Privacy Policy

Last Updated: June 29, 2026

prmpts is a product of Brewcode LLC (“Brewcode,” “we,” “us,” or “our”), a limited liability company organized under the laws of the State of Delaware, USA, with its registered office at 1130 Ogletown Road, PMB # 1857, Suite 2, Newark, Delaware 19711, USA. This Privacy Policy describes how we collect, use, store, share, and protect information about you when you use our website at www.prmpts.app and the prmpts AI prompt platform (collectively, the “Service”).

This policy is framed in compliance with the Information Technology Act, 2000 (“IT Act”), the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (“IT Rules”), and guidelines issued by the Ministry of Electronics and Information Technology (MEITY). We also respect obligations applicable under the General Data Protection Regulation (GDPR) for users in the European Union and the California Consumer Privacy Act (CCPA) for California residents.

Please read this policy carefully. By accessing prmpts, you acknowledge that you have read, understood, and agree to be bound by all the terms of this Privacy Policy.

1. Information We Collect

1.1 Account Registration Information

When you create a prmpts account, we collect:

• Full name and email address
• Username and (optionally) profile bio, avatar, and social links (website, X/Twitter, GitHub)
• Password (stored as a bcrypt hash — never in plaintext), where you sign up with email and password
• For social sign-ups, your provider identifier and basic profile (see Section 3)
• Notification and marketing preferences, and your consent records (terms/privacy acceptance, policy version, marketing opt-in)
• Billing details: name on card, billing address, and last four digits of card (full card numbers are processed and stored exclusively by our payment processor, Stripe — never by us)

1.2 Content You Create

When you use prmpts, we collect and store the content you create, including:

• Prompts you author — titles, prompt body/content, variables, tags, categories, and visibility (public, private, draft)
• Collections you build and the prompts you add to them
• Bookmarks, likes, copies, and other interactions with prompts
• Your public profile (display name, username, bio, avatar) when you choose to make prompts or collections public
• Share codes and links you generate

You are responsible for ensuring that prompts and other content you submit do not contain sensitive personal data, secrets, or material you do not have the right to share — especially for content you make public.

1.3 AI Prompt Generation Data

When you use prmpts’ AI generation features, we collect:

• The instructions, inputs, and context you submit to generate or improve a prompt
• The AI-generated output returned to you
• Generation metadata: model used, token/usage counts, estimated cost, and timestamps
• Aggregate usage counters tied to your account (e.g. lifetime generations) for plan limits and abuse prevention

See Section 4 for how this data is processed by third-party AI providers.

1.4 Usage & Technical Data

• IP address, browser type and version, operating system, and device type
• Pages visited, features used, prompt views, session duration, and click patterns
• Error logs, API response times, and performance diagnostics
• Referral source and marketing campaign parameters (UTM tags)
• Cookies and tracking identifiers
• Last active/last login timestamp (updated on authenticated requests)

1.5 Communication Data

• Emails and support requests sent to us
• Public contact-form submissions
• In-app feedback, bug reports, and feature requests
• Responses to surveys or research invitations

1.6 Payment & Billing Data

Payment transactions are processed by Stripe. We do not store full card numbers or CVV codes. We retain a Stripe customer identifier, subscription identifier, transaction/invoice IDs, subscription status, plan tier, billing interval, and invoice history for accounting and statutory compliance.

2. How We Use Your Information

We use collected information for:

• Providing and improving the prmpts platform
• Storing, organising, and (where you choose) publishing the prompts and collections you create
• Generating prompts and AI-powered suggestions via our AI features
• Processing payments and managing your subscription
• Sending service-related notifications (sign-in/OTP codes, password resets, billing and renewal alerts, security notices)
• Sending product updates and community-activity emails where you have opted in
• Analysing usage patterns and platform analytics
• Debugging and resolving technical issues
• Complying with legal obligations
• Preventing fraud, abuse, and ensuring security
• Personalising your experience

We DO NOT:

• Sell your personal data to third parties
• Share your credentials or authentication tokens with unauthorised parties
• Use your data for marketing without the consent required by law
• Make your private prompts, drafts, or collections visible to other users
• Use your prompts, generation inputs, or generated outputs to train AI models

3. Sign-In with Google and GitHub

prmpts lets you sign in using Google or GitHub via OAuth 2.0. These integrations are used for authentication only — to verify your identity and create or access your account.

3.1 Google Sign-In

When you sign in with Google, we receive a Google-issued ID token and your basic profile information (name, email address, and profile picture). We use this solely to create or sign you into your prmpts account.

We do not request or access your Gmail, Google Drive, Google Contacts, Google Calendar, or any other Google service. prmpts’ use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

3.2 GitHub Sign-In

When you sign in with GitHub, we receive your basic GitHub profile (name, email address, and avatar) to create or sign you into your prmpts account. We do not access your repositories or any other GitHub data.

3.3 Data from Sign-In Providers

• We store only the identifiers and basic profile fields needed to operate your account.
• We do not sell, share, or transfer data obtained from sign-in providers to any other party.
• We do not use sign-in provider data for advertising.
• You may set a password to enable email/password login independently of these providers.

4. AI Processing & Third-Party AI Providers

When you use prmpts’ AI generation features, your input (your instructions/context and the relevant prompt content) is sent to an AI provider to produce the requested output. Depending on the model selected, the provider may be Google Vertex AI (Gemini), AWS Bedrock, or OpenRouter. The following safeguards apply:

• Only the content needed to fulfil your request (your instructions and the prompt text/context you provide) is sent to the provider — not your account credentials or billing data.
• AI providers process this data under data processing agreements that prohibit using your data to train their models.
• We do not use your generation inputs or outputs to train models.
• You are responsible for ensuring your inputs do not include sensitive personal data you do not wish to share with an AI provider.
• Generation inputs, outputs, and usage metadata are stored within your prmpts account.

