Privacy Policy
Last updated: April 29, 2026
1. Who we are
SendDeck is a presentation sharing and analytics platform operated by Lukins Labs AB (Org. nr 559517-2676), a Swedish company ("we", "us", "our"). We enable users to upload PDF presentations, share them via unique links, and track how recipients engage with the content.
SendDeck is built on Lovable Cloud, a full-stack cloud platform powered by Supabase's open-source infrastructure. All backend services — including the database, authentication, file storage, and serverless functions — are hosted and managed through Lovable Cloud.
2. Data controller
The SendDeck account holder (the person who uploads and shares presentations) acts as the data controller for any analytics data collected when recipients view their shared links. SendDeck (Lukins Labs AB) acts as the data processor on behalf of the account holder.
3. What data we collect
3.1 Account holders (registered users)
- Email address (for authentication)
- Display name (optional)
- Avatar URL (optional, via OAuth providers)
- Uploaded PDF files and generated slide images
- Subscription plan information
3.2 Presentation viewers (recipients of shared links)
When a recipient opens a shared SendDeck link, the following data is collected to provide the account holder with engagement analytics:
- Anonymised session ID — a randomly generated identifier (not tied to any personal account or login)
- Approximate geolocation — country and city derived from the viewer's IP address via a third-party IP lookup service (ipapi.co). The raw IP address is not stored.
- Approximate coordinates — latitude and longitude at city level (not precise location)
- Device metadata — device type (Desktop/Mobile/Tablet), browser name, and operating system, parsed from the User-Agent header
- Slide engagement — which slides were viewed and time spent per slide
- Engagement events — downloads, shares, and fullscreen toggles
3.3 What we do NOT collect from viewers
- No names, email addresses, or personal identifiers
- No cookies or persistent tracking mechanisms on shared presentation links
- No IP addresses stored in our database
- No login or account creation required to view presentations
Note: cookies and analytics tools are used on our public marketing pages (e.g. senddeck.to landing pages). See Section 6 below. These tools are not loaded on shared presentation viewer links.
4. Legal basis for processing (GDPR Art. 6)
- Account holders: Contract performance (Art. 6(1)(b)) — processing is necessary to provide the SendDeck service.
- Presentation viewers: Legitimate interest (Art. 6(1)(f)) — the account holder has a legitimate business interest in understanding how shared sales materials are engaged with. The data collected is minimal, anonymised, and does not identify individual viewers.
5. Infrastructure & third-party sub-processors
SendDeck's backend infrastructure is provided by Lovable Cloud, which uses the following services:
| Service | Provider | Purpose | Location |
|---|---|---|---|
| Database & Auth | Supabase (via Lovable Cloud) | User accounts, presentation data, analytics | EU (AWS eu-central-1) |
| File storage | Supabase Storage (via Lovable Cloud) | PDF files and slide images | EU (AWS eu-central-1) |
| Edge Functions | Deno Deploy (via Lovable Cloud) | Serverless backend logic (geo lookup, payments) | Globally distributed |
| IP Geolocation | ipapi.co | Derive approximate city/country from viewer IP | N/A (API call, no data stored by them for us) |
| Payments | Stripe | Subscription billing for paid plans | EU/US |
| Authentication (OAuth) | Optional "Sign in with Google" | Global |
6. Cookies & marketing analytics (website only)
On our public marketing website (e.g. senddeck.to), we use a small set of third-party tools to understand how visitors discover SendDeck, measure marketing performance, and improve the product experience. These tools are not loaded on shared presentation viewer links — viewers of shared decks are never tracked by these services.
All non-essential cookies and tracking scripts are gated behind Cookiebot consent and only activate after you accept them. You can change or withdraw your consent at any time via the "Cookie Settings" link in the footer.
| Tool | Provider | Purpose | Category |
|---|---|---|---|
| Cookiebot | Cybot A/S (Denmark) | Consent management platform — collects and stores your cookie consent choices and controls which other scripts are allowed to run. | Strictly necessary |
| Google Tag Manager | Google Ireland Ltd. | Tag container used to load and manage the analytics and marketing tags listed below. GTM itself does not set tracking cookies. | Strictly necessary |
| Google Analytics 4 | Google Ireland Ltd. | Aggregated website analytics — page views, traffic sources, device and country-level statistics. IP anonymisation is enabled. | Statistics |
| LinkedIn Insight Tag | LinkedIn Ireland Unlimited Co. | Measures the performance of our LinkedIn campaigns and enables conversion tracking and audience building for retargeting. | Marketing |
| Microsoft Clarity | Microsoft Ireland Operations Ltd. | Behavioural analytics — heatmaps and anonymised session recordings of marketing pages to help us improve UX. Sensitive inputs are masked. | Statistics |
Some of these providers (Google, LinkedIn, Microsoft) may transfer data outside the EU/EEA. Where this happens, transfers rely on the EU-U.S. Data Privacy Framework and/or Standard Contractual Clauses as the legal transfer mechanism. A full, up-to-date list of cookies set on our website — including their duration and purpose — is available in the cookie declaration accessible via "Cookie Settings" in the footer.
7. Data retention
- Account data: Retained for the duration of the account. Deleted upon account deletion.
- Presentation files: Retained until deleted by the account holder or upon account deletion.
- Viewer analytics: Retained for as long as the associated presentation exists. Deleted when the presentation is deleted by the account holder.
- Marketing analytics cookies: Retained for the duration set by each provider (see cookie declaration). Consent records are stored by Cookiebot for 12 months.
8. Data subject rights (GDPR)
If you are an EU/EEA resident, you have the right to:
- Access your personal data
- Rectify inaccurate data
- Erase your data ("right to be forgotten")
- Restrict processing
- Data portability
- Object to processing
To exercise these rights, contact us at support@lukinslabs.com.
9. Shared link compliance
When a SendDeck user shares a presentation link with a client or prospect, the viewer is not required to create an account or provide any personal information. The analytics collected are limited to anonymised session-level data as described in Section 3.2.
Because no personally identifiable information (PII) is collected from viewers and no cookies are used, the shared link viewing experience is designed to be compliant with GDPR and ePrivacy regulations without requiring explicit cookie consent from viewers.
Account holders who share links are responsible for informing their recipients about analytics tracking in accordance with their own privacy policies and applicable regulations.
10. Security
We implement appropriate technical and organisational measures to protect data, including:
- Encryption in transit (TLS/HTTPS) for all communications
- Encryption at rest for stored data via Lovable Cloud
- Row Level Security (RLS) policies ensuring users can only access their own data
- Optional password protection for shared presentations
- Serverless architecture with no persistent servers to attack
11. Changes to this policy
We may update this Privacy Policy from time to time. We will notify registered users of material changes via email or in-app notification.
12. Contact
For privacy-related questions or requests, contact:
Lukins Labs AB
Org. nr: 559517-2676
Email: support@lukinslabs.com