Privacy Policy

This Privacy Policy explains how Prompt Dock, Inc. (“Prompt Dock,” “we,” “us,” or “our”) collects, uses, discloses, and protects personal information when you use promptdock.ai and our related applications and services (collectively, the “Service”).

Prompt Dock is a global, web-based marketplace for AI prompts, offered as a software-as-a-service product with a free tier and paid monthly subscriptions. The Service is available worldwide, and this policy is written to address the major privacy frameworks that apply to our users, including the EU and UK General Data Protection Regulations, the Swiss Federal Act on Data Protection, the California Consumer Privacy Act (as amended by the CPRA), and comparable laws in other regions.

By using the Service, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with it, please do not use the Service.

The data controller responsible for your personal information is:

Prompt Dock, Inc.
Registered mailing address available on request — email [email protected]
Privacy contact: [email protected]

For users in the European Economic Area (EEA) and the United Kingdom, our representative under Article 27 GDPR / UK GDPR is: to be appointed; in the interim, EEA/UK users may contact us at [email protected]. Where appointed, our Data Protection Officer can be reached at: [email protected].

This policy applies to personal information we process about:

• Visitors to our website and marketing pages.
• Registered account holders on free and paid tiers.
• Creators who publish prompts, blogs, or challenge solutions and who may receive payouts.
• People who contact us or subscribe to our newsletter.

It does not apply to third-party websites or services that we link to but do not control. When we act as a processor on behalf of a creator (for example, in relation to content they publish), the creator may have their own responsibilities as a controller.

We collect the following categories of personal information.

Account and profile information. When you register, we collect your email address and, if you sign in with Google OAuth, the basic profile information Google shares with us (such as your name and email). You set a public profile that may include a display name, handle, avatar image, biography, an optional website link, and an optional “buy me a coffee” support link. If you create a password, we store it only in salted, hashed form via our authentication provider — we never see or store your password in plain text.

Your public creator profile. Once you publish at least one public prompt or blog post, we create a public creator page for you at /u/<your-handle>. It shows only information you have already made public — your display name, handle, avatar, biography, optional website and support links, and cards for your published prompts and posts. It never shows your email address, your plan, or any billing information. Because it is public, search engines may index it. You can turn it off at any timein Settings → Profile (“Show my public creator profile”); your page then returns “not found” and you stop appearing in creator search, while your published prompts and posts remain available on the marketplace.

Subscription and billing information. When you subscribe to a paid plan (Explorer, Premium Creator, or Master), payment is processed by Stripe. We do not receive or store your full payment card number. We store Stripe customer and subscription identifiers, your plan, billing status, renewal dates, and transaction history needed to manage your subscription.

Creator payout information. If you enroll to receive creator payouts, you complete identity verification (KYC) directly through Stripe Connect Express. Stripe collects and verifies your identity and financial details; we receive a Connect account identifier, payout status, and the amounts we owe and have paid, but not your underlying government-ID or bank details.

Content you create and submit. This includes prompts (free or premium), blog posts, “Prompt Challenges” you post or submit solutions to, ratings, and any other material you choose to publish or share.

AI playground inputs and outputs. When you use the AI playground, the prompt text and inputs you submit are sent to Anthropic for inference, and the model’s response is returned to you. See “AI playground and third-party AI processing” below.

Engagement and usage data. We collect data about how you use the Service, including prompts you reveal, view, favorite, or bookmark, ratings you give, playground runs, searches you perform, and notifications generated for you.

Device, log, and analytics data. We automatically collect technical information such as your IP address, browser type, device and operating-system information, referring pages, pages viewed, and approximate location inferred from your IP. We also collect product-observability and telemetry data (for example via Logfire / OpenTelemetry) to monitor performance, diagnose errors, and improve reliability.

Communications. If you email us, subscribe to our newsletter, or otherwise contact us, we keep a record of that correspondence and your contact preferences.

We use cookies and similar technologies for the following purposes:

• Strictly necessary cookies — to authenticate you, keep you signed in, and maintain session security. These are essential and cannot be switched off through the Service.
• Functional cookies — to remember preferences such as your settings and display choices.
• Analytics and performance — to understand how the Service is used (page views, searches, device/browser information) so we can improve it.

We do not use cookies for cross-context behavioral advertising. Where required by the ePrivacy Directive and GDPR (for example, for non-essential cookies for EEA/UK/Swiss users), we ask for your consent before setting such cookies, and you can withdraw consent at any time. You can also control cookies through your browser settings; disabling some cookies may affect how the Service works.

