Privacy Policy

1Who we are and what this policy covers

Kambin provides a PowerPoint add-in and companion website (kambin.ai) that review presentations for formatting and consistency issues and let the user decide which suggested fixes to apply. This Privacy Policy explains what information we collect when you use the Kambin add-in, create or use a Kambin account, visit kambin.ai, or contact us; how we use and share that information; how long we keep it; and the choices and rights you have.

This policy applies to everyone who interacts with Kambin, including early-access and pilot users. Where Kambin is provided to you through your employer or another organization under a customer agreement, that agreement governs any conflict with this policy for the organization's own data, and your organization's administrator may have access to your usage records as described in Section 4.

Kambin is a business tool. It is not directed to children, and we do not knowingly collect personal information from anyone under 16.

2A short version

• The presentation files you review with Kambin are processed in memory to produce results and are not stored by Kambin. They are never written to a database, a backup, or file storage, and they are never used to train any AI model.
• Kambin uses an AI model hosted in Kambin's own Microsoft Azure environment in the United States to read slide text. Text from your slides is sent to that model for the analysis you requested and for nothing else. Slide images are not sent unless you turn on a feature that needs them. Your files are never sent to the public OpenAI service or to any other AI provider.
• We keep the minimum account information needed to sign you in, enforce your plan's usage limits, and keep the service secure. We do not run advertising or behavioral analytics, and we do not sell or share personal information for advertising.
• You can ask us to access, correct, export, or delete your personal information at any time by emailing privacy@kambin.ai. We respond within 30 days.

3Definitions

Customer Content means the presentation files you submit to Kambin for review, including everything inside them: slide text, numbers, images, notes, embedded objects, formatting, metadata, and any suggested or applied fixes derived from them.

Account Data means information about you as a person or an organization: name, work email address, password (stored only as a one-way hash), optional multi-factor authentication secret, organization name, role, and account status.

Usage Records means records of how Kambin is used: when a review was run, how many slides it covered, how many usage credits it consumed, and counts of issues found by category.

Security Logs means records generated to keep accounts and the service secure: sign-in attempts and outcomes, password and MFA changes, administrative actions, IP address, and browser or client identifier.

Product Telemetry means content-free signals the add-in sends to help us improve detection quality: which issue types were shown, whether a suggested fix was accepted or rejected, timing of steps, and a one-way fingerprint of the file so repeat reviews of the same file can be recognized. Product Telemetry carries no slide text, no images, and no user identity.

Operational Logs means server and infrastructure logs used to run and troubleshoot the service. Kambin's logging rules prohibit writing Customer Content into these logs.

4Information we collect

We do not collect precise location, biometric data, government identifiers, payment card numbers (we do not currently process payments; if we introduce paid billing through a payment provider, this policy will be updated before that happens), or any category of sensitive personal information as defined by applicable law.

If your organization uses Kambin under a customer agreement, its administrators can see the Usage Records and account status of members of the organization, including name, email, and credits consumed. Administrators cannot see Customer Content, because Kambin does not store it.

5How we handle your presentation files (Customer Content)

This section describes exactly what happens to a file you submit, because it is the question we are asked most often.

Where it goes. When you click Analyze, the add-in sends the presentation over an encrypted connection (TLS) to Kambin's analysis service, which runs in Kambin's Microsoft Azure environment in the United States (Azure East US and East US 2 regions, both located in Virginia). The connection requires a valid signed-in session; no analysis endpoint accepts a file without authentication.

How it is processed. The analysis service reads the file in memory and in short-lived working files on the server's local disk that exist only for the duration of the review. When the review completes, or if it fails, the working files are deleted. Nothing derived from the file is written to a database, to backups, or to any file or object storage.

Your review session. While you are reviewing results, the service keeps the file and the proposed fixes in server memory so that previews and applied fixes can be produced without re-uploading. This review state is replaced when you start a new review and expires after 30 minutes of inactivity. If you use the slide preview feature, images of the affected slides are held for the same window and then removed. Expired material is unreadable immediately and physically removed by the next cleanup pass or service restart, whichever comes first.

