Privacy Policy

⚠️ AI-generated draft — must be reviewed by a lawyer before publishing. This document was drafted by an AI assistant as a starting point only. It is not legal advice, may not fully comply with GDPR, CCPA/CPRA, or other applicable privacy laws, and must be reviewed and approved by a qualified lawyer (and, if needed, a privacy specialist) before publication.

Effective date: [Effective date]

Last updated: [Effective date]

[Company legal name] ("Prompt Bank," "we," "us," or "our") respects your privacy. This Privacy Policy explains what personal data we collect when you use the Prompt Bank website and services (the "Service"), how we use it, who we share it with, and the choices and rights available to you.

By using the Service, you acknowledge the practices described in this Privacy Policy. If you do not agree, please do not use the Service.

1. Who We Are

[Company legal name] is the data controller responsible for your personal data in connection with the Service. We are based in/organized under the laws of [Jurisdiction]. You can reach us at [contact email] or [address] with any privacy questions.

2. What Information We Collect

2.1 Information you provide directly

• Account information: email address, password (stored in hashed/encrypted form), and any display name you choose to set.
• Communications: messages you send us, such as support requests, content-removal requests, or feedback (which may include your name, email, and message content).
• Payment-related information: we do not directly collect or store your full payment card details. Billing and payment information is collected and processed by Lemon Squeezy as merchant of record (see Section 4). We may receive limited transaction metadata from Lemon Squeezy, such as subscription status, plan tier, and billing history, in order to manage your account.

2.2 Information we collect automatically

• Usage and activity data: the prompts you view, search, favorite, and copy; copy-quota usage (e.g., how many copies you have used in a given period); pages visited; features used; timestamps; and general interaction data.
• Device and log data: IP address, browser type, operating system, device identifiers, referring URLs, and similar technical information.
• Cookies and similar technologies: used for authentication (keeping you logged in), remembering preferences, and analytics. See our Cookie Notice for details and your choices.
• Analytics data: aggregated and/or pseudonymized usage statistics collected via our analytics provider(s) (see Section 4) to help us understand how the Service is used and to improve it.

2.3 Information we do not intentionally collect

We do not intentionally collect sensitive categories of personal data (such as health, biometric, or precise geolocation data) and ask that you not submit such information to us, including in support messages.

3. How We Use Your Information

We use the information described above to:

1. Create and maintain your account, and authenticate you when you log in.
2. Provide the Service, including enforcing free-tier and paid-tier copy quotas (Section 4 of our Terms of Service) and displaying your favorites/history.
3. Process subscription purchases, renewals, and cancellations (in conjunction with Lemon Squeezy as merchant of record).
4. Communicate with you — for example, account notices, security alerts, billing notices, responses to support or removal requests, and (where you have opted in, or as otherwise permitted by law) product updates and marketing.
5. Monitor, secure, and improve the Service, including detecting and preventing scraping, abuse, fraud, and violations of our Terms of Service.
6. Analyze aggregate usage trends to improve features, content curation, and performance.
7. Comply with legal obligations and enforce our Terms of Service.

4. Who We Share Information With

We do not sell your personal data. We share personal data only in the following circumstances:

• Lemon Squeezy (payment processor / merchant of record). When you subscribe to a paid plan, your billing and payment information is handled directly by Lemon Squeezy, which acts as the merchant of record for all transactions. Lemon Squeezy processes this data under its own privacy policy: [Lemon Squeezy Privacy Policy link — placeholder].
• Analytics providers. We use third-party analytics tools (e.g., [Google Analytics / Plausible / PostHog — placeholder, specify actual provider(s)]) to understand usage patterns. These providers may process technical and usage data on our behalf, subject to their own privacy terms.
• Hosting and infrastructure providers. We use third-party cloud hosting, storage, database, and email-delivery providers (e.g., [hosting provider — placeholder], [email provider — placeholder]) to operate the Service. These providers process data solely to provide services to us.
• Legal and safety. We may disclose information if required by law, legal process, or governmental request, or where we believe disclosure is necessary to protect the rights, property, or safety of Prompt Bank, our users, or the public, including in connection with content-removal or intellectual-property disputes.
• Business transfers. If we are involved in a merger, acquisition, financing, or sale of assets, personal data may be transferred as part of that transaction, subject to standard confidentiality protections.
• With your consent. We may share information for other purposes with your consent.

