Compliance and responsible AI
How Many Slides Pro handles privacy, content moderation, and EU AI Act obligations.
GDPR (Regulation 2016/679)
We act as data controller for account data, projects, and prompt content. Lawful basis per purpose is documented in our Privacy Policy. EU residents can exercise access, correction, portability, restriction, objection, and erasure rights.
Lawful basis per purpose
| Purpose | Lawful basis | Examples |
|---|---|---|
| Account creation and authentication | Contract (Art. 6(1)(b)) | Email, hashed password, language, profile fields |
| Project, artifact, and version storage | Contract (Art. 6(1)(b)) | Prompts, artifact drafts, brand cues, version history |
| AI processing (prompts, model input/output) | Contract (Art. 6(1)(b)) | Workspace content sent to the configured model |
| Billing, invoicing, tax | Legal obligation (Art. 6(1)(c)) | Plan tier, transaction records, VAT |
| Fraud, abuse, and security logs | Legitimate interest (Art. 6(1)(f)) | IP, request metadata, anomaly signals |
| Aggregated analytics (when enabled) | Consent (Art. 6(1)(a)) | Page views, feature usage, device class |
| Marketing communications | Consent (Art. 6(1)(a)) | Email subscription, beta program opt-in |
Retention windows
| Data category | Retention |
|---|---|
| Account data | Active account plus 30 days after deletion |
| Projects, prompts, artifacts, versions | Active account plus 30 days after deletion |
| AI run transcripts and activity events | 90 days |
| Export bundles on R2 | 30 days |
| Authentication cookies and session tokens | 7 days |
| Cookie consent records | 6 years (Art. 30 record of processing) |
| Security and abuse logs | 12 months |
| Tax and billing records | 6 years (Moldovan law) |
Sub-processors
| Sub-processor | Purpose | Location |
|---|---|---|
| Cloudflare | Pages, Workers, D1, R2, Email Routing, Browser Rendering, AI inference | Global edge; primary storage in EU/US regions selected at runtime |
| Email delivery provider | Transactional email (auth, billing receipts, moderation notices) | EU/US |
Privacy contact
For privacy requests (access, portability, erasure, restriction, objection) and any EU representative inquiry, contact privacy@manyslides.pro. We respond within 30 days.
DSA (Regulation 2022/2065)
Many Slides Pro is a hosting intermediary for shareable artifacts. We honour notice-and-action, statement of reasons, and out-of-court dispute references even though we are below the VLOP threshold.
- Single point of contact for authorities: legal@manyslides.pro
- Report this artifact button on every public share view - report is triaged within 7 days
- Statement of reasons is sent to the author whenever an artifact is restricted
- Out-of-court dispute bodies are listed in our Terms of Use
EU AI Act (Regulation 2024/1689)
We are a general-purpose AI system deployer for the underlying Cloudflare Workers AI models. We do not train models; we route prompts and orchestrate quality agents.
- AI-generated content is labeled 'Generated by Many Slides Pro using AI' on every artifact surface, share preview, and exported file
- The exact model name is recorded per artifact version and surfaced in the share footer
- AI Act Art. 5 prohibited uses are forbidden in our Terms of Use and enforced in prompt preflight
- Annex III high-risk contexts trigger an in-studio warning and require explicit confirmation before generation
Art. 5 EU AI Act - prohibited uses
- Subliminal techniques beyond a person's consciousness to materially distort behavior causing harm
- Exploitation of vulnerabilities due to age, disability, or social/economic situation
- Social scoring by public authorities leading to detrimental treatment
- Predictive policing based solely on profiling or personality traits
- Untargeted scraping of facial images from the internet or CCTV to build recognition databases
- Inferring emotions in workplaces or educational institutions (except medical or safety use)
- Biometric categorization inferring race, political opinion, sexual orientation, or religion
Annex III high-risk contexts we screen for
- Employment and worker management (hiring, evaluation, promotion, termination)
- Access to education or vocational training (admissions, grading, exam proctoring)
- Access to essential private or public services and benefits (credit, insurance, emergency dispatch)
- Law enforcement, migration, and border control
- Administration of justice and democratic processes
- Critical infrastructure (water, gas, electricity, traffic)
- Medical or safety-critical device use
AI literacy (Art. 4)
Operators are trained on prompt evaluation, hallucination risks, model limits, and incident reporting. Records are kept by the engineering team.