GDPR & Privacy
Deckyard includes features to help you comply with GDPR and privacy regulations.
Overview
Section titled “Overview”Manage user data, privacy settings, and comply with data protection regulations. Deckyard provides tools for:
- Data export (right of access)
- Data deletion (right to erasure)
- Analytics opt-out
- Lead data anonymization
- Cookie consent management
Data Export
Section titled “Data Export”Users can export their own data for GDPR compliance (right of access) using the Data Backup feature.
What’s Included
Section titled “What’s Included”A data export contains:
- All presentations created by the user (as JSON)
- Referenced images (local uploads and remote URLs)
- Optionally: version history, image library, slide library, themes
Requesting an Export
Section titled “Requesting an Export”Users can request their data export:
- Go to Settings > Data Export
- Select which additional data to include
- Click Start export
- Download the ZIP when the export completes (in-app notification + optional email)
The download link is available for 2 hours. See Data Backup for full details.
Export Format
Section titled “Export Format”Data is exported as:
- JSON format for presentations and structured data
- Original format for images and media files
- ZIP archive containing everything
Admin Exports
Section titled “Admin Exports”Admins can export user data on behalf of users:
- Go to Admin > Users
- Select the user
- Click Export Data
Data Deletion
Section titled “Data Deletion”Users have the right to erasure under GDPR.
User-Initiated Deletion
Section titled “User-Initiated Deletion”Users can request deletion of their analytics data:
- Go to Settings > Privacy
- Click Delete My Analytics Data
- Confirm the deletion
This removes:
- View tracking data
- Interaction history
- Engagement metrics
Note: This doesn’t delete presentations or account data. Account deletion must be requested from an admin.
Admin Deletion
Section titled “Admin Deletion”Admins can delete all user data:
- Go to Admin > Users
- Select the user
- Click Delete User
- Choose what to delete:
- Account only
- Account and all presentations
- Account and all data (full erasure)
Presentation Owner Transfer
Section titled “Presentation Owner Transfer”Before deleting a user, consider transferring their presentations:
- Go to the presentation
- Click Settings > Transfer Ownership
- Select the new owner
- Confirm the transfer
Analytics Opt-Out
Section titled “Analytics Opt-Out”Allow users to opt out of analytics tracking.
How It Works
Section titled “How It Works”When a user opts out:
- No view tracking for their sessions
- No interaction logging
- No engagement metrics collected
- Still able to submit forms and votes (anonymous)
Enabling Opt-Out
Section titled “Enabling Opt-Out”Users can opt out in their settings:
- Go to Settings > Privacy
- Toggle Analytics Tracking off
Viewer Opt-Out
Section titled “Viewer Opt-Out”Public viewers can opt out via:
- Cookie consent banner
- Privacy settings link
- URL parameter:
?analytics=off
Respecting Do Not Track
Section titled “Respecting Do Not Track”Deckyard respects the browser’s Do Not Track (DNT) header:
- When DNT is enabled, analytics are disabled
- This can be configured at the instance level
Lead Anonymization
Section titled “Lead Anonymization”Anonymize captured lead data while retaining aggregate statistics.
Why Anonymize
Section titled “Why Anonymize”- Comply with data retention policies
- Keep statistical insights without personal data
- Reduce liability from stored personal information
Anonymization Process
Section titled “Anonymization Process”When leads are anonymized:
- Personal identifiers are removed (name, email)
- A hash is retained for deduplication
- Aggregate statistics are preserved
- Timestamps are retained for trend analysis
Bulk Anonymization
Section titled “Bulk Anonymization”Admins can anonymize old leads:
- Go to Admin > Leads
- Click Anonymize Old Leads
- Set the age threshold (e.g., older than 90 days)
- Confirm the action
Automatic Anonymization
Section titled “Automatic Anonymization”Configure automatic anonymization:
LEAD_RETENTION_DAYS=90LEAD_AUTO_ANONYMIZE=trueAfter the retention period, leads are automatically anonymized.
Cookie Consent
Section titled “Cookie Consent”Manage cookie consent for GDPR compliance.
Cookie Categories
Section titled “Cookie Categories”Deckyard uses cookies in these categories:
| Category | Purpose | Required |
|---|---|---|
| Essential | Session, authentication | Yes |
| Functional | Preferences, language | No |
| Analytics | Usage tracking | No |
Consent Banner
Section titled “Consent Banner”Enable a cookie consent banner:
- Go to Admin > Settings
- Enable Cookie Consent Banner
- Customize the message
- Configure link to privacy policy
Consent Storage
Section titled “Consent Storage”User consent is stored:
- In a cookie (
cookie_consent) - Valid for 1 year
- Recorded with timestamp
Third-Party Cookies
Section titled “Third-Party Cookies”Deckyard minimizes third-party cookies:
- Media embeds may set cookies (YouTube, etc.)
- External fonts may set cookies
- Configure via Content Security Policy
Privacy Policy Link
Section titled “Privacy Policy Link”Configure your privacy policy URL:
PRIVACY_POLICY_URL=https://yoursite.com/privacyThis link appears in:
- Cookie consent banner
- User settings
- Registration forms
- Lead capture forms
Data Processing Agreements
Section titled “Data Processing Agreements”For enterprise deployments:
- Deckyard can be self-hosted for full data control
- No data is sent to third parties (except configured integrations)
- Database remains under your control
Compliance Checklist
Section titled “Compliance Checklist”Ensure GDPR compliance:
- Privacy policy published and linked
- Cookie consent banner enabled
- Data export functionality available
- Data deletion process documented
- Analytics opt-out available
- Lead retention policy configured
- Data processing agreement in place
- User rights documented