Legal
Privacy Policy
Effective date: 24 May 2026
1. Introduction
Promptora ("we", "us", or "our") operates the website located at https://www.promptora.shop (the "Platform"). This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you access or use our Platform, create an account, make a purchase, or sell digital goods through our marketplace.
By accessing or using the Platform you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy. If you do not agree, please discontinue use immediately.
This Policy complies with the UK General Data Protection Regulation (UK GDPR), the EU General Data Protection Regulation (EU GDPR 2016/679), the California Consumer Privacy Act (CCPA/CPRA), and other applicable data protection legislation.
2. Data Controller
For the purposes of UK and EU data protection law, Promptora is the data controller of your personal data. Our designated point of contact for privacy matters is reachable at legal@promptora.shop.
3. Information We Collect
3.1 Information You Provide Directly
- Account data: email address, username, password (hashed), profile biography, social media URLs, and avatar configuration when you register or update your profile.
- Payment data: when you make a purchase or register as a seller, payment processing is handled by Stripe, Inc. We do not store full card numbers, CVV codes, or bank account details on our servers. We receive and store a Stripe customer ID, Stripe Connect account ID (for sellers), and transaction metadata such as amount, currency, and timestamp.
- Content data: prompt files, workflow files, agent instruction sets, and associated metadata (titles, summaries, tags, SHA-256 hashes) that you upload for sale. Uploaded receipt content is encrypted at rest using AES-256 encryption before storage.
- Outcome media: screenshots and images you upload to illustrate the outcome of your listed receipts, and URLs you provide for video or website demonstrations.
- Communications: any messages, support requests, or correspondence you send to us.
3.2 Information Collected Automatically
- Log data: IP address, browser type and version, operating system, referring URL, pages visited, time and date of access, and clickstream data.
- Device data: device identifiers, hardware model, and network information.
- Cookies and local storage: we use browser localStorage to persist UI preferences (e.g. theme, A/B test variant). We do not currently deploy third-party advertising cookies. See Section 9 for full cookie details.
- Usage analytics: feature interactions, search queries, pages viewed, and conversion events to understand how users engage with the Platform.
3.3 Information from Third Parties
- OAuth providers: if you sign in via Google or X (Twitter), we receive your email address, name, and profile picture URL from those providers. We do not receive your passwords from these services.
- Referral data: if you arrive via a referral link, we record the referral code to attribute the introduction to the referring seller.
4. How We Use Your Information
We process your personal data for the following purposes and legal bases:
| Purpose | Legal Basis |
|---|---|
| Providing and operating the Platform | Performance of contract (Art. 6(1)(b) UK/EU GDPR) |
| Processing purchases and seller payouts | Performance of contract |
| AI-powered metadata generation (via Anthropic API) | Performance of contract; legitimate interests |
| Verifying identity and preventing fraud | Legitimate interests; legal obligation |
| Sending transactional emails (e.g. purchase confirmations) | Performance of contract |
| Responding to support requests | Legitimate interests |
| Improving and personalising the Platform | Legitimate interests |
| Complying with legal and regulatory obligations | Legal obligation (Art. 6(1)(c)) |
| Enforcing our Terms of Service | Legitimate interests |
5. Sharing and Disclosure of Your Information
We do not sell your personal data. We may share your information in the following limited circumstances:
5.1 Service Providers
We share data with carefully selected third-party processors who act on our instructions:
- Supabase, Inc. — database hosting, authentication, and file storage (US; EU Standard Contractual Clauses in place).
- Stripe, Inc. — payment processing and seller payouts (US; SCCs in place; PCI-DSS Level 1 certified).
- Anthropic, PBC — AI-powered analysis of uploaded content to generate metadata. Content is transmitted to Anthropic's API over TLS and is subject to Anthropic's data processing terms.
- Vercel, Inc. — web hosting and serverless functions (US; SCCs in place).
- Google LLC / X Corp — OAuth authentication only.
