Privacy notice

You do not have to email anyone to exercise your rights. Open your profile and you can:

• Download everything — one file containing your profile, every session and slide you made, your flashcards and revision history, the sessions you attended, your certificates and your contributions. This is your right of access and portability.
• Correct your details — name, role, hospital, handle, bio, photo and links are all editable in the app.
• Delete your account and everything in it, permanently, including the images you uploaded. This is your right to erasure.

For anything else — restriction, objection, or a request on behalf of someone who only attended a session — email hello@slidebites.com or use the contact form and pick "Data or privacy request". We reply within one month, free of charge.

SlideBites is operated by SlideBites, established in the United Kingdom, and is the controller for the data described here. Contact us about anything in this notice at hello@slidebites.com. Where you upload teaching material, you are responsible for making sure it contains no patient-identifiable or other unlawfully shared personal data — see our acceptable use policy.

• Account data (name, email, password hash, profile handle, bio, avatar, links) — to create and secure your account and show your public profile. Basis: performance of our contract with you.
• Sign-in data from Microsoft, Google or Apple, where you use them (such as name, email address, profile picture where provided, and the provider's account identifier) — only to create and authenticate your account. We do not post to those accounts or read your contacts, calendar, email or files. Basis: performance of our contract. If you use Apple's Hide My Email, we only see the relay address Apple provides.
• Content you create (topics, briefs, slides, notes, images you upload, flashcards, folders) — to provide the service. Basis: performance of our contract.
• Topic text sent for AI generation — passed to our AI provider to build your session, and not used by us to train models. Basis: performance of our contract. Never include patient-identifiable information in a prompt.
• Session delivery data (join codes, attendance, answers to questions, reactions, confidence signals, feedback responses, certificates) — to run live sessions and issue attendance records. Answers can be given anonymously. Basis: performance of our contract and our legitimate interest in useful teaching analytics.
• Emails you ask us to send (certificate emails, contact-form messages and our reply) — to deliver what you requested and to answer you. Basis: performance of our contract and legitimate interests.
• Contribution and purchase data (amount, frequency where relevant, optional public display name/message, Stripe payment reference, or Apple App Store transaction and product identifiers) — to verify, record and administer support payments, refunds and subscription status. We never receive or store your full payment-card details. Basis: performance of our contract and legitimate interests; publishing your name or message is optional and based on your choice.
• Technical and security data (IP address where processed by infrastructure providers, device and browser information, app version, log and error data) — to keep the service secure, prevent abuse, diagnose faults and maintain reliability. Basis: legitimate interests.
• Push-notification data, where you enable notifications (a device or installation identifier, push token, platform and notification preference) — to deliver the notifications you ask for and keep the token associated with the correct signed-in account. Basis: performance of our contract and your device-level permission.

Where we rely on consent — publishing your name on the supporter wall, or emailing a certificate to an address you type in — you can withdraw it at any time and we will act on it. We do not use your data for advertising and we do not make automated decisions that have a legal effect on you.

• Supabase — the database, authentication, file storage and realtime infrastructure that holds your account and content.
• Our AI provider — receives the topic and brief you type in order to generate a session. It does not receive your account details.
• Resend — sends transactional email such as certificates, contact-form messages and replies.
• Stripe — our payment processor for contributions: payments, subscription management, tax compliance, invoicing, refunds and related customer service.
• Microsoft, Google and Apple — only when you choose their sign-in service, to authenticate you.
• Hosting, error-monitoring, content-delivery and push-notification infrastructure providers that run the service or deliver notifications, including Apple Push Notification service or Google/Firebase infrastructure where applicable.
• Professional advisers (legal, accounting) and authorities, where we are required or permitted by law.

Every provider acts on written terms as our processor and may only use the data to provide their service to us. We do not sell your personal data, and we do not use your clinical teaching content to sell advertising.

Your profile is private unless you make it public. Sessions and flashcard sets are shared to the library only when you choose to share them, and you can make them private again at any time. Live answers can be given anonymously, and a supporter name or message only appears publicly if you tick the box.

Some of our providers process data outside the UK and EEA. Where that happens we rely on UK/EU adequacy decisions or on Standard Contractual Clauses (with the UK Addendum where relevant), together with additional safeguards such as encryption in transit and at rest. You can ask us for details of the safeguards for any particular provider.

• Account and content: while your account is active. When you delete your account it is removed immediately, along with your sessions, slides, uploads, flashcards and certificates.
• Attendance and certificate records of sessions you taught: kept while your account exists, so learners can verify their teaching record; removed with the account.
• Contribution records: the transaction, amount and date are kept for 7 years for tax and accounting. When you delete your account we immediately strip your name, message and email from those records, so only the anonymous financial entry remains. Stripe keeps its own copy as the payment processor.
• Contact-form correspondence: up to 24 months.
• Security and error logs: typically up to 12 months.
• Push-notification device records: while notifications are enabled for that installation or until the token is replaced, disabled or no longer needed.

When data is no longer needed we delete it or irreversibly anonymise it.

• Access — get a copy of your data. Download it yourself from your profile.
• Rectification — have inaccurate data corrected. Edit it in the app or ask us.
• Erasure — have your data deleted. Delete your account from your profile, or ask us.
• Portability — receive your data in a structured, machine-readable format. Our export is JSON.
• Restriction and objection — ask us to pause processing, or object to processing based on our legitimate interests.
• Withdraw consent — for anything we do on the basis of consent, at any time.
• Complain — to the UK Information Commissioner's Office at ico.org.uk, or to the supervisory authority where you live or work.

Requests are free and answered within one month. We may ask you to confirm your identity so we do not disclose your data to someone else.

You do not need an account to join a session. In that case we hold the display name you typed, your answers, any feedback you gave, and — if you asked for one — a certificate and the email address you sent it to. To see or delete that record, email hello@slidebites.com with the session date and the name you used, and we will action it within one month.

We use appropriate technical and organisational measures: encrypted connections, encryption at rest, row-level access rules so users can only reach their own data, private file storage with short-lived signed links, least-privilege service credentials, secret management and monitoring. No system is perfectly secure, so please use a strong, unique password. If a breach is likely to risk your rights, we will tell the regulator within 72 hours and tell you without undue delay.

SlideBites is intended for educators, learners and professionals aged 16 or over. It is not designed for use by children under 16 as account holders. If you believe a child has created an account contrary to this rule, contact us and we will review and remove it where appropriate.

Storage that is strictly necessary — signing you in, security, and keeping your place and your answers in a live session — is used on the basis that you asked for the service. Anything optional, such as remembering your text size or presenter notes, is only used with your consent, asked for in a banner where the law requires it and always changeable from “Cookie settings” at the bottom of any page. We run no advertising, no cross-site tracking and no third-party analytics, we do not sell or share your personal information, and our typeface is served from our own site so nothing about you goes to a font host. Full detail is in the cookie notice.

If we change this notice we will update the date at the top and, for anything significant, tell you in the app. If the change affects optional storage we will ask you again.