1. Introduction
The entity responsible for the processing of your personal data is Artor ehf., Jörfalind 21, 201 Kópavogur, Iceland (SSID: 690802-3410). If you have any questions regarding your data or this policy, you can contact us at privacy@infoslides.app, admin@infoslides.app, or support@infoslides.app, or by using the contact form on our Support page.
We are committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data when you use our digital signage platform, APIs, applications, and related services ("Service").
This policy applies to all users of InfoSlides, including account holders, team members, display devices, connected AI assistants, and visitors to our website.
2. Data Controller
Artor ehf. is the data controller for personal data collected and processed through InfoSlides. For payment-related transactions and billing data, Paddle.com acts as the Merchant of Record and processes payment information as an independent data controller under their own Privacy Policy.
3. Information We Collect
3.1 Information You Provide
- Account information: Name, email address, display name, and password when you register.
- Profile & Workspace information: Workspace name, business details, timezone, locale, and preferences.
- Content: Presentations, PowerPoint files, images, videos, web links, templates, and dynamic data feeds you upload or configure in the Service.
- Communications: Messages, feedback, and support inquiries sent to our team.
3.2 Information Collected Automatically
- Usage data: Pages visited, features used, playback interactions, and actions taken within the Service.
- Device information: Browser type, operating system, screen resolution, app version, IP address, and device identifiers for registered display screens.
- Log data: System event logs, API request logs, access times, error reports, and referring URLs.
- Analytics data: We use Google Analytics 4 to collect aggregated, anonymised data about website visitors. IP addresses are anonymised before storage. Analytics cookies are only set after you have accepted our cookie consent banner. See our Cookie Policy for full details.
- Acquisition data: On your first visit we store which page referred you (if any) and campaign parameters in the URL to determine effective growth channels. This is stored for up to 30 days in a first-party cookie and contains no personal tracking data.
3.3 Information from Third Parties & Integrations
- OAuth sign-in providers: When you sign in via Google, Microsoft, or GitHub, we receive your verified email address, name, and profile picture.
- Payment processor: Paddle provides transaction confirmations, subscription statuses, and invoice references. We do not receive or store payment card details.
- Connected AI assistants & agent integrations: When you connect an external AI assistant (such as ChatGPT, Claude, Microsoft 365 Copilot, or custom MCP agents) to your InfoSlides workspace, we process requests sent on your behalf. Details are set out in Section 4 below.
3.4 TV Application Data (Tizen, Android TV, and Web Players)
Our TV display applications operate with a privacy-first architecture and collect only minimal necessary operational telemetry:
- App identifier: The
X-Client-App header is sent with API calls for player compatibility and format negotiation.
- Device pairing tokens: Screen ID, device name, and playback stream tokens stored locally on the TV's storage (via localStorage) to maintain playback.
- Diagnostics: Connection heartbeat timestamps and playback error codes to diagnose black screens or network issues.
- What TV apps do NOT collect: No advertising trackers, no third-party analytics, no camera/microphone access, no browsing history, and no GPS coordinates.
4. AI Assistants, Agents & Model Context Protocol (MCP) Connections
InfoSlides provides native integrations for AI assistants (including OpenAI ChatGPT plugins/connectors, Anthropic Claude desktop and connectors, Microsoft 365 Copilot, and custom Model Context Protocol agents). This section explains how data flows when you connect an assistant.
4.1 Scope of Data Access and Actions
When you authorize an AI assistant via OAuth 2.1 or issue an API key, it acts on your behalf strictly within the permissions (scopes) granted:
- Read access (
infoslides.read): Allows the assistant to view screen names, status (online/offline), currently playing slideshows, slide thumbnails, schedules, data sources, templates, media assets, and workspace health diagnostics.
- Write access (
infoslides.write): Allows the assistant to create or modify slides, update schedules, trigger temporary takeovers, pair screens, upload media, push live data payloads, and revert recent changes.
