Privacy Policy

Data We Collect

• Prompt content you choose to save or publish to the community library.
• Team workspace prompts you save to a shared team library (visible to team owners/admins and approved members).
• Generated metadata (title, description, category, token count, usage counters).
• Technical account identifier (user ID) and session credentials used to authenticate extension requests.
• Email addresses you optionally provide for support, checkout, or product updates.
• Which link you arrived from: the source, medium, and campaign on that link, and when you landed.
• Payment subscription metadata from Stripe (for example, customer and subscription status).
• Operational error logs when AI or backend requests fail; these logs may include prompt text needed to diagnose the failure.

How We Use Data

• Store and display your prompts and metadata in your PromptAlo experience.
• Provide search, trending, and prompt sharing capabilities for prompts you mark public.
• Process and validate subscription status for paid features.
• Prevent abuse and maintain service reliability.
• Respond to support, billing, privacy, export, and deletion requests.

Where Data Is Stored

• Your browser stores local extension data in Chrome extension storage, including saved prompts, settings, quotas, and cached session state.
• PromptAlo servers store account records, cloud-synced prompts, prompt quality reviews, subscription state, and support records in MongoDB.
• Stripe stores billing and subscription records for payment processing.
• When AI-powered labeling, embeddings, or quality review is used, prompt text is sent to the configured AI provider through PromptAlo server infrastructure.

Third-Party Services

• Stripe for billing and subscription events.
• MongoDB Atlas for application data storage.
• OpenRouter-compatible AI providers for metadata generation, semantic search embeddings, and prompt quality review.

International data transfers: Your data may be processed in countries outside the UK or EEA by:

• MongoDB Atlas: Relies on Standard Contractual Clauses (SCCs) and EU-US Data Privacy Framework certification.
• Stripe: Certified under the EU-US Data Privacy Framework.
• AI providers via OpenRouter: May process data in the USA or other regions; safeguards depend on the specific provider selected by OpenRouter.

We rely on these providers' compliance frameworks and contractual safeguards to protect your data during international transfers.

AI Service Data Flow

When you use AI-powered features, PromptAlo routes your prompt text through configured AI providers to generate metadata, quality checks, and search embeddings.

Default AI provider: OpenRouter (https://openrouter.ai), which routes requests to underlying AI providers including OpenAI, Anthropic, Google, Meta, and others depending on the selected model.

Which operations send prompts to AI providers:

• Metadata generation (titles, descriptions, categories)
• Prompt quality review checks
• Semantic search embeddings for the prompt library

You can disable AI features in the extension settings if you prefer not to share prompt text with third-party AI providers.

AI provider privacy policies:

• OpenRouter: https://openrouter.ai/privacy
• OpenAI: https://openai.com/policies/privacy-policy
• Anthropic: https://www.anthropic.com/legal/privacy
• Google: https://policies.google.com/privacy

PromptAlo does not control how third-party AI providers retain or use data sent to them. Their data handling is governed by their own privacy policies.

GDPR and UK GDPR

Data controller: Dario Maddaluno, operating PromptAlo as a sole trader.

Privacy contact: [email protected]

Postal address: Available on verified request for legal, privacy, and regulatory matters.

PromptAlo processes personal data under one or more of these legal bases: performance of a contract (providing the service you request), consent (optional emails and optional public sharing), and legitimate interests (service security, abuse prevention, diagnostics, and product operation).

Residents of the UK, EEA, and jurisdictions with similar laws may request:

• Access to the personal data PromptAlo holds about you.
• Correction of inaccurate or incomplete data.
• Deletion of your data.
• Export of your data in a structured, machine-readable format.
• Restriction of or objection to certain processing.
• Withdrawal of consent for optional processing.

Requests can be made in-product where available, or by emailing [email protected] from the address you use with PromptAlo.

Data Retention

We retain your data for the following periods:

• Prompts and account data: Retained while your account is active, or until you request deletion.
• Operational error logs: Automatically deleted after 90 days.
• Support records: Retained for 2 years after your last interaction with support.
• Billing and tax records: Retained by Stripe for 7 years in accordance with UK/EU tax and accounting requirements.
• Backup purging: Deleted data is removed from backup systems within 90 days of the deletion request.

Data Export and Deletion

• You can export your data from the extension settings in JSON format. The export includes all prompts, settings, quality reviews, and account information.
• You can delete your account from the extension settings or by contacting support.
• After a verified deletion request, PromptAlo removes your account data from active systems within 30 days.
• Billing records are retained by Stripe for 7 years as required by law and are not deleted with your account.

Analytics and Tracking

If you accept analytics cookies on the website, Google Analytics records which link you arrived from (the source, medium, and campaign on that link). You can decline or change this under Cookie settings. PromptAlo does not use advertising cookies or sell personal data. The extension may send anonymous, first-party product events (for example install, first save, first reuse, and paywall views) using a random install identifier. Prompt text is never included in these events. You can turn this off in extension Options.