Privacy Notice

1. Who we are

Prompt Forge ("Prompt Forge", "we", "us") is operated by ACLL&R Holding OÜ, a private limited company. We act as the data controller for personal data processed through the Prompt Forge service (the "Service"). You can reach us at privacy@promptforge.app.

2. Personal data we collect

• Account data: email address, authentication identifiers, and login credentials.
• Content data: prompts, outcomes, tags, model outputs, and other content you submit to the Service.
• Usage & telemetry: feature interactions, request counts, quota usage, timestamps, and error logs.
• Device & connection data: IP address, browser and device identifiers, and general location derived from IP.
• Support data: messages you send us and metadata about those messages.
• Billing metadata: subscription status, plan, and renewal dates. Payment card and billing address data is collected and processed by Paddle (see Section 5); we do not receive or store your card details.

3. How we use your data

• Create and secure your account and authenticate your sessions.
• Provide the Service, including generating and storing prompts and running test outputs against LLM providers.
• Enforce plan limits, prevent abuse, and detect fraud or security incidents.
• Provide customer support and respond to your requests.
• Improve the Service, debug issues, and analyse aggregated usage patterns.
• Send service-related communications (e.g., account, security, billing notices).
• Comply with legal obligations.

4. Legal bases (GDPR)

• Performance of a contract — to provide the Service you've signed up for.
• Legitimate interests — securing the Service, preventing abuse, improving the product, and running the business.
• Legal obligation — tax, accounting, and responding to lawful requests.
• Consent — where required (e.g., certain cookies or marketing communications). You can withdraw consent at any time.

5. Sharing your data

We share personal data only with the following categories of recipients:

• Merchant of Record — Paddle.com Market Ltd, which handles checkout, subscription management, payments, tax compliance, invoicing, and refund processing on our behalf.
• Infrastructure & hosting providers that host the Service, our database, and our authentication and edge functions.
• LLM providers (e.g., OpenAI, Anthropic, Google) to the extent you send prompts through the Service to be executed against their APIs.
• Analytics and error-monitoring tooling used to keep the Service reliable.
• Professional advisers (legal, accounting, auditors) under confidentiality.
• Authorities where required by law, court order, or to protect our rights or the safety of others.

We do not sell your personal data.

6. International transfers

Some of our subprocessors are located outside the European Economic Area (EEA) and the UK. Where personal data is transferred internationally, we rely on adequacy decisions or Standard Contractual Clauses (SCCs) approved by the European Commission, together with supplementary measures where appropriate.

7. Data retention

We keep personal data only for as long as we need it for the purposes above. Account and content data are retained while your account is active and for a limited period afterwards to handle disputes, comply with legal obligations, and support account recovery. When no longer needed, data is deleted or anonymised. You can request deletion of your account at any time (see Section 8).

8. Your rights

Subject to applicable law, you have the right to:

• Access the personal data we hold about you.
• Request correction of inaccurate data.
• Request erasure of your data.
• Restrict or object to certain processing.
• Request portability of data you provided to us.
• Withdraw consent where processing is based on consent.
• Lodge a complaint with your local supervisory authority (in Estonia, the Data Protection Inspectorate — Andmekaitse Inspektsioon).

To exercise any of these rights, email privacy@promptforge.app. We aim to respond within one month.

9. Security

We use appropriate technical and organisational measures to protect personal data, including encryption in transit, access controls, and audit logging. No system is perfectly secure, and we cannot guarantee absolute security.

10. Cookies

We use strictly necessary cookies to keep you signed in and to operate the Service. If we introduce analytics or marketing cookies, we will present a cookie banner allowing you to manage your preferences.

11. Changes to this notice

We may update this notice from time to time. Material changes will be highlighted in the Service or by email. The "Last updated" date at the top always reflects the current version.

12. Contact

ACLL&R Holding OÜ · privacy@promptforge.app