4.2 Connection Telemetry and Stored Metadata
For each authorized connection, we store:
- The OAuth client identifier and name of the assistant (for example
chatgpt, or an identifier created when the assistant registered itself), the user and workspace that authorized it, the authorized scopes, and the type of assistant it is.
- When the connection was authorized and when its refresh token expires.
- Hashed refresh tokens with automatic token rotation and token family reuse detection.
We do not store the chat transcripts, prompts, or conversation history between you and third-party AI platforms.
4.3 Issue Reporting & Telemetry (report_issue)
If you ask an agent that runs on your own computer or uses an API key (for example the InfoSlides command-line tool or a custom agent) to report an issue or bug with InfoSlides, the agent transmits a diagnostic report to our internal AgentFeedbacks registry containing: a summary of the problem, your high-level intent, the failing API request structure, and the agent's name. Issue reports strictly exclude passwords, API keys, personal contact details, and private slide content. Feedback records are retained for debugging and service quality improvement and deleted automatically after 12 months, or earlier with workspace deletion. A testimonial that we have chosen to show on our website stays for as long as it is shown.
4.4 Undo Tokens
When an agent performs a modifying action, a cryptographically signed undo token is returned to the agent. This token contains a signed snapshot of the prior state, enabling the agent to revert the change if you say "undo that". We do not store undo tokens: the token is held by the assistant, so the snapshot (for example the text of a slide) stays wherever that assistant keeps its conversation. An undo token stops working 24 hours after it was issued.
4.5 Grant Management, Disconnect & DCR Client Retention
You have complete control over all connected applications. You can inspect all active OAuth connections and revoke access at any time by visiting Settings → Connected Applications. Agents that work in your workspace with an API key rather than through an OAuth connection are managed separately: you can see and revoke their keys at any time under Settings → API Keys.
- Immediate Revocation: Clicking "Disconnect" immediately revokes the authorization grant, rendering all active access tokens and refresh tokens permanently invalid (answering
401 Unauthorized and invalid_grant).
- Client and grant cleanup: Disconnecting keeps the assistant's registration, so you can reconnect later. A dynamically registered client (RFC 7591) with no grant activity for 30 days is deleted, and revoked or expired grant records are deleted 30 days after they stop working.
- Token Expiration: Inactive refresh tokens expire automatically after 30 days unless refreshed by active use.
4.6 Data Handling Principles
- Our servers: Agent requests run on InfoSlides' own servers, which are hosted by Hetzner in Finland (European Economic Area). The exception is AI slide generation: when you ask an assistant to generate a slide with AI, your description and any text or files you supply for it are sent to the AI model provider we use for that feature, as set out in Section 7. Assistants such as ChatGPT and Claude keep their own conversation history under their own privacy policies; we do not receive it.
- No data selling: We never sell workspace data, aggregated feeds, or user content to third parties or brokers.
- No model training: We do not use your slide content, company presentations, or media uploads to train third-party foundation models.
- No cross-site tracking or profiling: We do not track users across external applications or build advertising profiles.
- No sensitive health or biometric data: The Service neither requests nor processes protected health information or biometric data.
- No sponsored content: InfoSlides displays only your own scheduled content and does not inject advertisements or third-party sponsored material into your screens.
5. How We Use Your Information
We process your personal data for the following lawful purposes:
- Service delivery: To operate your account, render slideshows, manage screen pairings, deliver HLS video streams, and execute authorized agent commands.
- Billing and subscription management: To process payments, manage plan allowances, and handle invoicing via Paddle.
- Service communications: To send critical system alerts, screen offline notifications, security notices, and respond to support tickets.
- Security and platform integrity: To prevent unauthorized access, mitigate brute-force and DDoS attacks, and enforce role-based access control.
- Legal compliance: To comply with applicable European and Icelandic legal and accounting obligations.
6. Legal Basis for Processing (GDPR)
If you are located in the European Economic Area (EEA), our legal grounds for processing personal data under the EU General Data Protection Regulation (GDPR) are:
- Performance of a Contract (Art. 6(1)(b) GDPR): Providing the digital signage service and executing API requests as agreed under our Terms of Service.
- Legitimate Interests (Art. 6(1)(f) GDPR): Ensuring platform security, preventing abuse, monitoring system performance, and improving service reliability.
- Legal Obligation (Art. 6(1)(c) GDPR): Complying with statutory financial, tax, and bookkeeping requirements.
- Consent (Art. 6(1)(a) GDPR): Where you have granted explicit consent, such as for optional analytics cookies.
7. Data Sharing and Disclosure
We do not sell, rent, or monetize your personal data. Data is shared only with trusted processors necessary to deliver the Service:
- Paddle.com: Merchant of Record and payment gateway for subscription billing.
- Hosting & Cloud Infrastructure: Hetzner Online GmbH hosts our servers in Finland, within the European Economic Area.
- AI model providers: To generate slides with AI we send the description, and any text or files you supply for it, to AI model providers (currently Google, Anthropic and OpenAI models). We do not use your slide content or media uploads to train their models.
- Authorized AI Platforms: When you connect an assistant (e.g. ChatGPT, Claude), responses to the assistant's specific API queries (such as screen lists or slide metadata) are returned to that assistant's provider to fulfill your instruction.
- Workspace Team Members: Authorized users within your workspace can view shared slides, schedules, and screen states according to their assigned workspace role.
- Legal Authorities: When required by binding legal process, court order, or applicable law.
8. Data Retention & Workspace Deletion
We retain personal data for as long as your workspace remains active. For inactive free workspaces, we apply the following retention timeline:
- A free workspace is considered inactive when no member has signed in, no screen has checked in, and no API key or token has been used for 12 consecutive months.
- At least 30 days prior to pausing, we notify workspace administrators by email. Signing in immediately resets the activity clock.
- After 12 months of inactivity, the workspace is paused. 30 days following pause, uploaded media and rendered stream files are permanently erased. 90 days following pause, all workspace data and associated accounts are permanently deleted.
You may request immediate and permanent deletion of your workspace and personal data at any time by emailing privacy@infoslides.app or admin@infoslides.app. Deletion is completed within 30 days.
Financial invoices and transaction receipts are retained for the statutory period required by Icelandic commercial bookkeeping law.
9. Your Rights Under GDPR
Under GDPR and applicable data protection legislation, you have the right to:
- Access: Obtain confirmation of processing and a copy of your personal data.
- Rectification: Correct inaccurate or incomplete personal data.
- Erasure: Request permanent deletion of your personal data ("right to be forgotten").
- Restriction: Request temporary restriction of processing under certain circumstances.
- Data Portability: Receive your data in a structured, machine-readable format.
- Objection: Object to processing based on legitimate interests.
- Revocation of Consent: Withdraw previously given consent at any time without affecting prior lawful processing.
To exercise any of these rights, contact us at privacy@infoslides.app or submit a request via our Support page. We respond to all verified requests within 30 days.
10. International Transfers & Security
All core customer content and operational databases are hosted in the European Economic Area. Where data is transferred internationally (e.g. during authentication or AI assistant integrations), transfers are governed by standard contractual clauses (SCCs) approved by the European Commission.
We employ rigorous security measures including TLS 1.3 encryption in transit, AES-256 encryption at rest, regular vulnerability scanning, strict role-based access controls, and rate limiting.
11. Children's Privacy
The Service is designed for business and organizational use and is not directed to individuals under 16 years of age. We do not knowingly collect personal data from children.
12. Changes to This Privacy Policy
We may periodically update this policy to reflect changes in legal requirements or platform features. Material changes will be communicated via email or an in-app banner prior to taking effect.
13. Contact Us
For any questions, data subject requests, or privacy concerns, please contact our dedicated team:
You also have the right to lodge a complaint with your competent supervisory authority (in Iceland, Persónuvernd, www.personuvernd.is).