5.2 Public Profile Information
Your username, avatar, and bio are publicly visible to all users of the Platform. Receipts you list are publicly visible to authenticated users.
5.3 Legal Requirements
We may disclose your information if required by law, subpoena, court order, or government authority, or if we believe in good faith that such disclosure is necessary to protect our rights, prevent fraud, or ensure the safety of any person.
5.4 Business Transfers
In the event of a merger, acquisition, asset sale, or insolvency proceeding, your personal data may be transferred to a successor entity. We will provide notice before your data is transferred and becomes subject to a different privacy policy.
6. International Data Transfers
Promptora operates primarily from the United Kingdom. Our service providers are located in the United States. Where we transfer personal data outside the UK or EEA, we ensure appropriate safeguards are in place, including UK International Data Transfer Agreements (IDTAs), EU Standard Contractual Clauses (SCCs), or transfers to countries with an adequacy decision.
7. Data Retention
We retain your personal data only for as long as necessary for the purposes set out in this Policy or as required by law:
- Account data: retained for the duration of your account and for 7 years after closure for legal and tax compliance purposes.
- Transaction records: retained for 7 years to satisfy HMRC / IRS tax retention requirements.
- Uploaded content: retained while your listing is active and for 90 days after deletion to allow dispute resolution.
- Log data: retained for 90 days.
- Waitlist data: retained until the waitlist is closed or you request deletion, whichever is earlier.
8. Your Rights
Depending on your jurisdiction, you have the following rights regarding your personal data:
8.1 UK/EU Rights (UK GDPR / EU GDPR)
- Right of access: request a copy of the personal data we hold about you.
- Right to rectification: request correction of inaccurate or incomplete data.
- Right to erasure: request deletion of your data where there is no compelling reason for continued processing.
- Right to restriction: request that we restrict processing of your data in certain circumstances.
- Right to data portability: receive your data in a structured, machine-readable format.
- Right to object: object to processing based on legitimate interests.
- Rights related to automated decision-making: we do not make solely automated decisions that produce legal or similarly significant effects.
To exercise these rights, contact us at legal@promptora.shop. We will respond within 30 days. You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk or your local supervisory authority.
8.2 California Rights (CCPA/CPRA)
California residents have the right to know what personal information is collected, the right to delete, the right to opt-out of the sale of personal information (we do not sell personal information), the right to non-discrimination for exercising these rights, and the right to correct inaccurate personal information. Submit requests to legal@promptora.shop.
9. Cookies and Tracking Technologies
We use the following storage mechanisms:
- Authentication cookies: set by Supabase to maintain your login session. Strictly necessary.
- Preference storage (localStorage): stores your theme preference and A/B test variant. No personal data is stored.
We do not currently use advertising cookies or cross-site tracking. If this changes, we will update this Policy and seek appropriate consent.
10. Security
We implement industry-standard technical and organisational measures to protect your personal data, including TLS encryption in transit, AES-256 encryption for stored prompt content, hashed passwords, row-level security on our database, and restricted access to production systems. However, no method of transmission or storage is 100% secure. In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify you and the relevant supervisory authority within 72 hours as required by UK/EU GDPR.
11. Children's Privacy
The Platform is not directed to individuals under the age of 16 (or 13 in jurisdictions that permit it). We do not knowingly collect personal data from children. If you become aware that a child has provided us with personal data without parental consent, please contact us at legal@promptora.shop and we will take steps to delete such information.
12. Third-Party Links
The Platform may contain links to third-party websites or services. We are not responsible for the privacy practices of those third parties and encourage you to review their privacy policies independently.
13. Changes to This Policy
We reserve the right to update this Privacy Policy at any time. When we make material changes, we will update the effective date at the top of this page and, where appropriate, notify you by email or a prominent notice on the Platform. Your continued use of the Platform after any changes constitutes acceptance of the updated Policy.
14. Contact Us
For any questions, concerns, or requests relating to this Privacy Policy, please contact: