SitePromptLabLegal
Privacy Policy
Last updated: October 25, 2026
Who we are
SitePromptLab operates this website and is the data controller for the personal data described in this notice: we decide why and how it is processed.
Data we collect
Account data (email address, display name, encrypted login credentials or Google sign-in identifier); membership data (plan, status and renewal dates received from our payment provider); usage data (saved prompts, recently viewed prompts, and design descriptions you enter into Find My Prompt); and technical data (IP address, browser and device information, and logs). We never receive or store your full card details.
Why we use it and legal basis
To create your account and provide the library and your membership (performance of a contract); to keep the service secure and prevent fraud and abuse (legitimate interests); to improve the service and fix problems (legitimate interests); to answer support requests (contract and legitimate interests); and to meet tax, accounting and legal obligations (legal obligation). We send marketing only with your consent, which you can withdraw at any time.
Who we share it with
Service providers that host and run the platform, including database, authentication and AI recommendation providers, acting on our instructions; Paddle.com, our Merchant of Record, which handles the sale of memberships, subscription management, payments, tax compliance and invoicing; professional advisers such as lawyers and accountants; and authorities where required by law. We do not sell your personal data.
International transfers
Our providers may process data outside your country. Where required, we rely on appropriate safeguards such as standard contractual clauses.
How long we keep it
We keep account and usage data while your account is active and delete or anonymise it within 90 days after you delete your account. Membership and transaction records are kept as long as required for tax and accounting law (typically up to 7 years). Technical logs are kept for a limited period, usually no longer than 30 days.
Your rights
Depending on where you live, you may have the right to access, correct, delete, restrict or object to processing of your data, to data portability, and to withdraw consent. You may also complain to your local data protection authority. Contact us through your account to exercise these rights; we respond within one month.
Security
We use appropriate technical and organisational measures, including encryption in transit, access controls and database rules that limit each account to its own data.
Cookies and local storage
We use only essential browser storage needed to keep you signed in and run checkout. We do not use advertising cookies.