Privacy Policy

1. Introduction

The entity responsible for the processing of your personal data is Artor ehf., Jörfalind 21, 201 Kópavogur, Iceland (SSID: 690802-3410). If you have any questions regarding your data, you can contact us by using the contact form on the Support page. We are committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data when you use our digital signage platform and related services ("Service").

This policy applies to all users of InfoSlides, including account holders, team members, and visitors to our website.

2. Data Controller

Artor is the data controller for the personal data we collect and process. For payment-related data, Paddle.com acts as the Merchant of Record and processes payment information as an independent data controller under their own Privacy Policy.

3. Information We Collect

3.1 Information You Provide

• Account information: Name, email address, and password when you register.
• Profile information: Display name, workspace name, and contact details.
• Content: Presentations, images, and media files you upload to the Service.
• Communications: Messages you send to our support team.

3.2 Information Collected Automatically

• Usage data: Pages visited, features used, actions taken within the Service.
• Device information: Browser type, operating system, screen resolution, and device identifiers for registered display devices.
• Log data: IP addresses, access times, and referring URLs.
• Analytics data: We use Google Analytics 4 to collect aggregated, anonymised data about how visitors interact with our website (pages visited, session duration, referral source). IP addresses are anonymised before storage. Analytics cookies are only set after you have accepted our cookie consent banner. See our Cookie Policy for full details.
• Cookies: As described in our Cookie Policy.

3.3 Information from Third Parties

• OAuth providers: When you sign in via Google, Microsoft, or Apple, we receive your name, email address, and profile picture as authorized by you.
• Payment processor: Paddle provides us with transaction confirmations and subscription status. We do not receive or store your full payment card details.

3.4 TV Application Data (Tizen and Other TV Platforms)

Our TV applications (including the InfoSlides Tizen TV app) operate with a privacy-first approach and collect only necessary data:

• App version identifier: The X-Client-App header (e.g., "tizen/1.0.0") is sent with API requests for compatibility tracking and client identification only.
• Device pairing information: Device ID, device name, and stream token are stored locally on your TV's device storage (via localStorage) only for the purpose of connecting to your InfoSlides streams. These are required for the app to function.
• Slideshow configuration: Player settings and configuration fetched from the API are stored locally for playback purposes.
• Stream metadata: The HLS stream URL and associated metadata necessary for video playback.
• Error logs: Technical error information is logged to the browser console only and is never transmitted to our servers or any third-party service.

What TV apps do NOT collect:

• ❌ No analytics tracking (Google Analytics is not used)
• ❌ No personal data (camera, microphone, contacts are not accessed)
• ❌ No browsing history
• ❌ No GPS or location information
• ❌ No user activity tracking beyond what is necessary for stream delivery

4. How We Use Your Information

We use your personal data for the following purposes:

• Providing the Service: To create and manage your account, process your content, and deliver streams to your devices.
• Billing: To manage subscriptions and communicate billing-related matters (payment processing is handled by Paddle).
• Communication: To send service-related notifications, security alerts, and support responses.
• Improvement: To analyze usage patterns and improve the Service.
• Security: To detect and prevent fraud, abuse, and security incidents.
• Legal compliance: To comply with applicable laws and legal obligations.

5. Legal Basis for Processing (GDPR)

If you are in the European Economic Area (EEA), we process your data based on:

• Contract performance: Processing necessary to provide the Service you signed up for.
• Legitimate interests: Service improvement, security, and fraud prevention, where these interests are not overridden by your rights.
• Consent: Where you have given explicit consent, such as for marketing communications.
• Legal obligation: Processing required to comply with applicable laws.

6. Data Sharing and Disclosure

We do not sell your personal data. We may share your information with:

• Google LLC (Google Analytics): Anonymised, aggregated website usage data is processed by Google Analytics 4. Data is transferred to Google servers and governed by Google's Privacy Policy. We have enabled IP anonymisation and only activate analytics after cookie consent is obtained.
• Paddle.com: Our payment processor and Merchant of Record, for billing and subscription management.
• OAuth providers: Authentication data flows through Google, Microsoft, or Apple as part of sign-in.
• Hosting providers: Infrastructure services that host and deliver the Service.
• Team members: Other users within your workspace can see shared content and team information as configured by your administrator.
• Law enforcement: When required by law, regulation, or valid legal process.

7. Data Retention

We retain personal data associated with your account for as long as your subscription is active. If a subscription is canceled or a trial period ends without conversion to a paid plan, we will retain the account data for a period of 30 days to allow for easy reactivation or data retrieval by the user. Following this period, all personal data associated with the Workspace account will be permanently deleted or anonymized from our active databases, except where we are required to retain certain information (such as invoices or payment records) to comply with legal, tax, or accounting obligations under Icelandic law.

8. Your Rights (GDPR)

If you are in the EEA, you have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Rectification: Request correction of inaccurate or incomplete data.
• Erasure: Request deletion of your personal data ("right to be forgotten").
• Restriction: Request that we limit processing of your data.
• Portability: Request your data in a structured, machine-readable format.
• Objection: Object to processing based on legitimate interests.
• Withdraw consent: Where processing is based on consent, you may withdraw it at any time.

To exercise these rights, contact us using the contact form on the Support page. We will respond within 30 days.

9. International Data Transfers

Your data may be transferred to and processed in countries outside your country of residence. When we transfer data outside the EEA, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the European Commission.

10. Data Security

We implement appropriate technical and organizational measures to protect your data, including:

• Encryption of data in transit (TLS) and at rest.
• Regular security assessments and monitoring.
• Access controls and authentication requirements.
• Secure password hashing using industry-standard algorithms.

While we strive to protect your data, no method of transmission or storage is 100% secure. We encourage you to use strong passwords and keep your credentials confidential.

11. Children's Privacy

The Service is not intended for use by individuals under the age of 16. We do not knowingly collect personal data from children. If we become aware that we have collected data from a child, we will delete it promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or through a notice in the Service. The "Last updated" date at the top indicates when the policy was last revised.

13. Contact Us

For questions or concerns about this Privacy Policy or our data practices, contact us using the Contact form on the Support page

If you are in the EEA and believe your data protection rights have been violated, you have the right to lodge a complaint with your local data protection authority.