Privacy Policy

1. Introduction

Deck (“we”, “us”, or “our”) is operated by Soho Tech Holdings Pty Ltd, an Australian company. We provide a customer feedback management platform that helps product teams synthesize, organize, and share user research insights.

This Privacy Policy explains how we collect, use, store, and protect your personal information when you use our service at getdeck.io (the “Service”). We are committed to protecting your privacy and handling your data transparently.

2. Information We Collect

2.1 Account Information

We use Clerk for authentication. When you create an account, the following information may be collected and stored by Clerk:

• Email address
• Name and surname (if you sign up via social login such as Google)
• Organization membership information

Note: Deck does not store personal identity information in our own databases. This data is managed by Clerk in accordance with their privacy practices.

2.2 Customer Feedback Data

When you use Deck, you may upload or connect the following types of data:

• User interview recordings: Video and audio files you upload directly to Deck
• Transcripts: Text transcriptions of your interviews
• Insights and themes: Synthesized insights generated from your feedback data
• Video snippets: Highlight clips created from your recordings

2.3 Integration Data

If you connect third-party services to Deck:

• CRM Integrations (Salesforce, HubSpot, Attio): We store only CRM user and account IDs. We do not store CRM record data. When you filter by CRM properties, we query your CRM in real-time. Your organization administrator controls which CRM fields can be queried.
• Slack Integration: We fetch data from Slack channels you designate and can post insights to channels you specify.

2.4 Usage Analytics

We collect usage data through PostHog using cookieless tracking. This includes:

• Feature usage patterns
• Performance metrics
• Error logs

We also use the OpenAI Ads Measurement Pixel on our marketing website and app to measure page views and attribute visits to ads. It records page views and uses first-party attribution cookies. We also send registration and paid-subscription conversion events to OpenAI with an event type, timestamp, event ID, and sanitized source URL; those server-side payloads do not include email, phone, or name. If automatic advanced matching is enabled in Ads Manager, the browser pixel may also detect and hash supported contact details on our pages.

2.5 Payment Information

Payment processing is handled entirely by Stripe. We do not store credit card numbers, bank account details, or other payment credentials on our servers.

3. How We Use Your Information

We use your information for the following purposes:

• Providing the Service: Processing your feedback data, generating insights, and enabling collaboration features
• AI-Powered Analysis: Sending transcripts and insights to large language model (LLM) providers to generate synthesized insights (see Section 4)
• Service Improvement: Analyzing usage patterns, including the identified MCP usage events described in Section 12.4, to improve functionality
• Advertising Measurement: Measuring page views and attributing visits to ads through the OpenAI Ads Measurement Pixel and first-party attribution cookies (see Section 2.4)
• Communication: Sending service-related notifications and responding to support requests
• Legal Compliance: Meeting our legal obligations and protecting our rights

4. Data Processing by AI Providers

To provide AI-powered synthesis and insight generation, we send certain data to third-party LLM providers:

• Google (Gemini)
• Anthropic (Claude)
• OpenAI

What we send: Interview transcripts, insights, and themes for processing.

5. Data Storage and Regional Hosting

5.1 Your Choice of Data Region

Organization administrators can choose where their data is stored from the following regions:

• United States: Oregon
• Europe: London
• Australia: Sydney

This regional choice applies to:

• Database storage (Neon Postgres)
• Full interview recordings (Vercel Blob)
• Video snippets (AWS S3)

5.2 Infrastructure Providers

We use the following infrastructure providers:

• Vercel: Application hosting and blob storage
• Neon: PostgreSQL database
• AWS: S3 storage for video snippets
• Upstash: Redis caching
• Clerk: Authentication (note: Clerk data region cannot be selected by users)
• Nango: Third-party integrations

6. Data Retention

Active accounts: We retain your data for as long as your account is active.

Inactive accounts: If your account has no activity for 365 consecutive days, your data may be deleted.

Deletion requests: When you request deletion of your data, we will complete the deletion within 14 days of your request.

7. Data Sharing

We do not sell your data. We share page-view, attribution, and conversion-event information with OpenAI for advertising measurement through its Ads Measurement Pixel and Conversions API, as described in Section 2.4.

We share data only with:

• Service providers: The infrastructure and AI providers listed in this policy, and OpenAI for Ads Measurement Pixel and Conversions API processing, to provide the services described here
• AI assistants you connect: The provider of any AI assistant you connect to Deck, which receives the data you request through that connection (see Section 12)
• Legal requirements: When required by law, court order, or government request
• Business transfers: In connection with a merger, acquisition, or sale of assets, with notice to you

8. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

8.1 All Users

• Access: Request a copy of the personal data we hold about you
• Correction: Request correction of inaccurate data
• Deletion: Request deletion of your data
• Data portability: Request your data in a portable format

8.2 Additional Rights for EU/UK Users (GDPR)

If you are located in the European Union or United Kingdom, you also have the right to:

• Restrict processing: Request that we limit how we use your data
• Object to processing: Object to processing based on legitimate interests
• Lodge a complaint: File a complaint with your local data protection authority

Legal basis for processing (GDPR): We process your data based on: (a) your consent; (b) performance of our contract with you; (c) our legitimate business interests; or (d) compliance with legal obligations.

