Privacy Notice

1. Who we are

PromptAura ("PromptAura", "we", "us", "our") operates the PromptAura website and services. PromptAura is the data controller for the personal data described in this notice. You can reach us at rotdot64@gmail.com.

2. Data we collect

• Account data: name, email address, authentication identifiers (including Google sign-in ID where used), and password hashes.
• Profile & usage data: preferences, language, trial and unlock status, prompts you create, projects, courses, certificates, and progress.
• Content you submit: prompts, uploaded images, feedback and reviews, support messages.
• Technical data: IP address, device and browser type, log data, approximate location derived from IP, and cookie identifiers.
• Payment metadata: subscription and purchase status, transaction IDs, plan identifiers. Full payment card details are collected by Paddle, not by us.

3. How we use your data

• To create and manage your account and provide the Service.
• To generate AI outputs from your prompts and store your projects.
• To process purchases, unlocks, and subscriptions.
• To respond to support requests and feedback.
• To secure the Service, prevent fraud and abuse, and comply with law.
• To improve product features and understand aggregate usage.
• To send transactional emails; marketing emails only where permitted.

4. Legal basis (EEA/UK users)

• Contract: to provide the Service you have purchased or signed up for.
• Legitimate interests: service security, fraud prevention, product improvement.
• Consent: for optional cookies and marketing communications.
• Legal obligation: tax, accounting, and response to lawful requests.

5. Who we share data with

• Paddle.com — our Merchant of Record. Paddle processes payments, subscription management, tax compliance, invoicing, and refunds. See Paddle's Privacy Notice.
• Hosting & database providers that store data on our behalf under contract.
• AI model providers that process prompts to generate outputs.
• Email & support tooling used to communicate with you.
• Professional advisers (legal, accounting) where necessary.
• Authorities where required by law or to protect rights and safety.

We do not sell your personal data.

6. International transfers

Your data may be processed in countries outside your own, including the United States. Where required, we rely on appropriate safeguards such as the Standard Contractual Clauses or an adequacy decision.

7. Retention

We keep account and usage data while your account is active and for a reasonable period afterwards (typically up to 24 months) to comply with legal, tax, and dispute-resolution obligations. Transaction records are retained for the period required by applicable tax law. Data that is no longer needed is deleted or anonymised.

8. Your rights

Depending on where you live you may have the right to:

• access, correct, or delete the personal data we hold about you;
• restrict or object to certain processing;
• port your data to another provider;
• withdraw consent where processing is based on consent;
• lodge a complaint with your local data protection authority.

To exercise these rights email rotdot64@gmail.com. We will respond within one month.

9. Security

We use appropriate technical and organisational measures including encryption in transit, row-level security on our database, access controls, and periodic reviews. No system is 100% secure; please use a strong, unique password.

10. Cookies

We use essential cookies for authentication and session management, and limited analytics cookies to understand usage. You can manage cookies through your browser settings.

11. Changes

We may update this notice from time to time. Material changes will be communicated via the Service or by email.