What We Process and Why
| Purpose | Personal data | Legal basis | Retention |
|---|---|---|---|
| Create and manage your account | Email address, password credentials managed by Supabase, account identifier, display name, profile picture, authentication provider, and account settings. | Performance of our contract with you. | While your account is active, then deleted when you delete your account, subject to limited legal or backup retention. |
| Provide Prompt Studio | Workspaces, prompts, prompt versions and drafts, agent settings, chats, AI inputs and outputs, collaboration records, model choices, and service preferences. | Performance of our contract with you. | While your account or relevant workspace is active, until you delete the content or account. |
| Connect and operate AI providers | Prompts, chat messages, instructions, model settings, related content sent to the AI provider you select, and optional OpenAI or Google Gemini API keys. | Performance of our contract with you. | Content is retained in Promptera as described above. Provider-side retention is governed by the selected provider and your agreement or settings with that provider. |
| Measure usage and enforce service limits | Model and provider used, token counts, request identifiers, timestamps, quota and subscription information, status, and limited error information. | Performance of our contract and our legitimate interest in operating and improving the service. | While your account is active, then deleted with your account unless needed for a legal claim. |
| Enable workspace collaboration | Name, email address, profile picture, workspace role, and temporary editor-presence information shared with authorized workspace members. | Performance of our contract with you. | Membership records are kept while you belong to the workspace; editor-presence information is temporary. |
| Secure and operate the service | IP address, request and device information, authentication events, and server or error logs. | Our legitimate interests in security, fraud prevention, troubleshooting, and service reliability. | Kept for a limited operational period, then deleted or overwritten, unless needed to investigate an incident or legal claim. |
| Respond to enquiries | Name, email address, subject, message, and subsequent correspondence you send us. | Taking steps at your request or our legitimate interest in responding to enquiries. | Retained only as long as needed to handle the enquiry and any related legal obligations. |
| Understand use of our public website and apps | Page URL, page title, interaction events, approximate location, device or browser information, and session recordings collected through Google Analytics for Firebase and Microsoft Clarity. | Your consent. | According to the configured analytics provider retention periods. |
| Meet legal obligations and protect rights | Information necessary to respond to lawful requests, enforce agreements, and establish or defend legal claims. | Legal obligation or our legitimate interests in protecting our rights. | For the period required by law or needed for the relevant claim. |
You must provide the data needed to create an account and operate requested features. Without it, we may be unable to provide those features. Optional profile information and personal API keys are not required.
Data From Other Sources
If you sign in or connect an account using Google or GitHub, we receive account information made available by that provider, such as your provider account identifier, email address, display name, profile picture, and connected-provider information. The information received depends on the provider and the permissions you approve.
AI Providers
When you use an AI-powered feature, Promptera sends the content needed to perform your request to the provider you select. The current supported providers are OpenAI and Google Gemini. This may include prompts, chats, agent instructions, and prompt-enhancement content.
You may optionally provide your own OpenAI or Google Gemini API key. Stored API keys are encrypted in Promptera's database and can be removed in your settings. The key is used to authenticate requests to the relevant provider.
Promptera does not use AI to make solely automated decisions about you that produce legal or similarly significant effects. Do not submit personal data or confidential information to an AI feature unless you are authorized to do so and it is necessary for your use of the service.
Cookies and Browser Storage
Prompt Studio uses browser local storage and session storage for necessary functions, including authentication sessions, OAuth security values, interface preferences, drafts, and navigation state.
Our public website and Prompt Studio use Google Analytics for Firebase and Microsoft Clarity to measure visits and interactions. These analytics providers may use cookies or similar identifiers and may receive page URLs, device or browser information, IP-derived approximate location, and event data (including session replays and heatmaps via Clarity). Analytics requires your consent. You can also block or delete cookies using your browser settings.
We also use Google reCAPTCHA to protect our contact forms from spam and abuse. Google reCAPTCHA sets strictly necessary security cookies and collects hardware and software information (such as device or browser data) to perform these security checks.
Who Receives Personal Data
We do not sell your personal data.
We disclose personal data only where needed to provide and operate the service, where you direct us to, or where required by law. Recipients include:
- OVHcloud, for hosting Prompt Studio and its database.
- Supabase, for account authentication, password recovery, and authentication emails.
- Google, for Google sign-in, Google Analytics for Firebase, Google reCAPTCHA, and Google Gemini when selected.
- Microsoft, for Microsoft Clarity analytics and session recordings.
- GitHub, when you choose GitHub sign-in or connect a GitHub account.
- OpenAI, when you select OpenAI-powered features.
- Authorized members of workspaces in which you collaborate.
- Professional advisers, public authorities, courts, or other parties where disclosure is legally required or necessary to protect rights.
Depending on the service, a provider may act as our processor or as an independent controller. Google, Microsoft, GitHub, OpenAI, and Supabase may process certain data as independent controllers when you use their accounts or services.
International Transfers
Some providers may process personal data outside the European Economic Area. Where GDPR rules on international transfers apply, transfers must be covered by a valid mechanism, such as an adequacy decision or the European Commission's Standard Contractual Clauses, together with supplementary measures where required. Contact info@promptera.io for information about the safeguards relevant to your data.
Security
We use technical and organizational measures designed to protect personal data, including access controls, encryption in transit, restricted production access, backups, and encryption of stored user-supplied API keys. No service can guarantee absolute security.
Your Rights
Subject to the conditions in applicable law, you may ask us to:
- provide access to your personal data;
- correct inaccurate personal data;
- delete your personal data;
- restrict processing;
- provide portable data;
- object to processing based on legitimate interests; or
- withdraw consent at any time, without affecting processing carried out before withdrawal.
You may object at any time to processing based on our legitimate interests. You may also object at any time to direct marketing, and we will stop using your data for that purpose.
Prompt Studio also provides settings to remove API keys, delete cloud data, and delete your account. To exercise your rights or withdraw consent, contact info@promptera.io. We may need to verify your identity before acting on a request.
You may lodge a complaint with the Hellenic Data Protection Authority, Kifissias 1-3, 115 23 Athens, Greece, using its complaint page. You may also contact another competent supervisory authority, particularly in the EU/EEA country where you live or work.
Children
Promptera is not directed to children under 16, and we do not knowingly collect their personal data. If you believe a child has provided personal data to us, contact info@promptera.io.
Changes
We may update this notice when our service or processing changes. We will publish the updated notice with a new effective date and provide additional notice where required.
Contact
For privacy questions or requests, email info@promptera.io.