Data Processing Addendum for Slaide Cloud

How AIVory processes personal data for Slaide Cloud and Slaide for Confluence and Jira, with the EU Standard Contractual Clauses.

Parties. The customer (controller) and AIVory (processor), for Slaide for Confluence and Jira and Slaide Cloud.

  1. Subject and duration. AIVory processes personal data to give the customer the Slaide service. The addendum lasts as long as the customer uses the service, plus the deletion period.
  2. Nature and purpose. Hosting, storing, and rendering decks. Sending selected content to AI model providers to build decks.
  3. Data and people. Atlassian account IDs, display names, and the page and issue content that the customer’s users select. The data subjects are the customer’s users and the people named in that content.
  4. Instructions. AIVory processes the data only on the customer’s documented instructions. The use of the service is an instruction.
  5. Confidentiality. Every person who has access to the data must keep it confidential.
  6. Security. TLS 1.2 or higher in transit. Encrypted disks at rest. Access limited to staff who need it. Request logs do not contain deck, page, or chat content.
  7. Sub-processors. The customer gives general authorisation for the sub-processors on https://getslaide.com/privacy/ (Hetzner, Microsoft Azure, DeepInfra, Baseten, Mistral AI, and others listed there). AIVory tells the customer 30 days before a change. The customer can object in that period. A change of AI model at a listed provider is not a change of sub-processor.
  8. Assistance. AIVory helps the customer answer data-subject requests and does so within 30 days. AIVory tells the customer without undue delay (and within 72 hours) after it finds a personal data breach.
  9. Deletion and return. On request, or 30 days after the end of the service, AIVory deletes the data, unless law requires storage. AIVory can export the decks before deletion.
  10. Audit. AIVory gives the information needed to show compliance and allows reasonable audits with 30 days’ notice.
  11. International transfers. Slaide Cloud is in the USA. For data from the EEA, UK, or Switzerland, the parties agree to the EU Standard Contractual Clauses (Module 2, controller to processor; Module 3 if the customer is a processor). Clause 7: no docking clause. Clause 9(a): option 2, 30 days. Clause 11: no independent dispute body. Clause 17: Irish law. Clause 18: Irish courts. For the UK, the UK Addendum applies. Annex I is sections 1–3 above. Annex II is section 6. Annex III is the sub-processor list.
  12. Contact. [email protected]; security contact [email protected].