Prezi

GDPR overview

Implementation is concrete rather than declarative. The privacy policy opens by stating that Prezi and Infogram built their data protection programme on both the EU GDPR and the UK GDPR. Prezi publishes a Data Processing Agreement with standard contractual clauses and a UK addendum, lists twenty authorised subprocessors with their country and purpose, and is certified under the EU-U.S. Data Privacy Framework, its UK Extension and the Swiss-U.S. Framework. Cross-border transfers rely on Commission-approved standard contractual clauses. A Data Protection Officer and a Data Protection Representative are reachable at privacy@prezi.com, though neither is named, so no Article 27 representative can be identified. Data subject rights are extended to all customers regardless of jurisdiction, and COPPA and FERPA compliance is claimed for school users.

Who owns the data?

You keep ownership of what you create. Prezi states plainly that it makes no claim of ownership to your User Content, but you grant it a licence whose reach depends on how the content is classified. Private User Content carries a worldwide, non-exclusive, sublicensable licence limited to running the service; it ends one year after you delete the content or close your account, although backup copies survive two years inside the EEA and indefinitely outside it. Public User Content carries a perpetual, transferable licence for any purpose, marketing included, and Prezi may use it to train its own algorithms and models. Content marked reusable may also reach third-party AI partners for their own commercial purposes.

Reuse rights

Output generated by the AI features can be used for any lawful purpose, entirely at your own risk. Prezi attaches four conditions: review every Output manually before you share, stream or publish it; attribute the content to yourself or your company; state clearly enough that no reader could miss it that the content was AI-generated; and never distribute material that breaches the terms. Prezi disclaims any warranty as to the accuracy, completeness, legality or reliability of what the model produces. In the other direction, you warrant that you hold every right needed for the files you upload, including documented consent from anyone pictured. Share links grant viewers a licence that outlives deletion by one year.

Data retention & training

Hosting summary

Hosting sits with two providers, both listed in the United States on Prezi's published subprocessor page: Amazon Web Services and Google. The security page describes a microservice architecture on AWS where services and databases are unreachable by default and every inbound rule must be added deliberately. Traffic is protected by TLS between client and server and between servers in different regions, and critical customer data created after February 2018 is encrypted at rest with AES-256, keys managed by the cloud provider. That provider is described as compliant with GDPR, HIPAA, GLBA and HITECH and certified under SOC, PCI, FedRAMP and ISO. Personal data is processed both inside and outside the United States, with Commission-approved standard contractual clauses and certification under the EU-U.S. Data Privacy Framework, its UK Extension and the Swiss-U.S. Framework covering the transfers. No named hosting region is offered — there is no EU residency option — although other subprocessors sit in the Netherlands, the United Kingdom and Malta.