Draft — not legally reviewed. Written as a starting point for a lawyer, not as a published policy. Every [[ … ]] below is a fact only PromptMaster's operator can supply, and the operator and support details are placeholders for this launch preview.

Privacy policy

Draft data handling information for the free launch.

Who is responsible

Operator: [[ legal entity name and address ]]. Privacy contact: [[ privacy contact email ]]. Workspace content and activity can also be subject to your organization’s policies. [[ controller and processor roles, legal bases and DPA ]] must be confirmed by the operator.

What the product stores

Your name, email, password hash, verification status and workspace roles, to operate your account.
Workflow instructions, questions, supplied answers, drafts and published versions, to store and deliver your content.
Invitations, membership changes, connector authorizations and activation records, including the member, workflow version and delivery time, to control access and show workspace activity.
Delivery identifiers and server logs for security and troubleshooting.
Optional verified domains, identity-provider configuration and linked issuer/subject identifiers when an admin enables SSO.

This free launch does not collect payment details through Mollie.

Who receives the data

Workspace admins can see members and workspace activity. Published company workflows are available to active workspace members. Private workflows are hidden from other active members, including admins. Workspace admins can recover and reassign an author’s workflows after that author is suspended or leaves. When you activate a workflow, your selected assistant receives its instructions and supplied answers. That assistant’s provider has its own data handling terms.

Deployment providers: [[ hosting and database provider, transactional email provider, optional error monitoring, regions and subprocessors ]]. International transfers: [[ applicable transfer arrangements ]].

Cookies and local storage

The app uses strictly necessary session cookies to keep you signed in and XSRF-TOKEN to protect form requests. The session cookie name depends on deployment configuration, with a default inactivity period of 120 minutes. Local storage remembers whether you hid the setup guide. The app does not include an analytics or advertising integration or load Google Fonts.

Retention and deletion

Account and workspace data remain while those records exist. Removal from a team revokes access and preserves historical activity. Account and workspace export and deletion controls are available in Account and Settings. [[ retention periods for activity, logs, deleted records and backups ]] remain to be supplied.

Your rights and requests

You may have rights to access, correct, erase, restrict or export your personal data, and to object to processing. Send requests to [[ privacy contact email ]], or to your organization where it controls the data. Supervisory authority: [[ competent authority and contact ]].

Security

Passwords are hashed. Workflow instructions are encrypted in storage and delivered through authenticated, workspace-scoped requests. Use HTTPS for a public deployment and keep account credentials and connector tokens confidential.