Privacy notice

This notice covers Cue: the website and the app at cuedecks.app, its MCP server, and the links you share from it (share links and follow links). It says what Cue stores, why, for how long, and which other companies are involved.

Who is responsible

Zyad Abuzeid, trading as Pink Panther Labs, Prenzlauer Promenade 191, 13189 Berlin, Germany. Email: hello@pinkpantherlabs.com.

For your account and for this website, we decide what is processed and why. For what a company puts into its workspace (decks, brand kits, data sources, members), that company decides, and Cue processes it on the company's behalf. If your company needs a data processing agreement, email us.

What Cue stores, and why

Your account

Your email address, your name and picture (which you set, or which Google provides if you sign in with Google), your Google account ID if you linked Google, your preferences (theme, presenter defaults) and when you last signed in. We use them to sign you in and to show who did what. They're kept until your account is deleted.

Sign-in sessions and links

• Sessions: a random session ID (stored only as a hash), how you signed in, your browser's user agent, the approximate location Cloudflare reports for the request (city and country), and when the session started and was last used. This keeps you signed in and lets you see and end your sessions. A session ends after 30 days or when you sign out.
• Sign-in links: the email address a link was sent to, the IP address that asked for it, and when. We use them to send the link and to limit how many links one address or IP address can request. They're deleted after about a day.

Workspaces and their content

• The workspace's name, icon and settings, its members and their roles, and pending invitations.
• Decks and every version of them. Each version records who made the change (a person, or an AI app acting for them) and the instruction behind it.
• Decks you import from a PowerPoint file or Google Slides: Cue keeps the deck it makes (the slides' text, tables, charts' numbers, speaker notes and the pictures it places) and the file's name in its history. It doesn't keep the file itself. Pictures over 48 KB go into the brand kit's image library.
• Brand kits, including logos, and each kit's image library: pictures you upload, add from a URL, or that Cue collects from a website when you import a brand from it, with where each came from, who added it, and the description and tags Cue or a person wrote for it; for a picture Cue made, the brief and the prompt it drew from; and the kit's characters (a name, a description and the pictures that show them). A picture is served from an address with a long random key, so anyone who has a deck that shows it can open it. Removing a picture deletes its file unless a deck still shows it.
• Companies your workspace makes decks for (customers and prospects): a name, a website domain, a logo, a color and a paragraph on what they do, read from that company's public website when you import it, or entered by a person, with where and when it was read and who added it. A deck for a company names it. Cue doesn't read anything else from their site, and doesn't send a company's logo or name to its picture model.
• Data sources (a URL or an uploaded CSV file), the values Cue read from them, refresh schedules and change alerts.
• Review series, share links, notifications, and an audit log of who did what in the workspace and when.

This is the product itself. It's kept until the workspace is deleted. An owner can restore a deleted workspace for 30 days; after that it's removed with everything in it.

Apps you connect to read from

You can connect your own accounts at other services so Cue can read from them: Stripe, HubSpot, Amplitude, PostHog, Mixpanel, ChartMogul, Jira and Confluence, Google Drive and Sheets, Linear, Notion, GitHub, or another MCP server you name. For each connection Cue stores which service it is, the account name or email the service reports, the read-only tools Cue may use, and its access and refresh tokens (for Stripe, the restricted API key you paste), encrypted (AES-GCM) before they're stored. From Stripe Cue reads subscriptions, subscription changes and invoices with their amounts, statuses, dates and customer IDs, never customer names, emails or payment details. For Google, Cue also stores the list of files you chose (their IDs, names and types). Cue reads from a connection only when you ask: for a data source you set up, while writing or editing a deck at your request, or to import a presentation you chose. What it reads for a data source is kept with that source as its latest values. Disconnecting deletes the tokens and the file list. You can also revoke Cue's access at the service itself.

