Privacy

This page explains how Showslide Education handles the personal data of lecturers, students and visitors to this site. It follows our Data Processing Agreement and Technical and Organisational Measures for universities.

Who is responsible

In lectures, your university decides why and how personal data is used. It is the controller. Showslide processes the data on its behalf, only to deliver the service and only on its documented instructions, under a Data Processing Agreement (Article 28 GDPR).

Showslide is run by WIN GRAVITY SRL, Iași, Romania, company registration no. J22/644/2017, VAT no. RO37233986.

What we process

Lecturers and staff

Name, email address, account credentials and presentation content. Needed to create and run sessions.

Students

Reactions, answers to in-session questions, and device and connection data (such as IP address and browser type). Students join without an account and get an anonymous identifier.

Students, only if the lecturer asks

Name, email address, and choice or short-text answers. Collected only when a lecturer adds such a question.

Showslide does not need special categories of personal data (Article 9 GDPR), and lecturers should not ask for them through the platform.

Students

• Students join a session by QR code or link, without creating an account.
• The pages students use load no analytics or advertising tags, including Google Analytics.
• Students never sign in with Google.
• Names, email addresses and short-text answers are collected only when a lecturer explicitly adds that question.

How long we keep it

Lecturer account data

Until the account is deleted, or 30 days after the pilot ends

Session reactions and answers, including names and email addresses collected by a question

90 days

Device data on sign-in sessions (IP address, browser type)

30 days, then removed. Expired sessions are deleted.

Backups

Overwritten after 7 days

Within 30 days of the end of the service, we return or delete all personal data, at the university's choice, and confirm this in writing, unless the law requires us to keep it.

Where it is stored and who processes it

Lecture and student session data is stored and backed up only in Germany, with Hetzner in Falkenstein (ISO 27001 certified). These providers handle lecture sessions and lecturer accounts:

Hetzner Online GmbH Falkenstein, Germany, EU

Hosting of the application, database, files and backups; PDF and image rendering. Handles: All lecture data: presentations, student reactions and answers, lecturer accounts, device data.

Plus Five Five, Inc. (Resend) Ireland, EU

Account and notification emails to lecturers. Handles: Lecturer name and email address.

Functional Software, Inc. (Sentry) EU

Error monitoring. Handles: Technical error details and lecturer account ID; no IP addresses or cookies.

Stripe Payments Europe, Ltd. Ireland, EU; may be accessed from the United States

Payments and subscriptions. Handles: Billing contact and payment details of the paying account; no student data.

These work on the website and lecturer pages only, never on student session pages:

Google Ireland Limited Ireland, EU; may be accessed from the United States

Usage analytics (Google Analytics, through Google Tag Manager). Handles: Pseudonymous usage data on the public website and lecturer pages.

Cloudflare, Inc. Global network; United States

Bot protection (Turnstile) on lecturer sign-in and website forms. Handles: Technical browser signals used to tell people from bots.

Web3Forms Portugal, EU

Contact and pilot forms on showslide.com. Handles: Only what a visitor types into the form.

Google Analytics collects pages viewed, device and browser type, and approximate location from the IP address. It does not receive names, email addresses, presentation content, reactions or answers. Lecturers can choose to sign in with Google; Showslide then receives only their name, email address and Google account identifier.

Some providers are US companies or may access data from the United States. These transfers rely on an adequacy decision, including the EU–US Data Privacy Framework, or on the European Commission's Standard Contractual Clauses. We give universities at least 30 days' notice before adding or replacing a provider.

How we protect it

• All traffic uses HTTPS (TLS 1.2 or higher).
• Databases and backups are encrypted at rest (AES-256).
• Production access is limited to two named engineers, with individual accounts and multi-factor authentication.
• Server logs record only the request method, path and status: no IP addresses, cookies or tokens.
• If there is a personal data breach, we notify the university within 48 hours of becoming aware of it.

Showslide does not yet hold ISO 27001 or SOC 2 certification. ISO 27001 certification and an independent penetration test are planned for 2027.

Your rights

Students and lecturers can ask to access, correct, delete, restrict or move their data, or object to its use. For lecture data, contact your university. If we receive your request, we pass it on to them and help them answer it.

For anything else, email [email protected].

For universities

Our Data Processing Agreement and Technical and Organisational Measures are available on request. Email [email protected].