artificial intelligence models. Decky may disclose Google user data to service providers only when necessary to provide or secure a user-facing feature requested by the user or organization and subject to appropriate confidentiality and data-use restrictions.

Users may revoke Decky’s OAuth access through their Google account or disconnect the applicable Google integration through Decky. Revoking access prevents Decky from obtaining additional information through that authorization. Information previously obtained may remain subject to the retention periods described in this Privacy Policy.

Decky’s use and transfer to any other application of information received from Google Workspace APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Decky uses cookies, browser storage, software development kits, pixels, and similar technologies to operate and understand the Services.

These technologies may be used to:

• Authenticate users.
• Maintain sessions.
• Secure accounts and the Services.
• Prevent fraud and abuse.
• Remember user preferences.
• Operate website and product features.
• Measure website and product usage.
• Understand how users navigate and interact with the Services.
• Diagnose performance and technical issues.
• Evaluate product functionality.
• Understand the effectiveness of communications and marketing.

Decky uses the following analytics providers:

Google Analytics

Decky uses Google Analytics to understand website traffic and usage. Google Analytics may collect information such as IP address, device and browser information, approximate geographic location derived from an IP address, pages viewed, referring pages, dates and times of visits, and website interaction and event information. Google processes this information according to its applicable terms and privacy practices.

PostHog

Decky uses PostHog to understand product usage, feature adoption, application performance, and user interaction with the Services. PostHog may process information such as account or user identifiers, device and browser information, IP address, pages and product features accessed, clicks and navigation activity, dates and times of activity, application events, error and performance information, and session and interaction information.

Depending on Decky’s product configuration, PostHog may also collect session-replay information showing how a user navigates and interacts with the Services.

Decky uses analytics information to operate, maintain, secure, troubleshoot, and improve the Services. Decky does not use Customer Content for targeted advertising.

Where required by applicable law, Decky requests consent before using nonessential analytics technologies. Users may manage cookies through browser settings and through any consent-management controls made available through the Services. Blocking certain cookies may affect the operation or availability of some features.

Decky may disclose information to the following categories of recipients.

7.1 Service providers and subprocessors

Decky uses third-party service providers and subprocessors to support functions such as cloud hosting, data storage, databases, authentication, artificial intelligence processing, application hosting, monitoring, error reporting, analytics, customer support, email delivery, payment processing, security, compliance, and professional services.

These providers may process information only as necessary to provide services to Decky and are subject to contractual obligations appropriate to their role. Information about Decky’s material subprocessors may be made available through Decky’s Trust Center, subprocessor list, Data Processing Addendum, or upon request.

7.2 Organizations and workspace administrators

When a user accesses the Services through an organization-managed workspace, information associated with the account and its activity may be available to the organization and its authorized administrators. This information may include user identity, user role, workspace activity, presentation requests, prompts, uploaded source files and attachments, Customer Content, generated presentations and other output, templates and assets used, review comments, approval activity, publishing history, usage information, and audit and security records.

The organization may control the account, access to Customer Content, workspace permissions, connected integrations, retention settings, and account termination. Users of organization-managed accounts should direct questions about their organization’s use of information to that organization.

7.3 Customer-authorized integrations and destinations

Decky may disclose information to a third-party service when a customer or user instructs Decky to retrieve information from that service, send information to that service, create or update content in that service, save a presentation or other output in that service, or run a customer-configured workflow involving that service. The third party’s processing of information is governed by its own terms and privacy policy.

7.4 Professional advisers and authorities

Decky may disclose information to lawyers, accountants, auditors, insurers, regulators, courts, law enforcement, or other authorities where reasonably necessary to comply with applicable law, respond to valid legal process, protect the rights, security, or property of Decky, our customers, users, or others, investigate fraud, misuse, or security incidents, or establish, exercise, or defend legal claims.

Where legally permitted, Decky will seek to notify the affected customer before disclosing Customer Content in response to a government or law-enforcement request.

7.5 Business transactions

Information may be disclosed or transferred as part of a merger, financing, acquisition, reorganization, bankruptcy, sale of assets, due diligence, or a similar corporate transaction. Any recipient will be required to process personal information consistently with applicable law and relevant contractual obligations.

If multiple users from the same organization use the Services, Decky may identify organizational usage patterns and contact company representatives regarding team or enterprise subscription opportunities.