Connected AI apps

When you connect an app such as Claude, ChatGPT or Cursor through Cue's MCP server, Cue stores the app's name, the workspace you picked, when the app was last used, and its access tokens (as hashes). The app acts as you, with your role. A connection ends after 30 days without use, and you and the workspace's admins can disconnect it in Settings. With each change the app makes to a deck, Cue keeps a short note of what you asked for (at most 500 characters) if the app sends one; it never reads your conversation.

Share-link views

When someone opens a share link, their browser keeps a random ID in local storage. Cue stores a hash of that ID together with the link (so one viewer can't be followed across links), when the view started and was last active, which version they saw, and the seconds spent on each slide. Cue doesn't store IP addresses or user agents for views and uses no third-party trackers. Members of the deck's workspace aren't counted on share links. The workspace sees views and time per slide for as long as it exists. A share link never identifies who opened it.

Who read a review (private links)

On a paid plan, a workspace can see who opened its private links (a deck's or a review's address under its own name, not a share link): its members who are signed in, and people who got in with a one-time code. For each of them Cue stores their email address with the view: when they opened it and were last active, which version they saw, and the seconds spent on each slide, so the workspace sees who opened a review's pre-read, how far they read, and who hasn't opened it yet. The page tells them so, naming the workspace, before they read. Still no IP addresses, user agents or third-party trackers. The company that runs the workspace decides this (an admin can turn it off under Settings), so it is the controller for these views and Cue processes them on its behalf. They're kept for as long as the workspace exists. People who opened a private link can ask that company, or us, about their data.

A review's editors can name who it's for (a list of email addresses) and turn on a digest: before each review, its presenter gets a notice and an email listing who in that list hasn't opened it. Whoever makes a share link with a label or a recipient gets a notice and an email the first time it's opened, without anything about who opened it.

Votes before a review

Where a workspace turns it on, people reading a share link or a private link can vote in a deck's polls before it's presented. Cue keeps only the count for each option. To allow one vote per poll, it keeps a keyed hash of the poll and the random ID the voter's browser holds, with no option, time, view or email address beside it, so a vote can't be traced to anyone. The browser remembers which polls it voted in (not how). These votes are kept apart from live votes, for as long as the deck exists.

Private links and one-time codes

A workspace can let people at its partners' email domains open its private links. If you ask for a one-time code, Cue stores your email address, which link you asked from, a hash of the code and when, to send the code and to limit how many one address can ask for; codes are deleted after about a day. Once you've typed a code, Cue keeps your email address with a hash of a random pass your browser holds, for that workspace, for 30 days, and the workspace's admins see in its audit log that your address got in. Views by people who got in with a code are counted together, unless the workspace sees who read its reviews (above). Cue limits how often one network address can ask for codes or try links without storing the address.

Live presentations

While a deck is presented live, Cue keeps the session's deck version, the current slide, a hash of the presenter's token, a snapshot of any bound numbers, and how many remotes and followers are connected. Viewers following along don't need an account and aren't identified. A session's data is deleted 24 hours after its last activity.

Followers can vote in polls, ask and upvote questions and send reactions. Their browser keeps a random follower ID the session issued, so a reload is still them; the session keeps it, and a salted hash of their IP address to limit abuse, only until the session's data is deleted. A question shows its text and, only if the follower typed one, a name. After the session, the workspace keeps each poll's results, the questions with their upvotes and what moderators did with them, the most followers at once and how many read each language, never follower IDs or addresses. When a follower or share-link reader picks another language, the deck's text (not speaker notes) is sent to OpenAI to translate it, and the translation is kept with that version of the deck.

Technical data

Cloudflare processes IP addresses and request details to deliver Cue and protect it from abuse. Cue's server logs (requests and errors) are kept by Cloudflare for a few days. To stop people guessing live-session codes, wrong codes are counted per IP address for a minute.

Website analytics

The website and the app's pages count visits with Cloudflare Web Analytics. Decks, share links, follow links and the other pages whose address names a deck or carries a link's code don't load it. It sets no cookies and stores nothing in your browser, and Cloudflare doesn't track individual visitors across websites with it. For each page view it records the page's address (without anything after a ?), the website that linked to it, your browser, operating system and type of device, your country, which Cloudflare derives from the request, and how fast the page loaded. We see only totals, not individual visitors.

