Privacy policy
Last updated November 11, 2026
Decklab is built to keep your work on your own machine. This policy explains what does reach us, and what we do with it. “We” means Decklab AI, based in India, which is responsible for your personal data. You can reach us at hello@decklab.ai.
What we collect
| What | Details | When |
|---|---|---|
| Account | Your email address and name. If you sign in with Google, also your Google account ID and profile picture. | When you make an account |
| Sessions | Your IP address, browser and device, and when you were last active. You can see these on your Security page. | When you sign in |
| Cloud projects | The projects you choose to sync, including their data, images and fonts. | When you turn on sync for a project |
| AI requests | The text and project content a step needs, what it returns, and what it cost in credits. | When you run an AI action |
| Billing | Your plan and its status. Dodo Payments handles your card and billing details, and we don’t see your full card number. | When you buy Pro or credits |
| Messages | What you send us, with your name and email address. | When you contact us |
| Usage analytics | The pages you visit and what you do in the app (such as making a project or an export), your browser, device and country, and where you came from. If you accept, also a masked recording of your session. Never your email, name, project content or what you type. | When you use the site or app. Stored against your account or browser only if you accept cookies |
| Server logs | Requests to our servers, including IP address and browser, kept by our hosting providers. | When you use the site or app |
What stays on your device
Projects you don’t sync are stored in your browser and never reach us. Neither does the app’s error log, unless you choose to send it to us.
The free tools work in your browser. The files you give them aren’t uploaded, and they’re gone when you close the tab.
How we use it
Where the GDPR or UK GDPR applies, the legal basis for each use is shown below.
- To provide the service you asked for: signing you in, syncing projects, running AI actions and taking payment (performance of a contract).
- To keep the service secure and working: limiting abuse, investigating faults and protecting accounts (our legitimate interests).
- To understand how the site and app are used and improve them, by counting visits and actions anonymously (our legitimate interests), and, if you accept cookies, following visits over time and recording masked sessions (your consent, which you can withdraw at any time).
- To answer you and to send emails the service needs, such as sign-in links (performance of a contract).
- To meet legal duties, such as keeping tax records (legal obligation).
We don’t sell your personal data, and we don’t share it for advertising. We don’t use your projects to train AI models.
Who processes it for us
These providers process data on our behalf, only as needed to run the service.
| Provider | What for |
|---|---|
| Vercel | Hosting the site and app |
| Neon | Database for accounts and synced projects |
| Cloudflare | File storage for synced projects, DNS, and checking that sign-ins and contact messages come from people |
| Upstash | Rate limits and usage metering |
| Trigger.dev | Running long AI jobs |
| Resend | Sending sign-in and account emails |
| Sign-in, if you choose it, and Analytics on the public site, if you accept cookies | |
| PostHog (EU) | Product analytics and session replay, hosted in the European Union |
| AI service providers | Generating text and images, when you run an AI action |
| Dodo Payments | Selling Pro and credits, as merchant of record. It acts as a separate controller of your billing data, under its own privacy policy. |
We may also disclose data if the law requires it, or as part of a sale or merger of the business, in which case this policy still protects it.
International transfers
Our providers may process data outside your country, including in the United States and other countries that may not have equivalent data protection laws. Where the law requires it, we rely on safeguards such as the European Commission’s standard contractual clauses.
How long we keep it
- Sign-in links expire after 10 minutes. Sessions last 30 days, renewing while you use them.
- Account data and cloud projects are kept until you delete them or your account.
- When you delete your account, we remove your account and cloud records straight away, and a daily cleanup removes your stored files. Provider backups may hold them for a short time afterwards.
- We keep billing and tax records for as long as the law requires.
- We keep messages you send through our contact form for 2 years after we’ve dealt with them.
Your rights
Depending on where you live, you may have the right to access, correct, delete or move your personal data, and to object to or restrict how we use it. You can do most of this yourself: edit your profile, download your data and delete your account from your account pages.
For anything else, write to hello@decklab.ai. You can also complain to your local data protection authority. If you live in California, you have similar rights to know and delete, and we won’t treat you differently for using them.
Security
Data is encrypted in transit, cloud files are private to your account, and access to them uses short-lived links. No service can promise perfect security, so keep your own backups of work that matters.
Children
Decklab isn’t meant for children under 13, or under the minimum age for an online account where you live, and we don’t knowingly collect their data. If you think a child has given us data, write to hello@decklab.ai and we’ll delete it.
Changes and contact
If we change this policy, we’ll update the date above, and tell account holders by email if the change is significant. Questions go to hello@decklab.ai.