Privacy Policy | PromptDeck

Last updated: 17 October 2026

1. Data controller

The controller is Prompt Deck, 12 rue des lois, Toulouse, France, publisher: Jean Baptiste Grossetti. To contact us about your data, use the contact form.

2. Data we collect

• Account data: your email address and basic profile information provided through Google sign-in, your plan and your credit balance.
• Run data: the original idea you submit, your interview answers as needed to generate the prompt, and timestamps of runs.
• Payment data: handled by Stripe. We receive subscription status and limited billing information, not your full card number.
• Session history: stored locally in your browser; it is not sent to our database as session history.
• Technical and usage data: limited data from privacy-friendly site analytics and security logs, such as pages visited and approximate technical information.
• Preferences: theme and cookie consent choices stored in your browser (see the cookie policy).
• Communications: what you send through the contact form.

3. Purposes and legal bases

Purpose	Legal basis (GDPR)
Create and manage your account, sign you in	Performance of a contract (Art. 6(1)(b))
Generate prompts and manage credits	Performance of a contract
Process payments and subscriptions	Performance of a contract; legal obligation (accounting)
Secure the Service and prevent abuse	Legitimate interests (Art. 6(1)(f))
Understand site usage with privacy-friendly analytics	Legitimate interests
Respond to your requests	Legitimate interests; contract
Comply with legal obligations	Legal obligation (Art. 6(1)(c))
Storing non-essential preferences where applicable	Consent (Art. 6(1)(a))

We do not sell your personal data.

4. Recipients and processors

We use the following providers to operate the Service:

• Lovable / Supabase, Inc.: application hosting, database and authentication infrastructure (Lovable Cloud).
• Cloudflare, Inc.: network, security and content delivery.
• Stripe: payment processing and subscription management.
• Google: sign-in (authentication) when you choose to log in with your Google account.
• OpenRouter and the model providers it routes to: AI processing. The text of your idea and answers is sent to models to generate your prompt. Do not include confidential or sensitive personal information you do not wish to share with these providers.

We may also disclose data where required by law or to protect our rights. Where providers act as processors, GDPR requires appropriate processing agreements. Google, Stripe and model providers may also act as independent controllers for some processing; their applicable policies govern that processing.

5. Retention

• Account data: for as long as your account is active, then deleted or anonymised within a reasonable period after closure, except where we must keep it by law.
• Run data: kept while your account is active so you can access your history, and deleted when you ask or when the account is deleted.
• Billing records: kept for the period required by French accounting and tax law (generally up to 10 years).
• Contact messages: kept as long as needed to handle your request, and typically no longer than 3 years after the last exchange.
• Browser storage: remains until you clear it.

6. International transfers

Our infrastructure and providers operate in the European Union and the United States. When personal data is transferred outside the European Economic Area, transfers require a valid GDPR mechanism, such as the EU-US Data Privacy Framework where the recipient is certified, or the European Commission's Standard Contractual Clauses (SCCs), together with supplementary measures where appropriate. The mechanism must be verified for the particular recipient; this policy does not assert that every listed provider is certified. You can request information about these safeguards through the contact form.

7. Your rights

Under GDPR you have the right to access, rectify, erase, restrict or object to processing of your data, to data portability, and to withdraw consent at any time where processing is based on consent. You may also give instructions about the fate of your data after death under French law. To exercise your rights, use the contact form. We may need to verify your identity, and will answer within one month.

8. Complaints

If you believe your rights are not respected, you may lodge a complaint with the French data protection authority, the CNIL (cnil.fr), or with the authority in your country of residence.

9. Security

We use technical and organisational measures such as encrypted connections, access controls and scoped authentication for the connector. No system is perfectly secure, and we encourage you to avoid submitting highly sensitive data.

10. Children

The Service is not intended for children under 16, and we do not knowingly collect their data.

11. Changes

We may update this policy and will change the date above. For material changes we will inform you appropriately.

12. Contact

Use the contact form. See also the terms of service and legal notice.