5. International Data Transfers

We are a global service and may process and store your data in countries other than the one in which you reside, including [Jurisdiction] and countries where our hosting, analytics, and payment providers operate. Where required by law (for example, under GDPR), we rely on appropriate safeguards for such transfers, such as standard contractual clauses or equivalent mechanisms. [Placeholder — confirm specific transfer mechanism with counsel based on hosting/vendor locations.]

6. Cookies

We use cookies and similar technologies for authentication, preferences, and analytics. Details on the categories of cookies we use, their purposes, and how to manage your preferences are set out in our Cookie Notice.

7. Data Retention

We retain personal data for as long as your account is active and as needed to provide the Service. Generally:

• Account data is retained until you delete your account, plus a limited period afterward to comply with legal, tax, or security obligations.
• Usage/copy-activity data is retained for as long as needed to enforce quotas and for a limited period afterward for analytics and abuse-prevention purposes, typically no longer than [12–24 months — placeholder].
• Billing records held by Lemon Squeezy are retained according to Lemon Squeezy's own retention practices and applicable tax/accounting laws.

We may retain limited data beyond these periods where necessary to comply with legal obligations, resolve disputes, or enforce our agreements.

8. Your Rights and Choices

Depending on your location, you may have some or all of the following rights regarding your personal data:

• Access — request a copy of the personal data we hold about you.
• Correction — request that we correct inaccurate or incomplete data.
• Deletion — request that we delete your personal data (subject to certain legal exceptions).
• Portability — request a copy of your data in a portable, machine-readable format.
• Objection / restriction — object to or request that we restrict certain processing, including analytics or marketing.
• Withdraw consent — where processing is based on consent (e.g., marketing emails, certain cookies), withdraw that consent at any time.
• Non-discrimination — (California residents) we will not discriminate against you for exercising your privacy rights.

How to exercise your rights: Contact us at [contact email]. We will respond within the timeframe required by applicable law (e.g., 30 days under GDPR, 45 days under CCPA/CPRA). We may need to verify your identity before fulfilling certain requests.

Region-specific notices:

• EEA/UK (GDPR): [Placeholder — confirm legal basis for each processing purpose (contract, legitimate interest, consent, legal obligation); identify EU/UK representative if required; confirm supervisory authority for complaints.]
• California (CCPA/CPRA): [Placeholder — confirm categories of personal information collected/disclosed in the prior 12 months per CCPA-required format; confirm we do not "sell" or "share" personal information as those terms are defined, or update this policy and add an opt-out mechanism if we do.]
• Other jurisdictions: [Placeholder — add notices for other applicable regimes, e.g., Taiwan PDPA, PIPEDA, LGPD, as relevant to target markets and company location.]

9. Children's Privacy

The Service is not directed to children under the age of [13/16 — align with Terms of Service and applicable law]. We do not knowingly collect personal data from children under that age. If we learn we have inadvertently collected such data, we will delete it. If you believe a child has provided us personal data, contact us at [contact email].

10. Security

We implement reasonable technical and organizational measures designed to protect your personal data, including encryption in transit, access controls, and secure storage of passwords. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security.

11. Third-Party Links and Sourced Content

The Service displays creator names/handles associated with publicly sourced prompts and example media (see our DMCA & Content Removal Policy). We do not collect personal data about these creators beyond what they have already made publicly available, and we do not control the privacy practices of the third-party platforms on which such content was originally posted.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will provide reasonable notice (for example, by email or an in-product notice) before the changes take effect. The "Last updated" date at the top of this page reflects the most recent revision.

13. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact:

[Company legal name] [address] [contact email]

[Placeholder — if a Data Protection Officer or EU/UK representative is appointed, list contact details here.]

This Privacy Policy is a template draft and does not constitute legal advice. It must be reviewed by a qualified attorney familiar with applicable privacy laws (including GDPR, CCPA/CPRA, and any laws applicable in [Jurisdiction]) before publication.