AI processing. Kambin's detection combines deterministic rules with an AI language model. The model reads slide text to catch issues such as inconsistent terminology, capitalization, numbers that do not agree across slides, and messaging inconsistencies. For this step, the service sends the text of each slide, and short extracts of slide text needed for deck-wide consistency checks (numbers, names, and key messages), to a model deployment in Kambin's own Azure AI Foundry resource. It does not send slide images, the file itself, the file name, or your identity. The model deployment is Microsoft Azure OpenAI Service, operated inside Kambin's Azure subscription; Kambin's production configuration rejects any connection to the public OpenAI service. Under Microsoft's Azure OpenAI data terms, Microsoft does not use your prompts or outputs to train or improve any model, does not share them with OpenAI, and does not make them available to other customers. Kambin does not enable any Azure feature that stores prompts or outputs. Microsoft operates an automated abuse-monitoring safeguard that can hold content flagged by its classifiers for up to 30 days for review.

What we do not do with your files. We do not store them. We do not use them to train or fine-tune any model, ours or anyone else's. We do not use them for marketing, benchmarking, or product demonstrations. We do not share them with any third party other than Microsoft as described above. Our engineers do not view them in the normal course of operations, and Kambin has no mechanism to retrieve a file after a review session ends.

What can be derived from your file and kept. Only two things: (a) content-free Product Telemetry, described in Section 3, which includes a one-way fingerprint of the file's bytes but not the file, its name, or any text in it; and (b) Usage Records, which count slides and issues. Kambin is removing file names from Usage Records; from the effective date of this policy, any file name recorded is deleted within 30 days.

6How we use other information

We use Account Data, Usage Records, Security Logs, Product Telemetry, Operational Logs, and support communications to:

• Provide the service: create accounts, authenticate you, enforce your plan's usage limits, show you your review history, and answer your requests.
• Keep the service secure: detect and prevent unauthorized access, abuse, and fraud; rate-limit traffic; investigate incidents.
• Improve the product: measure detection accuracy using content-free telemetry; identify performance problems; prioritize fixes.
• Communicate with you: service notices, security alerts, onboarding and password emails, and responses to your inquiries. We do not send marketing email without your consent, and you can opt out of any non-essential email at any time.
• Meet legal obligations: keep records required by law, respond to lawful requests, and enforce our agreements.

We do not use personal information for automated decision-making that produces legal or similarly significant effects, and we do not profile users.

For people in the European Economic Area, the United Kingdom, or Switzerland, our legal bases are: performance of a contract (providing the service you or your organization signed up for), our legitimate interests (securing the service, preventing abuse, improving the product using content-free data, and running our business), legal obligation, and, where required, your consent. Where we rely on legitimate interests, we have concluded that those interests are not overridden by your rights, given that we collect minimal data, do not track you across services, and do not store Customer Content.

7How we share information

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We share personal information only as follows.

Service providers (subprocessors). Companies that process data on our behalf, under contracts that limit their use of the data to providing services to Kambin.

We will update this list before adding a subprocessor that will process Customer Content or Account Data. Enterprise customers can request notice of subprocessor changes in their agreement.

Your organization. If you use Kambin through an organization account, that organization's administrators can see your Account Data and Usage Records.

Legal and safety. We may disclose information if required by law, subpoena, or court order; to protect the rights, property, or safety of Kambin, our users, or others; or to enforce our agreements. Where lawful, we will notify the affected customer before disclosing their data in response to a legal request and will disclose only what is required.

Business transfers. If Kambin is involved in a merger, acquisition, financing, or sale of assets, personal information may be transferred as part of that transaction. We will require the recipient to honor this policy or give you notice and a choice.

With your direction. We share information when you ask us to.

8How long we keep information

We keep personal information only as long as needed for the purposes above, and then delete or anonymize it. The full schedule, including disposal mechanisms, is published in the Kambin Data Handling and Retention Policy. In summary:

We may keep information longer where required by law, to resolve disputes, or to enforce our agreements, and we may keep aggregated or de-identified information that cannot reasonably be linked to you.

9Security

Kambin is built for organizations whose presentations are confidential, and the service is designed so that the most sensitive data, your files, is never at rest with us. Our controls include:

• Encryption in transit (TLS 1.2 or higher) for every connection between the add-in, kambin.ai, our servers, and our subprocessors. Encryption at rest for all databases and backups using Azure-managed keys.
• Authentication required on every endpoint that accepts or returns Customer Content. Passwords hashed with bcrypt. Optional time-based one-time-password multi-factor authentication. Login rate limiting per IP address and per account.
• Secrets, including the credential for the AI model, held in Azure Key Vault and never in source code, images, or the add-in.
• A logging contract enforced in code and by automated tests: informational logs never contain slide text, file names, or email addresses in clear form; correlation uses short one-way hashes.
• Separation of production and testing environments, access to production limited to the founders, and deployment only from reviewed code on the main branch.
• Content-blind product telemetry and cost records, so that no analytics pipeline ever holds Customer Content.
• A documented data retention and disposal schedule, reviewed at every release that introduces a new data store and at least annually.