5. Data Security & Encryption

5.1 Account Credentials

• Passwords are hashed using bcrypt and never stored in plaintext.
• Sign-in tokens are never displayed after authentication.
• JWT access tokens are short-lived, with refresh-token rotation.

5.2 AI Provider Credentials

Where administrators configure AI provider API keys, those credentials are encrypted at rest, decrypted only at the moment they are needed to call the provider, and never logged or returned to the browser.

5.3 Data in Transit

• All communication uses HTTPS/TLS 1.2 or higher.
• Data between your browser and our servers is encrypted.

5.4 Infrastructure Security

• Hosted on Google Cloud Platform (GCP) with encryption at rest (AES-256).
• Application data stored in MongoDB Atlas; media (avatars, blog images) stored in Google Cloud Storage.
• Access restricted to authorised services via role-based access control.
• Network isolation, firewall rules, and security monitoring.
• Security-relevant events logged for audit purposes.
• Regular security updates.

Despite these measures, no system is completely secure. Notify us immediately at support@prmpts.app if you suspect unauthorised access to your account.

6. Third-Party Services & Sub-Processors

We rely on a limited set of sub-processors to operate the Service. All are bound by data processing agreements and may not use your data for their own purposes.

7. Data Retention & Deletion

7.1 Active Accounts

While your account is active, we retain your account information, prompts, collections, bookmarks, generation history, and configuration.

7.2 Account Deletion

Upon account deletion:

• Your account is soft-deleted immediately and scheduled for permanent deletion. Personal data, prompts, collections, and related content are permanently deleted within 30 days.
• Encrypted backups are purged within 90 days.
• Billing records and invoices are retained for 7 years as required by Indian tax and accounting law.
• Audit logs are retained for up to 2 years.

7.3 Inactive Accounts

Accounts inactive for 12 or more months may be flagged for deletion. We will notify you by email before any deletion, giving you the opportunity to reactivate or export your data.

8. International Data Transfers

prmpts’ infrastructure is hosted on Google Cloud Platform, with application data in MongoDB Atlas. Your data may be transferred to and stored in data-centre regions inside or outside your country of residence. By using prmpts, you consent to such transfers. We rely on adequate safeguards, including Standard Contractual Clauses and our providers’ ISO 27001 / SOC 2 Type II certifications, for international transfers.

9. Your Rights & Data Subject Requests

Depending on your location (GDPR, CCPA, IT Act, etc.), you may have the following rights:

• Access: Request a copy of your personal data
• Rectification: Correct inaccurate or incomplete data
• Erasure: Delete your account and associated data
• Portability: Export your data in a machine-readable format
• Restriction: Limit how we process your information
• Objection: Opt out of certain data processing activities
• CCPA (California): Request disclosure, deletion, or opt-out of sale (we do not sell personal information)

You can exercise many of these rights directly from your account settings (profile editing, data export, account deletion, marketing preferences). To submit any other request, email support@prmpts.app. We will respond within 30 days. Identity verification may be required before processing your request.

10. Cookies & Tracking

We use:

• Session cookies — for authentication and security
• Analytics cookies — to understand usage patterns (where enabled)
• Preference cookies — to remember your settings

You can disable cookies in your browser, but some features may not work.

11. Sensitive Personal Data

Under the IT Rules, 2011, we classify and apply heightened protections to: account passwords (bcrypt hashed), payment card information (processed exclusively by our PCI-DSS-compliant processor — not stored by us), and any AI provider credentials configured by administrators (encrypted at rest). We collect sensitive personal data only with your informed consent and use it solely for the purposes stated in this policy.

12. Data Breach Notification

In the event of a data breach reasonably likely to result in harm to you, we will notify you via email within the timeframe required by applicable law, including a description of the breach, the data affected, our response measures, and recommended steps for you to take.

13. Children’s Privacy

prmpts is not intended for users under 18. We do not knowingly collect personal information from children. If we discover we have collected data from someone under 18, we will delete it. Contact us at support@prmpts.app if you believe a minor has provided us with personal information.

14. Changes to This Policy

We may update this policy periodically. Material changes will be announced via email to registered users, a notice on our website, and/or in-app notifications. Continued use of prmpts after changes constitutes acceptance of the updated policy.

15. Regional Compliance

GDPR (European Union)

If you are in the EU/EEA, you have additional rights under GDPR, including data portability, the right to be forgotten, and the right to lodge a complaint with your local supervisory authority. Our lawful basis for processing is performance of contract (to provide the Service) and legitimate interests (security, fraud prevention, analytics).

CCPA (California)

If you are a California resident, you have rights under CCPA including the right to know, the right to delete, and the right to opt out of the sale of personal information. We do not sell personal information.

India Compliance

prmpts is operated from Bengaluru, India and complies with the Information Technology Act, 2000; the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011; and MEITY guidelines. Any disputes relating to this Privacy Policy shall be subject to the exclusive jurisdiction of the courts in Bengaluru, Karnataka, India.

16. Contact Us

For privacy questions, concerns, or to exercise your data rights:

• Company: Brewcode LLC
• Product: prmpts
• Email: support@prmpts.app
• Website: www.prmpts.app
• Registered Address: 1130 Ogletown Road, PMB # 1857, Suite 2, Newark, Delaware 19711, USA
• Response Time: Within 7 business days for general queries; within 30 days for formal data-rights requests

By using prmpts, you confirm you have read and agree to this Privacy Policy.

Jurisdiction: India (Bengaluru, Karnataka) • Compliance: IT Act 2000 • IT Rules 2011 • MEITY Guidelines • GDPR • CCPA