Where sign-ups come from, and first steps

When you sign up, Cue records where you came from if the link you followed says so: a follow or share link's “Presented with Cue” mark, a campaign tag in the link (such as utm_source), or the website that sent you. It also records the page of this site you signed up from. Nothing is stored in your browser for this: the source travels in the links themselves.

For each workspace, Cue also records the date it first reaches each of these steps: a brand kit imported from a website, a first deck, a first data source, a first live presentation or share link, the second cycle of a review, a first invitation and a first paid plan. These records hold ids, dates and the source, never names, email addresses, IP addresses or deck content. Only Cue's operator sees them, as totals and a list of recent sign-ups without names, to learn which channels and first steps work. A sign-up's record is deleted with your account.

Google user data

This section covers data Cue receives from Google APIs.

What Cue accesses

• Sign in with Google: your name, email address, profile picture and Google account ID, to create your Cue account and sign you in.
• Google Drive and Sheets connector (only if you connect it): the files you choose yourself in Google's file picker, and nothing else in your Drive. Cue uses Google's drive.file permission, which covers only those files. For a chosen spreadsheet Cue reads its tabs and cell values; for a document or presentation, its text; and for a presentation you import, the whole presentation as a PowerPoint file, which Cue turns into a deck and doesn't keep.

How Cue uses it

Only to provide the features you use: to sign you in, to show the values from a sheet you chose on your slides and keep them up to date, to use a file you chose while writing or editing a deck you asked for, and to import a presentation you chose as a deck. Cue doesn't use Google user data for advertising, doesn't sell it, doesn't use it to build profiles of you, and doesn't use it to develop, improve or train generalized AI or machine-learning models. Nobody at Cue reads it, except with your permission, to investigate security issues or abuse, or where the law requires it.

Sharing

Cue shares Google user data only as needed to provide the feature you asked for: Cloudflare stores it as Cue's host, and when you ask Cue's AI to write, edit or import a deck using a file you chose, the relevant content is sent to OpenAI to do that task, with storage turned off. Under OpenAI's API terms it isn't used to train their models. Cue doesn't transfer Google user data to anyone else, except where the law requires it or to keep Cue secure.

Storage, protection and deletion

Google access tokens are encrypted before they're stored. Values Cue reads from a sheet for a data source are stored with that source in your workspace until you delete the source or the workspace. Disconnecting Google in Profile, Connections deletes Cue's tokens and your list of chosen files right away. You can also remove Cue's access at myaccount.google.com/connections. To have your Google sign-in data deleted, delete your account (email us).

Limited Use

Cue's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Cookies and local storage

Cue only stores what it needs to work. There are no advertising or analytics cookies and no advertising trackers. Cue's website analytics sets no cookies and stores nothing in your browser.

Name	Purpose	Kept for
__Host-cue_session (cookie)	Keeps you signed in	30 days
__Host-cue_oauth (cookie)	Protects a Google sign-in while it's in progress	10 minutes
__Host-cue_guest (cookie)	Remembers that you proved your work email with a one-time code, so a workspace's private links open for you	30 days
__Host-cue_handoff, __Host-cue_checked (cookies)	On a workspace's own address: protect signing you in from Cue's app, and remember for a while that it checked	20 and 30 minutes
cue.theme (local storage)	Your light or dark theme	Until you clear it
cue.viewer (local storage)	The random ID that counts unique viewers of a share link, and allows one vote per poll before a review	Until you clear it
cue.voted (local storage)	Which polls you voted in before a review (not how), so the page says so	Until you clear it
cue.remote.* (session storage)	Lets the phone remote control your presentation	Until you close the tab
cue.moderate.* (session storage)	Lets a moderator link run a session's polls and questions	Until you close the tab
cue.follower.* (local storage)	The random ID a live session gave you as a follower, so your vote and questions stay yours after a reload	Until you clear it
cue.reader.lang (local storage)	The language you read follow and share links in	Until you clear it