Kambin has begun a SOC 2 readiness program and intends to obtain a SOC 2 Type I report followed by a Type II report. No system is perfectly secure. If we become aware of a security breach that affects your personal information or Customer Content, we will notify affected customers without undue delay, and in any event within 72 hours of confirming the breach, with the information needed to assess the impact.

10Your rights and choices

You can exercise any of the following by emailing privacy@kambin.ai from the email address on your account, or through your organization's administrator. We will verify your identity, which for account holders usually means confirming control of the account email, and respond within 30 days. If a request is complex we may extend the deadline by up to 30 additional days and will tell you why.

• Access. Ask what personal information we hold about you and receive a copy.
• Correction. Update your name and email in your account settings, or ask us to correct inaccurate information.
• Deletion. Ask us to delete your account and personal information. We will delete Account Data, Usage Records, and Product Telemetry linked to you within 30 days, subject to the retention of Security Logs for 12 months and any legal holds. Customer Content requires no deletion request because it is never stored.
• Export. Receive your Account Data and Usage Records in a machine-readable format.
• Objection and restriction. Object to processing based on legitimate interests, or ask us to restrict processing while a dispute is resolved.
• Withdraw consent. Where processing is based on consent, withdraw it at any time without affecting prior processing.
• Opt out of email. Unsubscribe from any non-essential email via the link in the message or by contacting us. We will still send security and account notices.

We will not discriminate against you for exercising any of these rights.

If you use Kambin through your organization. Your organization is the controller of your Account Data and Usage Records, and Kambin processes them on its instructions. We will refer your request to your organization where its agreement with us requires that, and will help it respond.

11Additional information for California residents

Kambin does not sell personal information and does not share personal information for cross-context behavioral advertising, and has not done so in the preceding 12 months. We do not use or disclose sensitive personal information for purposes other than providing the service. In the preceding 12 months we have collected the categories of personal information listed in Section 4 (identifiers, professional information, internet or network activity limited to our own service, and customer records), from the sources and for the purposes described there, and disclosed them to the service providers in Section 7 for business purposes.

California residents have the right to know, delete, correct, and port their personal information, to opt out of sale or sharing (not applicable, as we do neither), to limit use of sensitive personal information (not applicable), and to non-discrimination. You may designate an authorized agent to make a request on your behalf; we will ask the agent for proof of authorization and may ask you to verify your identity directly. Contact privacy@kambin.ai.

12Additional information for the EEA, United Kingdom, and Switzerland

Roles. For Account Data and Usage Records of users who sign up directly, Kambin is the controller. For users provided access by an organization, that organization is the controller and Kambin is its processor under a data processing agreement, available on request. For Customer Content, Kambin is always a processor acting only on the user's instruction to analyze the file.

International transfers. Kambin is located in the United States and processes data there. Where personal information is transferred from the EEA, UK, or Switzerland, we rely on the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum, or Swiss adaptations, as applicable), supplemented by the safeguards described in Section 9, which are included in our data processing agreement. You can request a copy at privacy@kambin.ai.

Complaints. You have the right to lodge a complaint with your local supervisory authority. We would appreciate the chance to address your concern first.

Representative. Kambin has not appointed an EU or UK representative because it does not currently target users in those regions. We will update this policy if that changes.

13Cookies and local storage

kambin.ai sets only the cookies needed to sign you in and protect you from request forgery: a session token, a callback URL, and a CSRF token. They are marked HttpOnly and Secure and are not used for tracking. We do not use analytics, advertising, or social media cookies, and we do not respond differently to "Do Not Track" signals because we do not track.

The add-in stores a short-lived sign-in token and your display preferences in PowerPoint's local storage on your device so that you stay signed in and your settings persist. These values never contain Customer Content and are removed when you sign out or when the token expires.

14Changes to this policy

We will post any changes here with a new effective date and version number. For material changes that reduce your rights or expand how we use personal information, we will give account holders at least 30 days' notice by email or in-product notice before the change takes effect. Continued use after the effective date means you accept the updated policy.

15Contact us

KAMBIN, Inc.

Email: privacy@kambin.ai

General inquiries: hello@kambin.ai

Version history: 1.0, September 23, 2026, initial publication.