Privacy Notice

Prompting Academy is the data controller for the personal data we process through prompting.academy. This notice explains what we collect, why, and the rights you have.

• Account data — name, email address, login credentials — to create and secure your account (legal basis: contract performance).
• Content you create — prompts, documents, PRD projects, saved items — to provide the service and sync your workspace (legal basis: contract performance).
• Usage data — feature usage, generation counts, plan limits — to operate quotas, prevent abuse, and improve the product (legal basis: legitimate interests).
• Technical data — IP address (stored only as a one-way hash for guest rate limits), device and browser identifiers — for security and fraud prevention (legal basis: legitimate interests).
• Support messages — when you contact us, to respond and help you (legal basis: legitimate interests).

Payment data is collected and processed directly by Paddle as Merchant of Record when you make a purchase; we do not store your card details.

• Service providers — hosting, database, and infrastructure providers that run the service on our behalf.
• AI providers — your prompts and inputs are sent to AI model providers to generate outputs.
• Paddle (Merchant of Record) — for the sale of our products, subscription management, payments, tax compliance, and invoicing.
• Professional advisers — legal and accounting, where necessary.
• Authorities — where required by law.

We do not sell your personal data.

We keep personal data only as long as needed for the purposes above. When data is no longer needed, it is deleted or anonymised. Guest usage records (hashed IP + daily counters) are short-lived. Account data is kept while your account is active; you can request deletion at any time.

Depending on where you live, you have rights over your personal data, including: access, rectification, erasure, restriction of processing, data portability, objection to processing, and withdrawal of consent where processing is based on consent. You also have the right to complain to your local data protection authority. We respond to requests within one month. To exercise any right, contact us via the options on our About page.

We apply appropriate technical and organisational measures, including encryption in transit, hashed storage of sensitive identifiers, and access controls that limit who can see your data.

Our service providers may process data outside your country, including outside the UK/EEA. Where this happens, we rely on appropriate safeguards such as standard contractual clauses or adequacy decisions.

We use essential cookies and local storage to keep you signed in and remember preferences (like theme). We do not use marketing cookies. You can clear site data in your browser settings at any time; essential cookies are required for sign-in to work.