Privacy policy

PromptMarket is run by its operator ("we"), who is the controller of the personal data described on this page. For anything about your data, email maksim344551@gmail.com.

• No accounts, no sign-up, no newsletter.
• No cookies, no analytics, no advertising or tracking scripts, and nothing stored in your browser’s local storage.
• Fonts are bundled with the site and served from our own domain, so loading a page contacts no font provider.
• We only process personal data when you leave a review, when your browser requests pages from our host, when an error report is sent (if enabled), when you buy through Gumroad, or when you email us.

When you submit a review we store the name you enter, the optional role and plan (Solo or Team) you select, your star rating, your review text, the product it is about and the time of submission. Every review is checked by hand before it appears; once approved, your name, role, plan, rating, text and date are shown publicly on the product page, together with any reply from us. Use a nickname if you prefer.

Legal basis: your consent, given by submitting the review (Art. 6(1)(a) GDPR). You can withdraw it at any time by emailing us, and we will remove the review. Retention: published reviews stay until you ask us to remove them or the product is taken down; reviews waiting for moderation are kept until they are moderated; rejected reviews are deleted automatically 30 days after submission.

To limit how many reviews can be sent from one connection, the review system records the IP address of each submission (for IPv6, only the network part) together with the hour it was sent. It is used for nothing else, is never published, and is deleted automatically within 24 hours. Legal basis: our legitimate interest in keeping the review system free of spam and abuse (Art. 6(1)(f) GDPR).

The site is served by statichost.eu, a static hosting provider in the EU. Like any web server, it receives your IP address and standard request data (page requested, time, browser user agent, referring page) in order to deliver pages, and may keep them in access logs for a limited period for security and operation. Legal basis: our legitimate interest in running a secure website (Art. 6(1)(f) GDPR).

If error monitoring is enabled, errors on the site are reported to Sentry (Functional Software, Inc.): the error message and stack trace, the page URL, your browser and operating system version, and a short trail of preceding technical events (such as page navigation and button clicks, never what you type). Sentry also receives a minimal session signal when a page opens, used to count crash-free visits. Sentry necessarily receives the IP address of the connection that sends this data; our setup does not attach names, review text or other personal details. Legal basis: our legitimate interest in finding and fixing bugs (Art. 6(1)(f) GDPR).

Checkout and payment are handled by Gumroad, which sells the packs as merchant of record and processes your payment and contact details under its own privacy policy as a separate controller. We never see your card details. Gumroad shares with us, as the seller, the order details it gives every seller, such as your email address, name, country and what you bought; we use them only to deliver, support and account for your purchase (Art. 6(1)(b) and 6(1)(c) GDPR) and keep them as long as tax and accounting law requires.

If you email us, we use your address and message to reply (Art. 6(1)(b) or 6(1)(f) GDPR). Our mailbox is hosted by Google (Gmail). We keep correspondence for as long as needed to handle your request and any follow-up.

If weekly backups are enabled, reviews are backed up once a week to a private storage area of our code repository on GitHub, so they can be restored after a failure. Each backup is deleted automatically after 35 days. Spam-protection IP addresses are never included.

• Supabase (database for reviews and spam protection), hosted in the EU (Frankfurt, Germany), acting as our processor.
• statichost.eu (website hosting, EU).
• Sentry (error reports), only if error monitoring is enabled.
• GitHub (weekly review backups), only if backups are enabled.
• Google (email).
• Gumroad (checkout, as an independent controller).

Some of these companies are based in the United States or may access data from there. Where personal data leaves the EU/EEA, the transfer relies on the safeguards of Chapter V GDPR that the provider offers, such as the EU–US Data Privacy Framework or the European Commission’s Standard Contractual Clauses. We do not sell personal data or use it for advertising or automated decision-making.

You can ask us for access to your personal data, and to correct, delete or restrict it, to receive it in a portable format, and to object to processing based on legitimate interest (Art. 15–21 GDPR). Where processing relies on consent, you can withdraw it at any time without affecting what happened before. Email maksim344551@gmail.com; we reply within one month. You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU country where you live or work.

If we add new tools that process personal data (for example analytics or a newsletter), we will update this page before they go live, and change the date at the top.