Draft pending counsel review — last updated 2026-09-29. This is a working draft published for transparency. It is not final legal advice and will change after review.
Subprocessors
Every provider that processes personal data on our behalf, what it receives, and when. Locations and transfer mechanisms are being verified per provider and route.
Current subprocessors
| Provider | Service | Data categories | When used | Location | Transfer mechanism |
|---|---|---|---|---|---|
| Cloudflare, Inc. | Hosting and compute (Workers, Durable Objects, Workflows), database (D1), file storage (R2), transactional email (Email Service), network security | Account identifiers, IP address and request metadata, all stored project content, sign-in and account emails | Always | Global edge network; storage location to be confirmed per resource | EU Standard Contractual Clauses and/or EU–US Data Privacy Framework, to be confirmed |
| OpenRouter, Inc. | Model routing for the AI routes listed below | Prompts built from your brief, excerpts of your sources, slide and script text, practice answers; audio for the optional Whisper route | When you run an AI action | To be confirmed per route | Standard Contractual Clauses, to be confirmed |
| Model providers routed via OpenRouter | Inference for typesafe/jev-1.13, openai/gpt-6-luna, xiaomi/mimo-v2.6-pro, google/gemini-3.8-flash-lite-tts and openai/whisper-1 | The same request content as above, limited to what the route needs | When the corresponding AI action runs | To be confirmed per route | To be confirmed per route; no route is used where its privacy terms fail our requirements |
| Deepgram, Inc. | Speech transcription (Nova-3 streaming and prerecorded) | Microphone audio during rehearsal; uploaded recordings you ask us to transcribe | When you rehearse aloud or upload a recording | To be confirmed per route | Standard Contractual Clauses, to be confirmed |
| Stripe | Payment processing, tax calculation and invoicing | Name, email, billing address, payment method (held by Stripe, not by us), purchase history | When you buy or manage a paid offer | To be confirmed | Standard Contractual Clauses and/or EU–US Data Privacy Framework, to be confirmed |
| Brave Search | Optional public-web retrieval for finding sources | Search queries derived from your brief (not your uploaded files) | Only when you enable web research for a project | To be confirmed | To be confirmed |
| Google LLC | Google Slides and Google Docs export | The presentation or script you choose to export, and the OAuth grant you approve | Only when you connect your Google account for export | To be confirmed | Standard Contractual Clauses and/or EU–US Data Privacy Framework, to be confirmed |
AI model routes
We use only these exact routes. No other language model, summarisation service or fallback provider receives your content.
| Role | Route | Via | Used for |
|---|---|---|---|
| Typed classification | typesafe/jev-1.13 | OpenRouter | Brief classification, routing and schema-constrained decisions. Never the source of factual truth. |
| Main language model | openai/gpt-6-luna | OpenRouter | Argument construction, drafting, script writing and substantial verification. |
| Alternative language model | xiaomi/mimo-v2.6-pro | OpenRouter | Quality-tested alternative or independent verification route. |
| Narration and coach voice | google/gemini-3.8-flash-lite-tts | OpenRouter | Generated speech for narration and rehearsal questions. |
| Batch transcription option | openai/whisper-1 | OpenRouter | Transcribing uploaded recordings, where it meets our quality threshold. |
| Live transcription | Deepgram Nova-3 (streaming) | Deepgram | Real-time captions and turn-taking during live rehearsal. |
| Batch transcription | Deepgram Nova-3 (prerecorded) | Deepgram | Transcribing uploaded recordings. |
How we choose routes
- A request must satisfy capability, privacy, budget and quality requirements. Privacy is a hard filter, never traded for speed or cost.
- Where available we request zero-data-retention endpoints; that alone does not guarantee EU-only processing, so we don’t claim it.
- If no compliant route exists for a feature, that feature is unavailable in that privacy mode, and we tell you before upload or payment.
- We don’t permit providers to train on your content.
Change notices
We update this page before adding or replacing a subprocessor. Business customers with a data processing agreement receive advance notice and can object as described in the DPA. Questions: privacy@slidedeck.my.