Services Cue uses

These companies process data for Cue (subprocessors):

• Cloudflare, Inc. (USA): hosting and network (Workers), the database (D1, in Cloudflare's Eastern Europe region), live sessions (Durable Objects), connected-app tokens (Workers KV), PDF export (Browser Rendering), logs and website analytics (Web Analytics).
• OpenAI (USA): writing, editing and importing decks, drafting brand kits from a website, describing a brand kit's pictures and making new ones in its style, writing demos and review copy, and translating decks for followers and share-link readers. Cue sends what each task needs: your brief or instruction, the deck's content, the slides' text of a presentation you import (never its pictures or speaker notes), the text of the website for a brand import, a brand kit's pictures when you ask Cue to describe them (with their alt text, file name and the page they came from), and, when you ask Cue to make a picture, your brief, the kit's colors and name, and the pictures you picked as references (with a character's description). For a deck for a company, Cue's writer and editor also get that company's name, domain and what they do. Requests are sent with storage turned off, so OpenAI doesn't keep the responses for later use. Under OpenAI's API terms, API data isn't used to train models, and OpenAI may keep it for up to 30 days to detect abuse.
• Resend, Inc. (USA): sends sign-in links, one-time codes for private links, invitations, change alerts, a share link's first open and review digests. It receives the recipient's email address and the email's content.
• Paddle.com Market Ltd (UK): processes payments for paid plans as our reseller and merchant of record. When a workspace owner buys a plan, Paddle collects their name, email address, billing address and payment details itself, and handles payment, taxes and invoices; as the seller, it's also responsible for that data under its own privacy notice. Cue never receives or stores card details. Paddle isn't involved while Cue is free during early access.

Your browser and Cue also contact:

• Google Fonts: Cue's pages and decks load fonts from fonts.googleapis.com and fonts.gstatic.com, so your browser sends your IP address to Google when it loads them.
• Google sign-in: only if you choose to sign in with Google. Cue then receives your name, email address, picture and Google account ID.
• Websites and data sources you name: when you import a brand from a website or add a data source, Cue fetches that address from Cloudflare's network.
• AI apps you connect: what an app reads through Cue's MCP server is then handled under that app's own terms.
• Services you connect to read from (Stripe, HubSpot, Amplitude, PostHog, Mixpanel, ChartMogul, Atlassian, Google, Linear, Notion, GitHub or another MCP server you name): Cue contacts them with your connection's token when it reads for you. See Google user data for Google.

Cloudflare, OpenAI, Resend and Google are based in the United States and may process data there. Transfers to them rely on the EU–U.S. Data Privacy Framework or on standard contractual clauses in their data processing terms. Paddle is based in the United Kingdom, which the EU recognizes as providing adequate protection.

Legal bases

• To provide Cue (your account, sessions, workspaces and content, emails you ask for, and paid plans): performance of a contract, Art. 6(1)(b) GDPR.
• To keep records the law requires (orders and invoices): legal obligation, Art. 6(1)(c) GDPR.
• To keep Cue secure (rate limits, logs, the audit log) and to show a workspace how its share links are viewed: legitimate interests, Art. 6(1)(f) GDPR.
• To learn how people find and start using Cue (website analytics, where sign-ups come from and first steps): legitimate interests, Art. 6(1)(f) GDPR. You can object at any time by emailing us.
• Content in a workspace, and who read its private links: processed for the company that runs the workspace, under Art. 28 GDPR. That company decides why and on which legal basis.

Your rights

You can ask for access to your data, a copy of it, and its correction or deletion. You can ask us to restrict processing or object to it, and you can complain to a data protection supervisory authority. Email hello@pinkpantherlabs.com.

In the app, you can change your name and picture under Profile, end your other sessions, disconnect AI apps, and leave or delete workspaces. To delete your account, email us. If your data is in a company's workspace, that company may need to act on your request; we'll help it do so.

Changes

We'll update this notice when Cue changes what it stores or which services it uses, and date each version.