Privacy Policy

This policy explains how Promptsanai (“we”, “us”) collects and processes personal data when you use promptsanai.com, in line with the EU General Data Protection Regulation (GDPR).

1. Data controller

Promptsanai is the data controller for the personal data described below. For any privacy question or to exercise your rights, contact us at ucdagsemanur@gmail.com.

2. What we collect

• Account data — email address and hashed password, created when you sign up. Handled by our authentication provider, Supabase.
• Waitlist / mailing-list data — email address and, if you provide it, marketing UTM parameters from the link you arrived on.
• Anonymous usage data — before you create an account, we track which free prompts you have already viewed using a browser cookie and a one-way SHA-256 hash of your IP address. We never store your raw IP address.
• Prompt library activity — which prompts you copy, to show popularity and enforce plan limits.
• AI Studio conversations — if you use AI Studio while signed in, the messages you send and the replies you receive are stored against your account so your conversation history is there when you come back. Anonymous (signed-out) AI Studio conversations are never stored — only a message count, to enforce the free-trial limit.

3. Why we process it (legal basis)

• Providing and securing your account — performance of a contract (Art. 6(1)(b)).
• The anonymous free-copy limiter — legitimate interest (Art. 6(1)(f)) in preventing abuse of the free tier; it is a soft, non-security limit and fails open on error.
• Waitlist emails and product updates — consent (Art. 6(1)(a)), given when you submit the form.

4. Who we share data with

We use the following processors, each bound by a data processing agreement: Supabase (database, authentication, hosting of your account and prompt data), Vercel (application hosting), and — only for messages you send through AI Studio — the AI provider currently powering it (OpenAI). The text you type into AI Studio, and the reply it generates, is sent to that provider to produce your answer; it is not used by them to train their models under our account terms. We do not sell personal data, and we do not run third-party advertising trackers on this site today.

5. International transfers

Our processors may store data outside the EEA. Where that happens, transfers are covered by Standard Contractual Clauses or an equivalent safeguard recognised under GDPR.

6. Retention

• Account data — kept while your account is active, deleted within 30 days of account deletion.
• AI Studio conversations — kept while your account is active, and deleted along with the rest of your account data when it is deleted. You can also request deletion of individual conversations at any time by emailing us.
• Anonymous IP hashes — kept for a rolling 30-day window, pruned automatically after 60 days.
• Waitlist emails — kept until you unsubscribe or ask us to delete them.

7. Your rights

Under the GDPR you have the right to:

• Access the personal data we hold about you (Art. 15)
• Correct inaccurate data (Art. 16)
• Request erasure (“right to be forgotten”) (Art. 17)
• Restrict or object to processing (Art. 18, 21)
• Receive your data in a portable format (Art. 20)
• Withdraw consent at any time, where processing is based on consent
• Lodge a complaint with your national data protection authority

To exercise any of these rights, email ucdagsemanur@gmail.com. We respond within one month, as required by the GDPR.

8. Cookies

See our Cookie Policy for a full breakdown of the cookies this site uses.

9. Changes to this policy

We may update this policy as the product evolves. Material changes will be reflected by updating the “Last updated” date above.