The AI playground lets you run prompt text against AI models. Runs are processed by Anthropic Claude models; where we make additional models available, your prompt is routed through the Vercel AI Gateway to the provider of the model you select. When you submit a prompt:

• The text and inputs you submit are transmitted to the relevant model provider (Anthropic for Claude models; otherwise, via the Vercel AI Gateway, to the provider of the model you select) to generate a response, which is returned to you and may be stored as part of your run history.
• These providers process this data as service providers. Under Anthropic’s commercial API terms, inputs and outputs are not used to train Anthropic’s models and are subject to limited retention for abuse-screening and operational purposes; other model providers process your inputs under their own terms.
• Do not submit sensitive personal information, confidential data, or anything you are not authorized to share in the playground.

AI outputs are generated automatically and may be inaccurate, incomplete, or unsuitable for your purposes. They are provided “as is” without warranty. You are responsible for reviewing and verifying any output before relying on it. See our Terms of Service for the full AI output disclaimer.

We use personal information to:

• Create and administer your account and authenticate you.
• Provide the Service, including revealing prompts, running the playground, hosting your content, and operating Prompt Challenges.
• Process subscriptions, payments, and creator payouts, and prevent payment fraud.
• Calculate creator revenue-pool allocations and process withdrawals.
• Send transactional emails (such as receipts, security and account notices, and notifications you have enabled).
• Send our newsletter, where you have opted in, with one-click unsubscribe in every issue.
• Maintain, secure, debug, and improve the Service, including analytics and observability.
• Detect, prevent, and respond to fraud, abuse, scraping, security incidents, and violations of our Terms.
• Comply with our legal obligations and enforce our agreements.

Where the GDPR, UK GDPR, or the Swiss FADP applies, we rely on the following legal bases:

• Performance of a contract — to create and operate your account, provide the Service you subscribe to, process payments and payouts, and deliver content and features you request.
• Consent — for our marketing newsletter, for non-essential cookies, and for any other processing where we ask for it. You may withdraw consent at any time without affecting prior processing.
• Legitimate interests — to secure and improve the Service, prevent fraud and abuse, understand usage through analytics, and communicate with you about your account. We balance these interests against your rights and you may object (see “Your privacy rights”).
• Legal obligation — to comply with tax, accounting, anti-money-laundering, and other legal requirements, and to respond to lawful requests.

We do not sell your personal information. We share it only as described here:

• Service providers (subprocessors). We share data with vendors who process it on our behalf under contract, listed in “Subprocessors and third parties” below.
• Public content. Your profile and any content you choose to publish (prompts, blogs, challenge solutions, ratings) are visible to other users and, where applicable, to the public. Do not include information you wish to keep private.
• Payment and payout providers. Stripe processes your payments and creator payouts as described above.
• Legal and safety. We may disclose information to comply with law, respond to lawful requests, enforce our Terms, or protect the rights, property, or safety of Prompt Dock, our users, or the public.
• Business transfers. If we are involved in a merger, acquisition, financing, or sale of assets, your information may be transferred as part of that transaction, subject to this policy.

We use the following third parties to operate the Service:

• Supabase — database, authentication, and file storage hosting.
• Stripe — payment processing and Stripe Connect Express creator payouts (including KYC identity verification).
• Anthropic — AI model inference on prompt content you submit to the playground.
• Resend — transactional and newsletter email delivery.
• Vercel — application hosting and content delivery (CDN).
• Logfire / OpenTelemetry — product observability and telemetry.
• Google — optional OAuth sign-in, if you choose to use it.

Each subprocessor is bound by data-protection obligations consistent with applicable law. We may update this list as our service providers change; you can request our current list of subprocessors at any time by emailing [email protected].

Prompt Dock operates globally, and your information may be processed in countries other than your own, including the United States. Some of these countries may not provide the same level of data protection as your home jurisdiction.

When we transfer personal information out of the EEA, the UK, or Switzerland, we rely on appropriate safeguards, including:

• The European Commission’s Standard Contractual Clauses (SCCs) and the UK International Data Transfer Addendum, supplemented by transfer-impact assessments where required following the Schrems II decision.
• Adequacy decisions, where the destination country is recognized as providing an adequate level of protection.

You can request more information about these safeguards by contacting [email protected].

We keep personal information only for as long as necessary for the purposes described in this policy, including to provide the Service, comply with legal obligations (such as tax and financial-record requirements), resolve disputes, and enforce our agreements.

