Privacy Policy

3.1 Hosting (Netlify)

Our site is hosted by Netlify, Inc. (USA). Netlify automatically processes server logs containing IP addresses, browser type, referring URLs, and timestamps for security and operational purposes. Data is processed on the basis of our legitimate interest in reliable service delivery (Art. 6 (1) f GDPR). Netlify is a sub-processor under standard data processing terms. See Netlify's Privacy Policy.

3.2 Authentication (Firebase / Google)

We use Google Firebase Authentication for optional user accounts. If you sign in with a Google account, Google shares your name, email address, and profile picture with us via OAuth 2.0. This data is stored in Firebase (Google Cloud, EU/US regions) and used solely to identify your session and personalise the interface. Legal basis: your consent given at sign-in (Art. 6 (1) a GDPR). You may revoke access at any time via your Google Account settings at myaccount.google.com/permissions. See Google's Privacy Policy.

3.3 Google Drive & Google Import (optional)

Connecting your Google account grants Visually access to Google Drive for the following purposes:

• Personal Drive Sync — Visually creates and manages a Visually Presentations folder in your Drive. Only files within this folder are read or written. Legal basis: your explicit consent (Art. 6 (1) a GDPR).
• Google Import — Visually reads Google Slides, Docs, Sheets, and Forms from your Drive to allow importing them as slides (read-only, drive.readonly scope). Files are fetched on demand and not stored on our servers.
• Collab File Sharing — When you add a file to a collaborative session as the host, it is uploaded to a Visually Collab/<sessionId> folder in your own Google Drive using the drive.file scope. The file is then set to "anyone with the link can view" so session participants can download it. This makes those files accessible to anyone who knows the file ID. Files in this folder are not automatically deleted by Visually — you can manage them directly in your Google Drive. Legal basis: your explicit consent (Art. 6 (1) a GDPR).

The OAuth access token is stored in your browser session only and never on our servers. You can disconnect Google at any time in Settings. Our use of Google APIs is subject to the Google API Services User Data Policy, including the Limited Use requirements.

3.4 Canva Integration (optional)

If you connect your Canva account, Visually uses the Canva Connect API (OAuth 2.0 with PKCE) to list your designs and export selected designs as PDFs for import as presentation slides. The access and refresh tokens are stored exclusively in your browser's localStorage and are never transmitted to our servers. When you import a Canva design, the exported PDF is temporarily fetched via a server-side proxy to bypass browser CORS restrictions and is not stored permanently on our servers. Legal basis: your explicit consent (Art. 6 (1) a GDPR). You can disconnect Canva at any time within the app. See Canva's Privacy Policy.

3.5 Local Storage (IndexedDB)

Presentations, documents, mind maps, workspace data, and session history are stored in your browser's IndexedDB. This data never leaves your device unless you explicitly export it or enable Drive sync. Clearing your browser data will permanently delete this information.

3.6 AI Features (user-provided API keys)

Visually's AI features (AI Cockpit, image generation, presenter notes) require you to provide your own API keys (e.g. OpenAI, Anthropic). Your keys are stored exclusively in your browser's localStorage and are sent directly from your device to the respective AI provider — never to our servers. When you use an AI feature, your prompt content is transmitted to your chosen provider subject to their own privacy policy. Please do not input sensitive personal data into AI prompts.

3.7 Cloudinary (temporary media processing)

Some media conversion features temporarily upload files to Cloudinary. Uploaded files are automatically deleted after approximately 12 hours. Legal basis: legitimate interest in providing the conversion feature (Art. 6 (1) f GDPR). See Cloudinary's Privacy Policy.

3.8 Firebase Realtime Database

Certain interactive features (live audience view, quiz responses, collaborative session metadata, cursors, chat, and activity history) temporarily write data to Firebase Realtime Database. Collaborative session data is deleted automatically when the host ends the session or disconnects. Other data is typically deleted within 1–2 months.