Privacy Policy

Last updated: 2 July 2026

Vitero Corp s.r.o., a company incorporated in the Czech Republic (company reg. no. 10675400), with registered office at Primátorská 296/38, 180 00 Prague 8, Czech Republic ("Whyston", "we", "us"), operates the whyston.com web application and the Whyston PowerPoint add-in, and is the data controller for personal data processed through the Service. This policy describes what data we collect, how we use it, and your rights.

1. Data we collect

We collect the minimum data needed to operate the service:

• Account information — email address and display name, collected when you sign up via email/password, Google OAuth, or Microsoft SSO (add-in only).
• Usage metrics — generation count, token usage, and estimated cost per API call. Used for quota enforcement and service monitoring.
• Presentation artifacts — blueprints and slide JSON produced during generation are stored temporarily for debugging and cost attribution. Your presentation is assembled into a PowerPoint file on our servers and returned to your PowerPoint session for insertion; we do not retain the final .pptx file after it is delivered.
• Conversation history — messages exchanged with the AI assistant are stored so you can resume conversations. You can delete conversations at any time.
• Preferences — theme, default overlay settings, saved prompts, and image generation defaults.

2. Data we do not collect

• We do not read, store, or transmit the contents of your PowerPoint documents beyond what you explicitly send to the AI assistant or generation prompt.
• We do not use advertising trackers, analytics pixels, or third-party tracking cookies.
• We do not sell or share your data with third parties for advertising or marketing purposes.

3. Cookies & local storage

• Session cookie — a secure, httpOnly authentication cookie managed by Supabase. Required for sign-in.
• Theme preference — stored in your browser's localStorage (non-sensitive).

We do not set any third-party or advertising cookies.

4. Third-party services

To provide the service, your data may be processed by the following third parties:

• LLM providers — your prompts and generation inputs are sent to one or more AI model providers for slide generation and assistant responses. We currently use Anthropic, OpenAI, and Google (Gemini); we may add or change providers in the future. These providers are located in the United States. Each provider's own privacy policy applies to data they process.
• Supabase — authentication, database, and row-level security. Subject to Supabase's privacy policy.
• Vercel — hosting, serverless functions, and structured log storage. Subject to Vercel's privacy policy.
• fal.ai — optional image generation (Ideogram, FLUX models). Only used when you explicitly request image generation; the image prompt is sent to fal.ai and the underlying model providers. Subject to fal.ai's privacy policy.
• Polar — payment processing and subscription management for paid plans. When you subscribe, Polar (acting as our payment processor) handles your billing and payment information. Subject to Polar's terms and privacy policy.
• Microsoft — OAuth token validation for the PowerPoint add-in's SSO flow. No document content is sent to Microsoft through our service.
• Google — used in two distinct ways: (a) as an OAuth sign-in provider, where only authentication tokens are exchanged; and (b) as an LLM provider (Gemini), where prompts and generation inputs may be sent for slide generation (see "LLM providers" above).

5. Data retention

• Generation artifacts (blueprints, slide JSON, composition specs) — retained for up to 30 days for debugging and cost attribution, then deleted. Aggregate, non-personal cost and usage totals may be retained longer for billing.
• Conversation history — retained until you delete it, or until your account is deleted.
• Usage counters — aggregated monthly totals retained for quota enforcement and billing.
• Account data — retained until you request deletion.

6. Your rights

You may exercise the following rights by contacting us:

• Access — request a copy of the personal data we hold about you.
• Deletion — request deletion of your account and all associated data.
• Rectification — request correction of inaccurate personal data.
• Portability — request your data in a machine-readable format.
• Objection & restriction — object to, or request restriction of, processing based on our legitimate interests.
• Withdraw consent — where processing is based on your consent (e.g. optional image generation), withdraw it at any time, without affecting processing already carried out.

We will respond to requests within 30 days. If you are in the EU/EEA, you also have the right to lodge a complaint with a data protection supervisory authority — in the Czech Republic, the Office for Personal Data Protection (Úřad pro ochranu osobních údajů, uoou.gov.cz).

7. Legal basis & international transfers (EU/EEA)

Where the GDPR applies, we process your personal data on the following legal bases:

• Performance of a contract — to provide the Service (account, generation, the AI assistant, and delivery of your presentation).
• Legitimate interests — usage metrics, quota enforcement, security, and debugging.
• Consent — optional features such as AI image generation, which run only when you request them.

Some of our processors are located outside the EU/EEA, including in the United States — for example the LLM providers (Anthropic, OpenAI, Google), fal.ai, Vercel, and Polar. Where personal data is transferred internationally, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.

8. Security

All data is transmitted over HTTPS. Database access is governed by row-level security policies — each user can only access their own data. Generation is performed using Whyston-managed provider accounts, so your prompts and inputs are sent to the LLM providers on your behalf; if you choose to supply your own API key for direct LLM access, it is never stored on our servers.

9. Children

Whyston is not directed at children under 16. We do not knowingly collect personal data from children.

10. Changes to this policy

We may update this policy from time to time. Material changes will be communicated via the email address associated with your account. Continued use of the service after changes constitutes acceptance of the updated policy.

11. Contact

For privacy inquiries or to exercise your rights, contact the data controller, Vitero Corp s.r.o., at privacy@whyston.com.