Gamma

GDPR overview

Implementation is concrete rather than declarative: Gamma never writes the words GDPR compliant, but the privacy policy carries a dedicated Notice to European Users covering the EEA and the UK, and names Gamma as the controller. An Article 27 representative is appointed for the EU, Data Protection Representative Limited trading as DataRep, gamma@datarep.com, Altmarkt 10 B/D, Dresden 01067, Germany, with a separate UK representative at 107-111 Fleet Street, London EC4A 2AB. The legal bases are listed: contractual necessity, legitimate interests, legal obligation and consent. A data processing addendum is published with standard contractual clauses and annexes, alongside a public subprocessor list you can subscribe to through legal@gamma.app. Privacy requests go to privacy@gamma.app. International transfers to the United States are acknowledged and SOC 2 Type II is claimed. No effective date is readable in the static policy.

Who owns the data?

Gamma's terms state plainly that Gamma does not claim ownership of Your Content (4.3). In exchange, clause 4.4 grants Gamma a fully paid, royalty-free, worldwide, non-exclusive and fully sublicensable licence to use that content to operate and provide the service, including support and debugging, and extends a licence to the collaborators you invite, who may use, modify and display it according to your account settings. Gamma owns the platform, its code and its themes (4.1), and any feedback you send carries a perpetual, irrevocable licence (4.6). Prompts, usage and metrics are analysed to improve the service (4.7). You hold no ownership right in the account itself (2.4), and Gamma acts as controller under the GDPR.

Reuse rights

Your creations leave Gamma without asking anyone: every project exports to PPT, PDF, PNG or Google Slides, and can be published as a hosted website, a social post or a shareable link. Paid plans map custom domains, up to ten on Pro and up to a hundred on Ultra, and remove the Made with Gamma badge from Plus upwards. Every project is private by default, and you decide whether to open it to your workspace, to named individuals or to the public. An existing piece can be reused internally as the starting point for a new one, and the API generates, exports to PDF or PPTX, archives and deletes programmatically. The limits are on behaviour rather than on reuse: clause 5 of the terms forbids infringing, unlawful, spam and scraping uses, and the Acceptable Use Policy is incorporated by reference.

Data retention & training

Hosting summary

No page names a hosting country in its own right; the picture comes from the public subprocessor list. Amazon Web Services for hosting and storage, Google for hosting, application logging and AI services, and Vercel for infrastructure are all listed in the United States, as are Snowflake for warehousing and ClickHouse for analytics. Cloudflare handles content distribution, security and DNS globally, and the domain resolves to 104.18.10.200, a Cloudflare anycast address geolocated in the United States. A few subprocessors sit elsewhere: Iframely in Canada, Leonardo in Australia, Boldr in the United States and the Philippines, Hire Horatio in the United States and the Dominican Republic, Philo Labs and Birdie in the EU. The jurisdiction is American. The terms state that the services are controlled and offered by Gamma from its facilities in the United States of America, and the privacy policy warns that personal information may be transferred to the United States or other locations where privacy laws may not be as protective. The published DPA carries standard contractual clauses for transfers out of the EU, and SOC 2 Type II is claimed. No EU data residency option is published.