Privacy Policy
Last updated 5 November 2026
PPTmatic has no accounts, no analytics and no advertising. It keeps what it needs to make your template and deliver it, and this page says exactly what that is.
In short
| What | Where it goes | Can we see it? |
|---|---|---|
| The name you type while trying looks | Stays in your browser, apart from its first letter on some covers | Only that letter |
| Your design once you pick a look: name, description, slides, logo and pictures | Supabase, through this website | Yes |
| Decks an AI tool makes on your design | Supabase, through this website | Yes |
| Your email address and what you bought | Supabase, Stripe and Resend | Yes |
| Your card details | Stripe, on its own pages | Not your full card number |
| The list of your designs, and a copy of each | Your browser | No |
Who is responsible
PPTmatic is run by Marco Lüthi, the controller responsible for data processing under the Swiss Federal Act on Data Protection (FADP) and, where it applies, the EU General Data Protection Regulation (GDPR).
Marco Lüthi
Gutstrasse 172, 8055 Zürich, Switzerland
hi@luthi-mar.co
Trying looks
The name you type on the first page is used in your browser to draw the looks. It isn’t saved or sent anywhere until you pick a look, with one exception: a 3D cover shows the name’s first letter, so that one letter goes to this website’s server to draw the picture. Finished pictures are kept to save drawing them again, and they aren’t connected to you.
Your design
When you pick a look, your design is saved in a database and private storage at Supabase, Inc., the same project as our font site, which only this website’s server can reach: the name, any description you give, its colours and type, your slides, your logo and your pictures. We use it to show you the studio and to build your files, and for nothing else.
A design has its own long address. Anyone who has the address of a design that hasn’t been bought can open and change it, so treat it like a password. A design that has been bought opens only with its .pptmatic file or code.
Design files (.pptmatic) hold your settings, slides and pictures. A bought design’s file also holds its code. Anyone you give the file to can open the design.
AI tools
Each design has an address for AI tools that support MCP, such as Claude or ChatGPT. If you connect one, it can read your design’s details and pictures’ names, and it sends us the content of the decks it makes, which are saved with your design. What it does with your conversation is covered by the terms and privacy policy of whichever tool you use, such as Anthropic’s or OpenAI’s. PPTmatic itself doesn’t use AI, and nothing you give us is used to train any.
A deck’s review link can be opened by anyone who has it. It shows that deck’s slides and speaker notes, and not the rest of your design.
Buying
Checkout happens on Stripe’s own pages. Stripe receives your email address, your payment details and whatever else its checkout asks for. We never see your full card number. Stripe’s own privacy policy applies to what it collects there.
When you’ve paid, we keep a record of the sale in a database at Supabase, Inc.: your email address, the design’s name and its code, what you paid, and when we emailed you. The design and files you bought are kept in private storage at Supabase, so that you can get them again. This is the same database as our font site, Typomat, and the sale appears in its private admin view, which only Marco Lüthi can open.
Your template, design file and code are emailed to you by Resend, Inc. We only email you to deliver what you bought, and to send it again if you ask. There’s no mailing list.
In your browser
- A cookie for each design you’ve bought. It holds that design’s code, so that this browser can open it, and lasts 400 days. It’s set only when you pay, open a design file or enter a code. It’s needed for the site to do what you asked, so there’s no consent banner. Scripts on the page can’t read it.
- A list of your designs, and a copy of each. These stay in your browser’s local storage and IndexedDB, so that you can carry on where you left off, and we can’t read them. Removing a design from “Your designs” removes them.
There are no other cookies, and no analytics, advertising or tracking. Our fonts and textures come from this website, so pages don’t call anyone else’s servers.
Server logs and limits
This website is hosted by Vercel Inc., which keeps short-lived server logs of requests, as for any website, which include your internet address. So that codes can’t be guessed and nobody can flood an inbox, we also count tries by internet address, and requests to resend a file by email address. Those counts are held in memory for a few minutes and aren’t written down.
How long we keep things
Nothing here is deleted automatically. Designs, decks and sales stay until you ask us to delete them, by writing to hi@luthi-mar.co. If you’ve bought a template, we still have to keep the accounting records of the sale for as long as Swiss law requires, currently ten years. If we delete what you bought, you can’t download it from us again.
Legal basis
Where the GDPR applies, making your design, taking payment and delivering your files rest on providing what you asked for (Art. 6(1)(b) GDPR). Keeping accounting records rests on a legal obligation (Art. 6(1)(c) GDPR). Keeping the site secure and free of abuse rests on legitimate interest (Art. 6(1)(f) GDPR). Under the Swiss FADP, we process personal data only as described here and in line with its principles.
Your rights
You can ask for access to your personal data, and to have it corrected or deleted. You can object to or restrict processing, and ask for your data in a portable form. As there are no accounts, tell us your email address or the design’s address or code, so that we can find it. Write to hi@luthi-mar.co.
You can also complain to a supervisory authority: in Switzerland the Federal Data Protection and Information Commissioner (FDPIC), and in the EU the data protection authority of your country.
International transfers
Vercel is based in the United States. Vercel, Supabase, Stripe and Resend may process data outside Switzerland and the EU, under safeguards such as standard contractual clauses and the Data Privacy Framework.
Children
PPTmatic is made for people and businesses building a brand. It isn’t directed at children and doesn’t knowingly collect data from them.
Changes to this policy
If PPTmatic starts handling data differently, this page will be updated before the change ships, and the date at the top will change. See also our Terms of Use.