Privacy Policy

DeckLume is operated by Maind Solutions (the “Controller”). For privacy and data protection requests, contact support@decklume.app. Report security incidents to security@decklume.app.

• Account details: name, email and a hash of your password.
• Session and sign-in metadata.
• Brand assets, source documents and images you upload.
• Prompts and change requests you submit.
• Generated decks (their structure, compiled HTML and exports).
• Share links: tokens stored only as SHA-256 hashes, optional passwords as salted scrypt hashes, and view fingerprints (an HMAC of IP address and browser plus the referring site).
• Usage records, audit events and the operational logs needed to run the service.

• Contract: delivering the service you signed up for — your account, deck generation, exports and hosted sharing.
• Legitimate interests: running the product safely — rate limiting, abuse prevention, audit logs and malware scanning.
• Legal obligation: billing records and retention required by tax or accounting law.
• Consent: where required, for optional analytics or non-essential cookies.

To sign you in; to generate, revise, compile and export decks; to apply plan limits; to fix failures; to run hosted sharing; to bill paid plans; and to comply with the law. We don't sell personal data, and we don't use your prompts, sources or decks to train AI models.

When AI generation is on, the relevant parts of your prompt, brand and sources are sent from our servers to our AI inference provider, Venice AI, whose terms apply to processing on their infrastructure. We never include other customers' data or our own secrets.

We share data only with the providers listed on the subprocessors page, each for a specific job such as hosting, database, file storage, AI inference, email, billing or malware scanning. Transfers of EU/EEA personal data use Standard Contractual Clauses where applicable.

Some subprocessors process data in the United States or elsewhere outside the EU/EEA. We rely on the European Commission's Standard Contractual Clauses and equivalent mechanisms.

• Account data: while your account is active, then up to 30 days after deletion for backup integrity.
• Archived decks and brand kits: 90 days after you archive them, then deleted for good with their files, unless you restore them first.
• Audit logs and billing records: as long as the law requires (often 6–10 years).
• Share-link view records: 12 months.
• Operational logs: 30 days.
• You can delete your data at any time from Settings → Data & privacy, or ask us at support@decklume.app.

• Access and portability: download all your data as JSON from Settings → Data & privacy.
• Correction: edit your profile, brands and decks in the app, or contact us.
• Erasure: delete your account from Settings → Data & privacy, or ask us.
• Restriction and objection: contact us.
• Withdrawing consent: any time, without affecting earlier processing.
• Complaints: you can contact your local EU/EEA data protection authority.

We use only essential cookies for signing in, request protection and unlocking shared decks. No advertising trackers. The cookie policy lists them all.

DeckLume is not meant for children under 16 and we don't knowingly collect their data. If you think we have, contact us and we'll delete it.

HTTPS in transit, hashed passwords, tenant isolation, request-origin protection, rate limiting, malware scanning on uploads, SVG sanitisation, EXIF stripping and an audited deck runtime. See the security page.

We may update this policy. We announce material changes in the app and by email to active users. The latest version always lives on this page.