Slidesearch Privacy Notice
Last updated: June 8, 2026
This Privacy Notice explains how O8X B.V. processes personal data when providing Slidesearch.
1. Who We Are
Unless this notice states that we act as a processor on behalf of a customer, O8X B.V. is the controller of the personal data described in this notice. O8X B.V. is registered with the Dutch Chamber of Commerce under number 42056846.
For privacy-related questions, contact:
2. Customer Workspaces
When Slidesearch processes personal data contained in customer workspaces, repositories, presentations, or connected Microsoft 365 environments, the customer is generally the controller and O8X B.V. acts as a processor on the customer's behalf.
If you have questions about personal data contained in a customer workspace, please contact the relevant customer directly.
3. Personal Data We Process
Depending on how you use Slidesearch, we may process:
- account information such as name and email address;
- information received from Microsoft 365 tenants operated by our customers, including authenticated user account information such as name, email address, and tenant identifiers, and Microsoft 365 content metadata customers authorize us to access, such as SharePoint and OneDrive site, drive, and folder metadata;
- authentication and workspace information;
- usage and diagnostic information, including IP address, device information, and application logs;
- support communications; and
- content and metadata processed through customer-configured repositories and integrations.
4. How We Use Personal Data
We use personal data to:
- provide and operate the service;
- authenticate users and manage accounts;
- maintain security and prevent abuse;
- provide support and communicate with customers;
- improve the reliability and performance of the service; and
- comply with legal obligations.
We do not sell personal data.
We do not use customer content to train or fine-tune foundation models for our own benefit unless the customer expressly agrees in writing.
5. Legal Bases
Where O8X B.V. acts as controller, we rely on the following legal bases for the following purposes:
| Purpose | Typical Personal Data | Legal Basis |
|---|---|---|
| Provide the website, respond to inbound business inquiries, and take steps requested before entering into a contract | IP address, request metadata, business contact details, website form submissions | legitimate interests to operate and secure the website and communicate about Slidesearch, and pre-contract steps at your request where applicable |
| Create and administer accounts, authenticate users, provision workspaces, and provide the contracted service | name, business email address, account identifiers, workspace identifiers, authentication records | contract necessity |
| Provide customer support and service communications | contact details, workspace details, support history, attachments, diagnostic context | contract necessity and legitimate interests in supporting customers and maintaining service continuity |
| Secure the service, detect abuse, investigate incidents, maintain logs, and defend legal claims | IP address, device information, audit trails, security logs, usage metadata | legitimate interests and, where applicable, legal obligation |
| Maintain books, records, invoices, and tax documentation | billing contact details, transaction records, invoices | legal obligation and contract necessity |
| Measure website usage and improve the website and service | cookie identifiers, browser data, page and event analytics, approximate location derived from IP address | consent where required by law, and otherwise legitimate interests in measuring and improving website and service performance |
Where O8X B.V. acts as processor for customer workspace data, the customer determines the applicable legal basis.
6. Service Providers
We use third-party service providers to help operate Slidesearch, including providers for hosting, infrastructure, analytics, AI processing, search, and email delivery.
A current list of subprocessors is available in Subprocessors.
7. International Transfers
Slidesearch primarily processes personal data within the European Economic Area.
Some service providers may process personal data outside the European Economic Area or allow remote access from outside the European Economic Area, including providers with global operations such as Cloudflare, Google, and Microsoft.
Where personal data is transferred internationally, we rely on one or more of the following safeguards, as applicable:
- an adequacy decision issued by the European Commission;
- the EU Standard Contractual Clauses;
- the EU-U.S. Data Privacy Framework or the UK Extension or Swiss equivalent where applicable; and
- supplementary contractual, organizational, and technical measures, including access controls, encryption in transit, encryption at rest where supported, and data minimization.
A copy of the relevant transfer safeguard can be requested at [email protected].
8. Retention
We retain personal data only for as long as reasonably necessary to provide the service, comply with legal obligations, resolve disputes, enforce agreements, and maintain security and operational records.
Unless a longer retention period is required by law, legal hold, dispute resolution, or security needs, we apply the following retention periods:
| Data Category | Retention Period |
|---|---|
| Website server logs and edge security logs | 90 days |
| Website analytics data | 14 months |
| Website inquiry and request-access submissions | 12 months after the last interaction unless the inquiry becomes a customer relationship |
| Account profile and authentication records | during the account term plus 30 days |
| Customer workspace data, uploaded slides, and processed output | until deleted by the customer, the workspace is deleted, or the subscription ends, subject to backup and legal hold requirements |
| Backups | 30 days |
| Billing and tax records | 7 years |
| Security and audit logs for product access and administration | 180 days |
| Support requests and support correspondence | 2 years after ticket closure |
If a customer requests earlier deletion and no legal or security exception applies, we will delete or anonymize the relevant personal data within the periods described above.
9. Your Rights
Depending on your location and applicable law, you may have rights to:
- access personal data;
- correct inaccurate personal data;
- request deletion of personal data;
- restrict or object to certain processing activities;
- request data portability;
- withdraw consent where processing is based on consent; and
- lodge a complaint with the supervisory authority in the country of your habitual residence, place of work, or the place of the alleged infringement. For O8X B.V., the lead supervisory authority is the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
We do not make decisions based solely on automated processing, including profiling, that produce legal effects or similarly significant effects on individuals.
To exercise these rights, contact [email protected].
Where we process data on behalf of a customer, we may direct your request to that customer.
10. Security
We use reasonable technical and organizational measures designed to protect personal data against unauthorized access, disclosure, alteration, and loss.
11. Changes
We may update this Privacy Notice from time to time. The latest version will always be available on our website.
12. Contact
For privacy questions or requests:
[email protected]
O8X B.V.
Het Hoogt 00038
1025HA Amsterdam