8.3 Exercising Your Rights

To exercise any of these rights, contact us at matt.teixeira@getdeck.io. We will respond within 30 days (or sooner where required by law).

9. Security

We implement appropriate technical and organizational measures to protect your data, including:

• Encryption of data in transit (TLS) and at rest
• Access controls and authentication
• Regular security assessments
• Infrastructure hosted on enterprise-grade cloud providers

We are building our practices in accordance with SOC 2 certification standards.

10. International Data Transfers

While you can choose your primary data storage region, some data processing may occur in other locations:

• AI processing: Data sent to LLM providers may be processed in the United States
• Authentication: Clerk may process authentication data in the United States
• Analytics: Anonymized usage data may be processed internationally

Where data is transferred internationally, we ensure appropriate safeguards are in place, including standard contractual clauses where applicable.

11. Children's Privacy

Deck is a business-to-business service not intended for children. We do not knowingly collect personal information from anyone under 16 years of age. If you believe we have collected information from a child, please contact us immediately.

12. AI Assistants and MCP Integrations

12.1 What an MCP Connection Is

Deck provides a Model Context Protocol (MCP) server at mcp.getdeck.io that lets you connect Deck to a third-party AI assistant, such as ChatGPT, Claude, or Cursor. A connection is created only when you choose to add Deck to an AI assistant and then sign in to Deck to authorize it through an OAuth flow managed by Clerk. Once connected, the AI assistant can retrieve data from your Deck workspace and, when you ask it to, create or update data in Deck on your behalf.

An AI assistant can only access a Deck organization that you are a member of, where an organization administrator has enabled MCP access and your role is permitted to use it. Even when no organization is available to it, a connected AI assistant can still retrieve your own profile and the list of organizations you belong to (name, URL slug, and your role), as described in Section 12.2.

12.2 Information We Process

When you use Deck through a connected AI assistant, we process:

• Account and organization identifiers: Your Deck user ID and, from Clerk, the organizations you belong to (organization ID, name, and URL slug) and your role in each
• Connection records: For each organization, a record of your MCP connection containing your user ID, the organization ID, when you first connected, and when the connection was last used
• Tool requests: The requests your AI assistant sends to Deck, including the name of the tool or resource used and its inputs, such as search query text, filters, and the content of any records you ask it to create or update
• Data returned to the AI assistant: The Deck data needed to answer each request, which may include themes, insights, customer feedback excerpts, interview transcripts, NPS results, competitor research, opportunities, initiatives, and projects. This data can contain personal information about your own customers, such as names or quotes in transcripts.
• Your profile, when requested: If the AI assistant asks for your user context, Deck returns your user ID, first and last name, email addresses, profile image URL, account creation date, and last sign-in time. When listing or selecting organizations, Deck also returns organization names, URL slugs, and your role.

Note: Deck only receives what your AI assistant includes in a request. We do not receive your full conversation with the assistant.

12.3 How We Use This Information

• Authorizing requests: Verifying your identity and checking that MCP access is enabled for your organization and permitted for your role
• Fulfilling your requests: Retrieving the Deck data the AI assistant asks for and making the changes you ask it to make, under your user account. If you ask the assistant to start competitor research, we also use your primary email address to help identify your company.
• Administration:Showing organization administrators which members have connected an AI assistant, with each member's name, email address, and connection times
• Product analytics:Understanding how Deck's MCP tools are used so we can improve them (see Section 12.4)

12.4 Who Receives This Information

• Your AI assistant provider: The provider of the AI assistant you connect (for example, OpenAI for ChatGPT or Anthropic for Claude) receives the data Deck returns in response to your requests, including any profile information described in Section 12.2. The provider handles this data under its own terms and privacy policy, not this one, and may process it outside your selected data region.
• PostHog (analytics):For each tool or resource request, we send PostHog an event containing your user ID, the organization's ID, name, and URL slug, your role, the name of the tool or resource, the resource address (if any), and the search query text (if the request includes one). We also associate your organization ID, name, URL slug, and role with your user ID in PostHog. Some features, such as competitor research, send additional usage events that include your user ID and organization ID.
• Our service providers: Clerk (authentication and OAuth), and the infrastructure and AI providers listed in Sections 4 and 5.2, which handle data from MCP requests in the same way as data from the Deck app

12.5 Retention

We retain MCP connection records, MCP analytics events, and any data created through an AI assistant in accordance with Section 6. Data your AI assistant receives from Deck is retained by the assistant provider under its own policies.

12.6 Your Controls

• Disconnect:You can remove the Deck connection at any time in your AI assistant's connector or app settings. Disconnecting does not delete data the assistant has already received or your connection record in Deck.
• Organization settings:In Deck under Settings > MCP, organization administrators can turn MCP access on or off, choose whether admins, members, or both may use it, and see which members have connected. MCP access is off for an organization until an administrator turns it on.
• Access and deletion: You can exercise the rights in Section 8, including requesting deletion of your MCP connection records, by contacting us at matt.teixeira@getdeck.io

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by:

• Posting the updated policy on our website with a new effective date
• Sending an email notification for significant changes

Your continued use of the Service after changes become effective constitutes acceptance of the updated policy.

14. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us: