SlideRepo Privacy Policy

Last updated: 14 July 2026
Effective date: 14 July 2026

This Privacy Policy explains how SlideRepo (“the Add-in”) handles personal data. SlideRepo is published by The No Good Company (“we”, “us”, “the Provider”).

TL;DR

• Your slides never reach us. Slides, categories, audit logs, and settings live in your own Microsoft 365 tenant: your SharePoint and OneDrive. We have no access to them, and no ability to gain access.
• We run no analytics, no telemetry, and no tracking. There is no measurement SDK in the Add-in. We do not profile you and we do not sell or share personal data.
• Three narrow things do reach us, and we describe each below in detail: a bug report if you choose to send one; standard web-server logs when PowerPoint loads the Add-in’s files; and, if your organization gets SlideRepo through Microsoft AppSource, the purchase and contact details Microsoft passes to us as the publisher.
• You can leave at any time. Remove the Add-in and delete its configuration folders, and nothing of it remains.

The detail follows. Section 3 is the important one.

1. Who we are and how to reach us

The No Good Company, [LEGAL ENTITY NAME AND REGISTERED ADDRESS : to be completed], is the data controller for the personal data described in section 3.

For any privacy question, or to exercise the rights in section 9:

privacy@thenogoodcompany.com
General enquiries: info@thenogoodcompany.com

We are not required to appoint a Data Protection Officer and have not appointed one. Privacy requests are handled by the team at the address above.

2. What SlideRepo is

SlideRepo is a Microsoft Office Add-in that runs inside PowerPoint. It lets colleagues find, insert, contribute, and govern slides stored in their organization’s own SharePoint document library.

It is delivered as static JavaScript, HTML, and CSS. There is no SlideRepo application server and no SlideRepo database holding your content. The Add-in talks directly from your device to Microsoft’s APIs using your own Microsoft 365 credentials.

3. What data is involved, and who controls it

This is the part that matters, so we have split it by who holds the data and in what role.

3.1 Your content: in your tenant, not ours

Our role: none. For this data your organization is the controller and Microsoft is its processor under your Microsoft 365 agreement. We are not in that chain. We cannot read this data, we hold no key to it, and removing the Add-in does not give us any.

This is a design property, not a promise about our conduct.

3.2 Data exchanged with Microsoft

The Add-in calls Microsoft Graph (graph.microsoft.com) using the access token Microsoft issues to your signed-in account. These calls go directly from PowerPoint to Microsoft. They do not pass through us.

Permissions the Add-in requests, and why:

The Add-in cannot see anything your own account cannot see. It inherits SharePoint’s permissions and does not bypass them.

Microsoft’s handling of this data is governed by your agreement with Microsoft and its Privacy Statement.

3.3 Data that reaches us: the complete list

(a) Bug reports you choose to send.

When you open Information menu → Report a bug, fill in the form, and press Send, we receive:

• The description you wrote and the severity you selected.
• Your name and email address, taken from your Microsoft identity token. We do not ask you to type these; taking them from the verified token means they cannot be spoofed.
• Environment details: app version, Office host and platform, screen resolution, locale, the active repo’s display name and SharePoint hostname, your browser’s user-agent string, and a timestamp.
• The Add-in’s in-session diagnostics log, attached as a file. This records the actions and errors of your current session.
• A screenshot, only if you attach one.

Legal basis: our legitimate interests (Art. 6(1)(f) GDPR) in diagnosing and fixing faults in a product you use, and in supporting the request you made of us. You control whether this happens: nothing is sent unless you press Send.

A note on the diagnostics log: it may incidentally contain slide names, category names, and repo names, because those appear in the actions it records. It does not contain slide content. If that matters to you, review the log before sending. Open the task pane with ?debug=1 appended to the URL to read it.

(b) Web server logs.

When PowerPoint opens the task pane it fetches the Add-in’s files from our hosting provider. Like any web server, it records the request: IP address, user-agent, requested URL, timestamp.

Legal basis: our legitimate interests (Art. 6(1)(f)) in delivering the files, keeping the service secure, and diagnosing outages. We do not use these logs to identify you or build a profile, and we do not combine them with anything else.

(c) Purchase and contact data from Microsoft AppSource.

If your organization acquires SlideRepo through Microsoft AppSource, Microsoft passes us information about that acquisition, including contact details for the person who acquired it, transaction details, and usage information. This is Microsoft’s practice as the marketplace operator, described in the Microsoft Marketplace Terms of Use. It happens automatically as a result of the purchase, not through any action of yours, and not through the Add-in.

We use it to fulfil and support the licence, and to meet tax and accounting obligations.

Legal basis: performance of a contract (Art. 6(1)(b)) for fulfilment and support; legal obligation (Art. 6(1)(c)) for tax and accounting records; our legitimate interests (Art. 6(1)(f)) for the limited purpose of contacting a customer about their own licence.

We will not send you marketing on the basis of this data without asking you first.

That is the complete list. Nothing else about your use of the Add-in reaches us.

4. What we do not do

• We do not run analytics or telemetry. There is no Google Analytics, Mixpanel, Segment, Amplitude, Hotjar, FullStory, or any equivalent in the Add-in. Nothing reports back on what you click.
• We do not use cookies. The Add-in stores your Microsoft sign-in token and a session diagnostics log in your browser’s local storage on your own device. This is strictly necessary to keep you signed in, is not transmitted to us, and is not used for tracking.
• We do not sell personal data, and we do not “share” it as that term is defined under California law. We have never done so and we have no plans to.
• We do not use your data to train AI or machine-learning models.
• We do not advertise in the Add-in.
• We do not profile you or make automated decisions about you that produce legal or similarly significant effects (Art. 22 GDPR).

5. Who we share data with

We do not sell, rent, or trade personal data. We disclose it only to:

We may also disclose personal data where we are legally required to, such as a court order or a binding request from a competent authority, or where necessary to establish, exercise, or defend legal claims. If we receive such a request we will tell you unless we are legally prohibited from doing so.

If we are ever involved in a merger, acquisition, or sale of assets, personal data may transfer to the acquirer. We would give notice before that happened and the acquirer would remain bound by this policy or one no less protective.

6. Where data is stored, and international transfers

• Your content stays in your Microsoft 365 tenant, in whatever region Microsoft hosts it for you. You choose that; we have no involvement.
• Bug reports are held in our support system, [REGION : to be completed].
• Server logs are held by our hosting provider, [REGION : to be completed].

Where personal data is transferred out of the European Economic Area, the United Kingdom, or Switzerland to a country without an adequacy decision, we rely on the European Commission’s Standard Contractual Clauses (and the UK Addendum, or the Swiss equivalent, as applicable) with the recipient. You can request a copy of the relevant safeguards at the privacy address in §1.

7. How long we keep it

Your content in your own tenant is retained according to your organization’s SharePoint and OneDrive policies. We have no say in it and cannot delete it for you.

8. Security

• Sign-in uses Microsoft’s OAuth 2.0 / OpenID Connect via MSAL.js. We never see, receive, or store your password.
• Your access token is held in your browser’s local storage on your device. It expires per Microsoft’s policy and is refreshed silently where possible.
• All traffic, to Microsoft Graph, to our hosting, and to our support system, uses HTTPS (TLS 1.2 or higher).
• The Add-in authenticates to our support system with a Microsoft-issued token verified against Microsoft’s public keys. No secret key or API key is embedded in the Add-in, so there is nothing in the shipped code for an attacker to extract.
• Access to our support system is limited to staff who need it to answer tickets.

No system is perfectly secure, and we will not pretend otherwise.

Breach notification. If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority within 72 hours of becoming aware of it, as Art. 33 GDPR requires. Where the breach is likely to result in a high risk to you, we will notify you directly and without undue delay.

Reporting a vulnerability. Email info@thenogoodcompany.com with the subject “Security report”. We will acknowledge within five business days. We will not pursue legal action against good-faith security research that does not access other users’ data, degrade the service, or violate the law.

9. Your rights

Depending on where you live, you have some or all of the following rights over the personal data described in §3.3:

• Access: a copy of what we hold about you
• Rectification: correction of inaccurate data
• Erasure: deletion (“right to be forgotten”)
• Restriction: limit how we use it
• Portability: receive it in a machine-readable form
• Objection: object to processing based on legitimate interests, including at any time to direct marketing
• Withdraw consent: where we relied on consent, without affecting prior processing

Where the data lives in your tenant (§3.1), we cannot help you. We have no access. Ask your organization’s IT or data protection team; they have full control of the SharePoint and OneDrive content.

For the data in §3.3, contact us at privacy@thenogoodcompany.com. We will respond within 30 days. If a request is complex we may extend by a further two months and will tell you why within the first 30 days. We do not charge for this unless a request is manifestly unfounded or excessive.

We may need to verify your identity before acting, usually by confirming you control the email address associated with the request.

California residents: we do not sell or share personal information, and we do not offer financial incentives, so there is nothing to opt out of. You retain your rights to know, delete, correct, and to non-discrimination for exercising them. Use the same contact address.

Complaints. We would rather you came to us first. But you have the right to complain to a supervisory authority: in the EEA, the authority in your country of residence, work, or where the issue arose; in the UK, the Information Commissioner’s Office; in Switzerland, the Federal Data Protection and Information Commissioner.

10. Children

SlideRepo is a professional tool for business use. It is not directed at children, we do not knowingly collect personal data from children, and it is not made available through consumer channels. If you believe a child has provided us personal data, contact us and we will delete it.

11. Changes to this policy

If we change this policy we will update the date above. If a change materially affects how we handle your personal data, particularly if we ever begin collecting something not listed in §3.3, we will give notice before it takes effect, through the Add-in or by email, and where the law requires consent we will ask for it rather than assume it.

The current version is always at privacy.html.

12. Contact

The No Good Company
[LEGAL ENTITY NAME AND REGISTERED ADDRESS : to be completed]

Privacy: privacy@thenogoodcompany.com
General: info@thenogoodcompany.com