• Account and profile data is retained while your account is active.
• After account deletion, we delete or anonymize your personal data within a reasonable period, except where retention is required by law (for example, transaction records for accounting and tax) or for legitimate business purposes such as fraud prevention.
• Public content you published may remain visible if it has been incorporated into others’ activity (for example, a winning challenge solution); you may request its removal as described below.
• Playground inputs and outputs are retained by Anthropic for a limited period under its commercial terms, and by us as part of your run history.

Depending on where you live, you may have some or all of the following rights regarding your personal information.

EEA / UK / Switzerland (GDPR, UK GDPR, FADP). You have the right to:

• Access the personal data we hold about you.
• Rectify inaccurate or incomplete data.
• Erase your data (“right to be forgotten”).
• Restrict processing in certain circumstances.
• Data portability — receive your data in a structured, machine-readable format.
• Object to processing based on legitimate interests or direct marketing.
• Withdraw consent at any time where processing is based on consent.
• Lodge a complaint with your local supervisory authority (and, for UK users, the Information Commissioner’s Office).

To exercise these rights, contact [email protected]. We will respond within the timeframes required by law (generally one month under the GDPR). We may need to verify your identity before acting on a request.

If you are a California resident, you have specific rights under the California Consumer Privacy Act, as amended by the CPRA.

Categories of personal information we collect. Over the past 12 months we have collected the categories described in “Information we collect,” which map to the statutory categories of: identifiers (e.g., name, handle, email, IP address); customer records and commercial information (e.g., subscription and transaction history); internet and network activity (e.g., usage, searches, engagement); geolocation data (approximate, from IP); audio/visual data (e.g., avatar images); and inferences drawn from the above.

Sources and disclosures. We collect this information from you directly, automatically through your use of the Service, and from third parties such as Google (OAuth) and Stripe. We disclose personal information to service providers and contractors for business purposes as described in “How we share your information.”

We do not sell or share your personal information for cross-context behavioral advertising. We have not sold or “shared” (as those terms are defined under the CCPA/CPRA) personal information, including that of consumers under 16, in the preceding 12 months.

Your California rights. You have the right to: know what personal information we collect and how we use and disclose it; request access to and a copy of that information; request correction of inaccurate information; request deletion of your personal information; and limit the use of sensitive personal information (we do not use sensitive personal information for purposes that trigger this right). You also have the right to non-discrimination for exercising your rights.

We honor Global Privacy Control (GPC) browser signals as a valid opt-out request where applicable.

“Shine the Light.” California residents may request information about disclosures of personal information to third parties for their direct-marketing purposes; we do not disclose personal information for such purposes.

To exercise these rights, contact [email protected]. You may use an authorized agent, and we will verify requests as required by law.

• Canada (PIPEDA). You may access and correct your personal information and challenge our handling of it; you may contact the Office of the Privacy Commissioner of Canada.
• Brazil (LGPD). You have rights of confirmation, access, correction, anonymization, portability, deletion, information about sharing, and to revoke consent.
• Australia (Privacy Act). You may access and correct your personal information and complain to the Office of the Australian Information Commissioner.

For any of these, contact [email protected].

The Service is not directed to children. You must be at least 16 years old to create an account and use the Service. Some paid features and contracts also require that you have reached the age of majority in your jurisdiction (or are at least 18 where required). Where a higher minimum age applies under local law (for example, certain GDPR Article 8 thresholds), that age applies.

We do not knowingly collect personal information from children under these ages, consistent with COPPA and GDPR Article 8. If you believe a child has provided us personal information, please contact [email protected] and we will take appropriate steps to delete it.

We use technical and organizational measures designed to protect your personal information, including encryption in transit, access controls, row-level security on our database, and reputable infrastructure providers. No system is perfectly secure, and we cannot guarantee absolute security. If we become aware of a data breach affecting your personal information, we will notify you and the relevant authorities as required by law.

We send transactional emails necessary to operate your account (such as receipts and security notices); you cannot opt out of these while you hold an account. Our newsletter is opt-in, and every issue includes a one-click unsubscribe link. You can also manage notification preferences in your account settings.

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last updated” date and, where appropriate, notify you by email or through the Service. Your continued use of the Service after the changes take effect constitutes acceptance of the updated policy.

For questions or to exercise your privacy rights:

• Privacy: [email protected]
• Legal: [email protected]
• Mail: Prompt Dock, Inc., Registered mailing address available on request — email [email protected]
• EEA/UK representative: to be appointed; in the interim, EEA/UK users may contact us at [email protected]
• Data Protection Officer: [email protected]