For these purposes, Decky may use aggregated or non-personal business information, including:

• Company domain names.
• Brand identifiers.
• The number of users associated with an organization.
• Aggregate usage levels.
• Subscription and adoption patterns.

Decky does not use the content of private presentations or other confidential Customer Content for targeted advertising. Organizations may opt out of enterprise-related outreach by contacting support@decky.ai.

As permitted by Decky’s Terms of Service or another applicable written agreement, Decky may use a customer’s company name and logo to identify that customer in customer lists, presentations, marketing materials, case studies, and Decky’s website.

Customers may opt out of this use at any time by contacting support@decky.ai.

Decky does not sell Customer Content. Decky does not sell personal information for monetary consideration. Decky does not use Customer Content for targeted advertising or cross-context behavioral advertising.

Decky uses Google Analytics and PostHog for analytics and product-improvement purposes as described in this Privacy Policy. Decky does not use these services to serve personalized advertisements through the Decky Services.

Where required by applicable law, Decky will provide mechanisms to opt out of any activity legally considered a sale or sharing of personal information and will honor applicable browser-based opt-out preference signals.

Where the laws of the European Economic Area, United Kingdom, or another jurisdiction require a legal basis for processing, Decky relies on one or more of the following legal bases.

Performance of a contract

Decky processes information as necessary to provide the Services, administer subscriptions, create and maintain accounts, generate requested output, provide customer support, and perform obligations under an applicable agreement.

Legitimate interests

Decky may process information where necessary for legitimate interests, including operating and improving the Services, securing the Services, preventing fraud and misuse, supporting users and customers, communicating with business contacts, understanding organizational adoption, enforcing agreements, and protecting legal rights. Decky considers the impact of this processing on the rights and interests of affected individuals.

Consent

Decky may rely on consent where required for nonessential cookies and analytics, certain marketing communications, specific integrations, and certain uses of personal information. Consent may be withdrawn at any time. Withdrawal will not affect processing that occurred before consent was withdrawn.

Legal obligations

Decky may process information as necessary to comply with legal, regulatory, tax, accounting, security, or reporting obligations.

Legal claims

Decky may process information where necessary to establish, exercise, or defend legal claims. When Decky processes Customer Content as a processor, the applicable customer is responsible for determining the appropriate lawful basis for that processing.

Decky retains personal information and Customer Content only for as long as reasonably necessary to provide the Services, follow customer instructions, maintain account and workspace functionality, comply with contractual obligations, meet legal, tax, accounting, and regulatory requirements, resolve disputes, enforce agreements, protect the security and integrity of the Services, and establish or defend legal claims.

Decky’s general retention practices are as follows:

Active Customer Content

Customer Content is retained while the applicable account or customer agreement remains active, unless it is deleted earlier by an authorized user or administrator.

Deleted Customer Content

Customer Content that is deleted by an authorized user or administrator is removed from active production systems within 30 days, subject to technical limitations, legal requirements, and applicable customer agreements.

Terminated accounts

Following termination of an account or customer agreement, Customer Content is retained for up to 30 days before being deleted from active production systems, unless a different period is established in an applicable written agreement.

Backup copies

Customer Content may remain in encrypted or otherwise protected routine backups for up to 90 days after deletion from active production systems. Backup information is deleted or overwritten through Decky’s normal backup-rotation process. Information retained in routine backups will not be restored to active production systems except where necessary for disaster recovery, security, or legal purposes.

Security and application logs

Security, audit, diagnostic, and application logs are generally retained for up to 90 days. Logs may be retained longer where reasonably necessary to investigate a security incident, prevent fraud or abuse, comply with applicable law, or establish or defend legal claims.

Support, billing, and business records

Support communications are retained for as long as reasonably necessary to respond to requests, maintain business records, improve support, resolve disputes, and comply with legal obligations. Billing, tax, accounting, and transaction records may be retained for the periods required by applicable law.

Marketing information may be retained until the recipient opts out or the information is no longer reasonably necessary for business purposes. Deleted Customer Content may not be recoverable. Customers and users are responsible for maintaining copies of Customer Content they wish to preserve.

Subject to applicable customer agreements, Decky will cease using and, upon request, return or securely destroy Customer Content and Confidential Information following termination, except where retention is required by law, information is subject to a legal hold, information is needed to investigate fraud or a security incident, information remains temporarily in routine backup systems, or continued retention is necessary to establish or defend legal claims.

Decky may retain aggregated or deidentified information for longer periods where that information cannot reasonably be used to identify an individual.

Decky uses administrative, technical, and physical safeguards designed to protect personal information and Customer Content. These safeguards may include encryption in transit, encryption at rest where appropriate, access controls, role-based permissions, authentication and session controls, single sign-on support, security logging and monitoring, secure software-development practices, vendor and subprocessor reviews, incident-response procedures, employee security and privacy training, access reviews, vulnerability management, and independent security assessments.

Decky maintains a SOC 2 Type II compliance program. Additional information about Decky’s security practices and compliance documentation may be available through Decky’s Trust Center, subject to applicable confidentiality and access requirements.

No electronic system is completely secure. Decky cannot guarantee that unauthorized access, loss, misuse, or disclosure will never occur.

Decky is based in the United States. Personal information and Customer Content may be processed in the United States and in other countries where Decky or its service providers operate.

Where required by applicable law, Decky uses recognized safeguards for international transfers, which may include the European Commission’s Standard Contractual Clauses, the United Kingdom International Data Transfer Addendum, adequacy decisions, contractual safeguards, and other lawful transfer mechanisms.

Business customers may request additional information about applicable international-transfer safeguards through Decky’s Data Processing Addendum, Trust Center, or by contacting support@decky.ai.

Depending on your location and applicable law, you may have the right to:

• Request access to personal information about you.
• Request correction of inaccurate information.
• Request deletion of personal information.
• Request a portable copy of certain information.
• Object to certain processing.
• Request restriction of certain processing.
• Withdraw consent where processing is based on consent.
• Opt out of marketing communications.
• Appeal the denial of a privacy request where applicable.
• Lodge a complaint with a data-protection authority.

To submit a privacy request, contact support@decky.ai with the subject line “Privacy Request.”

Decky may need to verify your identity before completing a request. Decky may request additional information reasonably necessary to verify the request. Authorized agents may submit requests where permitted by applicable law, subject to appropriate verification.

Certain information may be exempt from a request, including information Decky must retain for legal compliance, security, fraud prevention, contractual obligations, legal claims, or protection of the rights of others.

Organization-managed information

If personal information about you was submitted to Decky by your employer or another Decky customer, that organization generally controls the information. You should first submit your request to that organization. Decky will assist the organization with the request as required by applicable law and Decky’s agreement with the organization.

Marketing communications

You may unsubscribe from marketing emails by using the unsubscribe link included in the email or by contacting Decky. Even after opting out of marketing communications, you may continue to receive necessary transactional, security, support, and account communications.

This section applies to the extent the California Consumer Privacy Act, as amended, applies to Decky’s processing. California residents may have the right to request the categories of personal information Decky has collected, the specific pieces of personal information Decky has collected, the categories of sources from which information was collected, the business or commercial purposes for collection and use, the categories of third parties to which information was disclosed, correction of inaccurate personal information, deletion of personal information, opt-out from the sale or sharing of personal information, limitation of certain uses of sensitive personal information, and non-discriminatory treatment for exercising privacy rights.

The categories of information Decky may collect are described in Section 2. The business and commercial purposes for collection and use are described in Section 3. The categories of recipients to which Decky may disclose information are described in Section 7.

Decky does not discriminate against individuals for exercising applicable privacy rights. California privacy requests may be submitted to support@decky.ai with the subject line “California Privacy Request.” Decky will respond within the time required by applicable law.

Where applicable, Decky will recognize legally valid browser-based opt-out preference signals, such as Global Privacy Control.

The Services are intended for business use by individuals who are at least 18 years old. Decky does not knowingly collect personal information directly from children under 13. If you believe a child has provided personal information to Decky without appropriate authorization, contact support@decky.ai.

Decky maintains an incident-response process designed to identify, investigate, contain, and remediate security incidents. If a security incident affects personal information or Customer Content, Decky will notify affected customers, individuals, regulators, or other parties as required by applicable law and contractual obligations.

Decky may update this Privacy Policy to reflect changes to the Services, Decky’s data practices, legal or regulatory requirements, service providers, or product functionality. When Decky makes material changes, Decky will provide notice through the Services, by email, on its website, or through another reasonable method.

Where required by law, Decky will obtain consent before using previously collected personal information for a materially different purpose. The date at the top of this Privacy Policy indicates when the current version became effective.

Questions, complaints, support inquiries, and privacy requests may be sent to: