Privacy Policy

Last updated: September 20, 2026

1. Introduction

Welcome to Noxi (accessible at noxi.ai), an AI-powered presentation generator ("Service"). This Privacy Policy describes how Noxi ("we", "us", or "our") collects, uses, stores, shares, and protects your personal information when you access or use our Service, including when you sign in through third-party authentication providers such as Google.

By using our Service, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree with the terms described herein, please do not use the Service.

2. Information We Collect

2.1 Account Information

When you create an account or sign in using Google OAuth, we receive and store the following information from your Google profile:

  • Your name
  • Email address
  • Profile picture URL
  • Google account identifier (unique ID)

We do not receive or store your Google password. Authentication is handled securely through the OAuth 2.0 protocol.

2.2 User-Generated Content

When you use the Service, we collect content you create or provide, including:

  • Text prompts and instructions submitted to generate presentations
  • Presentation data (slide content, titles, descriptions, layout preferences)
  • Uploaded files (images, PDFs, documents) used as references for generation
  • Custom branding assets (logos, color schemes, fonts)
  • Edits and modifications made to AI-generated content

2.3 Automatically Collected Data

When you use the Service, certain technical information is collected automatically:

  • Browser type and version
  • Device type and operating system
  • IP address and approximate geographic location
  • Pages visited and features used within the Service
  • Session duration and interaction patterns
  • Referring URL and search terms that led you to the Service

2.4 Cookies and Local Storage

We use browser cookies and local storage to maintain your session, remember your preferences (such as theme, layout settings, and recent presentations), and provide a seamless experience across visits. You can clear this data at any time through your browser settings, though doing so may require you to sign in again.

For non-essential tracking (analytics and error monitoring) we will not load any third-party scripts or send any beacons until you opt in via our cookie banner. Your decision is stored under the localStorage key noxi.consent.v1, and you can change it at any time via the link in the footer below.

2.5 Third-party Analytics and Monitoring

With your consent, we use the following third-party services to measure usage and detect crashes. Each loads only after you grant the matching consent category, and each receives the minimum data required for its function. We never sell or share this data for advertising purposes.

  • Vercel Web Analytics (analytics) — anonymous page-view counts, referrer, country-level geography, device class. URL query strings are stripped client-side before any beacon is sent. Privacy Policy
  • Vercel Speed Insights (analytics) — Web Vitals measurements (LCP, CLS, INP, FCP, TTFB) per route. No personal data, no user identifiers. Privacy Policy
  • Google Analytics 4 (via Google Tag Manager) (analytics) — usage statistics. Loaded under Google Consent Mode v2 with all advertising flags denied unless you explicitly grant analytics consent. Privacy Policy
  • Sentry (error monitoring) — diagnostic information for application crashes. Sensitive data (auth headers, request bodies, query strings, console output containing user content) is scrubbed before transmission. With your monitoring consent, Sentry also captures a short visual session replay of the page (mouse movements, clicks, scrolls, layout) so we can reproduce bugs you encounter; replays are sampled at approximately 10 % of opted-in sessions and 100 % of sessions where an error occurs. All form inputs (passwords, OAuth tokens, payment fields, free-text fields) are masked as ●●● in the replay before it leaves your browser. Network request and response bodies are never recorded — only URLs, status codes, and timing. Replays are retained for 90 days and then automatically deleted. Privacy Policy

2.6 Optional Connections to Third-party AI Clients

Noxi may make optional account connections available for third-party AI clients such as Claude, ChatGPT, or Codex. These connections are disabled unless you initiate the OAuth authorization flow and approve the permissions shown on Noxi's consent screen. A connection is limited to the Noxi operations and account resources covered by that authorization; it does not make your presentations public or give the client unrestricted access to your Noxi account.

When you authorize a connection, the OAuth identity flow provides the authorized client with a stable Noxi account identifier and your verified email address, plus your display name when one is available. The optional connector profile tool may omit display fields from its own response, but the OAuth identity flow can still provide the identity fields listed here.

If you use a connection, Noxi may return the presentation or template metadata and content needed to complete your request, but only when the corresponding capability is available and the approved authorization permits it. The receiving client processes that data under its own terms and privacy policy.

You can remove Noxi from the connection or connector settings provided by the third-party client; what that removal stops or changes is governed by that provider. You may also ask Noxi to revoke the authorization by emailing info@noxi.ai. Once Noxi has revoked the authorization, Noxi will reject future requests made under it. Neither step deletes copies already received or retained by the third-party client; contact that provider about its copy.

3. How We Use Your Information

We use the information we collect for the following purposes:

  • Provide the Service: Generate AI-powered presentations based on your prompts and uploaded content.
  • Authenticate your identity: Verify your account through email/password or Google OAuth sign-in.
  • Save and sync your work: Store your presentations, edits, and preferences so you can access them across sessions and devices.
  • Improve the Service: Analyze usage patterns to identify bugs, optimize performance, and develop new features. When you rate a generated slide, we also keep a layout-only record of it as described in section 5.
  • Communicate with you: Send transactional emails (e.g., password resets), respond to support requests, and notify you of significant changes to the Service or this policy.
  • Ensure security: Detect, prevent, and respond to fraud, abuse, and security threats.
  • Comply with legal obligations: Fulfill legal requirements, enforce our Terms of Service, and protect our rights.

4. AI Processing and Third-Party Services

Our Service relies on third-party providers to generate presentation content and images, convert reference documents, verify visual output, and recognize speech. When you submit a prompt, upload a file, or choose voice dictation, relevant data may be transmitted to the following services for processing:

  • ElevenLabs (Scribe) — When you start voice dictation and allow microphone access, your browser streams microphone audio to ElevenLabs to return speech as text in the editable input. Privacy Policy
  • Anthropic (Claude) — Used for text generation, presentation structuring, and AI editing. Privacy Policy
  • OpenAI — Used for text generation and presentation structuring. For custom-template analysis, it receives your template instructions, selected rendered reference pages, and bounded compiled visual and semantic QA evidence to identify style and layout rules and verify the result. Privacy Policy
  • Google Gemini — Used for image generation and multimodal processing, including selected reference images needed to reconstruct content-free custom-template backgrounds when exact native extraction is unavailable. Privacy Policy
  • Evolink — An image-generation gateway used to fulfil certain image requests; receives the image prompt needed to generate the requested visual. Website
  • ConvertAPI — When document conversion is required, receives the PDF or PPTX reference needed to determine page or slide count and render selected pages as images for custom-template analysis. Privacy Policy
  • Browserless — Receives compiled template or generated-slide markup and the short-lived asset URLs necessary to render English and Arabic QA screenshots, check layout and logo placement, and safely rasterize supported SVG logos. Privacy Policy
  • Perplexity — Used to research a topic when a presentation needs current, sourced facts; receives the search queries derived from your topic or prompt, and returns the findings and source links used to ground the generated content. Privacy Policy
  • Google OAuth — Used for secure account authentication. Privacy Policy

Speech recognition takes place on ElevenLabs servers. NOXI does not create separate audio recordings or stored transcription records; text you choose to send or save is handled like any other prompt or chat message. ElevenLabs' processing, including retention, is subject to the terms applicable to its service.

We send only the minimum data necessary for each operation. We do not sell or share your data with these providers for their own marketing or advertising purposes. Their processing of your data is governed by their respective privacy policies linked above.

5. Feedback on Generated Slides

When you rate an individual generated slide as good or poor, we record that rating together with a layout-only copy of the slide.

Before anything leaves your browser, the slide is stripped of its meaning:

  • every piece of text is replaced with neutral placeholder wording of the same length
  • figures are replaced with generic values such as 42% or 1.2M
  • images are replaced with a placeholder, and the links to them are removed entirely

What remains is the arrangement — spacing, proportions, hierarchy, where an image sits — with none of what you wrote inside it. We keep this so we can see which layouts work and correct the ones that do not. Our servers repeat the same stripping before storing the record, and the removed content is never restored.

We do not use your presentations, prompts, or uploaded files to train or fine-tune AI models. A layout-only record that we review and approve may later be used as a design example that guides how future presentations are composed; such examples contain placeholder text only.

A rating and its layout record are deleted when you delete your account. Ratings we have not reviewed are deleted automatically after 90 days.

5.1 Human Review

A small number of authorised people may view these layout-only records. They may also access the content of your account where it is necessary to investigate a fault you reported, respond to a support request, or address a security or abuse issue. We limit such access to what the task requires, and administrative changes to these records are recorded in an internal log.

6. Data Storage and Security

We use Supabase as our backend infrastructure for authentication, database storage, and file storage. Your data is:

  • Encrypted in transit using TLS/SSL protocols
  • Encrypted at rest using AES-256 encryption
  • Stored on servers located in secure data centers
  • Protected by access controls, authentication, and regular security audits

While we implement industry-standard security measures, no method of electronic storage or transmission is 100% secure. We cannot guarantee absolute security, but we are committed to protecting your data to the best of our ability.

7. Data Sharing and Disclosure

We do not sell, rent, or trade your personal information to third parties. We may share your information only in the following limited circumstances:

  • Service providers: With trusted third-party providers (e.g., Supabase, Anthropic, OpenAI, Google, Evolink, ConvertAPI, Browserless, and Perplexity) that help us operate the Service, subject to confidentiality and data-processing obligations appropriate to their role.
  • Content you choose to share: When you enable a share link for a presentation, it becomes accessible to anyone who has that link. Shared presentations are not listed publicly and are excluded from search-engine indexing by default; disabling the share link makes the presentation inaccessible to others again.
  • Legal requirements: When required by law, regulation, legal process, or governmental request.
  • Protection of rights: To protect the rights, property, or safety of Noxi, our users, or the public.
  • Business transfers: In connection with a merger, acquisition, or sale of assets, in which case your data would be transferred to the successor entity.

8. Data Retention

We retain your personal data for as long as your account is active or as needed to provide you with the Service. Custom-template upload reservations expire after two hours. Expired uploads, unpinned failed or deleted files, and obsolete unpinned compiler outputs are then eligible for automated Storage cleanup after the applicable safety grace period. Assets pinned to an immutable published template version are retained while that version is needed to render your presentations. Slide ratings and their layout-only records follow section 5: unreviewed ratings are deleted after 90 days, and all of them are deleted when you delete your account. Anonymized and aggregated data that cannot identify you may be retained indefinitely for analytics purposes.

To request account deletion, contact info@noxi.ai. We verify and process deletion requests in accordance with applicable law, subject to records we must retain for legal, security, fraud-prevention, or dispute-resolution purposes. Deleting an authentication record alone is not treated as complete erasure: associated database records and stored files must also be removed. Until a verified end-to-end self-service erasure workflow is available, these requests are handled manually.

9. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

  • Access: Request a copy of the personal data we hold about you.
  • Correction: Request correction of inaccurate or incomplete data.
  • Deletion: Request deletion of your account and associated data.
  • Portability: Request your data in a structured, machine-readable format.
  • Objection: Object to the processing of your data for certain purposes.
  • Withdrawal of consent: Withdraw consent at any time where processing is based on consent.

To exercise any of these rights, please contact us at info@noxi.ai. We will respond to your request within 30 days.

10. Google Sign-In

When you choose to sign in with Google, our use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically:

  • We only request access to your basic profile information (name, email, profile picture) needed for account creation and authentication.
  • We do not request access to your Google Drive, Gmail, Calendar, or any other Google services.
  • We do not use Google user data for advertising or share it with advertising platforms.
  • You can revoke Noxi's access to your Google account at any time through your Google Account permissions settings.

11. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence. These countries may have different data protection laws. When we transfer data internationally, we take appropriate measures to ensure your data remains protected in accordance with this Privacy Policy and applicable laws.

12. Children's Privacy

Our Service is not directed to individuals under the age of 13 (or the applicable age of digital consent in your jurisdiction). We do not knowingly collect personal information from children. If we become aware that we have inadvertently collected personal data from a child, we will take steps to delete that information promptly. If you believe a child has provided us with personal data, please contact us at info@noxi.ai.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will update the "Last updated" date at the top of this page and, where appropriate, notify you via email or a prominent notice within the Service. We encourage you to review this Privacy Policy periodically.

14. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Noxi — operated by Aidar Akmaev, Abu Dhabi, United Arab Emirates, who is responsible for the personal data described in this policy.

Website: noxi.ai

Email: info@noxi.ai

Terms of Service··Back to Noxi