1. Introduction
PromptArch ("we," "us," or "our") operates the website at promptarch.ai. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our service, with or without an account.
2. Information We Collect
2.1 Account Information
When you create an account via Google OAuth, GitHub OAuth, or magic link, we collect your email address, display name, and profile picture URL as provided by the authentication provider.
2.2 Usage Data
We collect information about how you use PromptArch, including prompts and Studio artifacts you build (domain, inputs, generated output), quality scores, Standards you save, credit transactions, the days you are active, feature usage patterns, and the versions of our Terms you accepted, with the date.
2.3 Payment and Subscription Information
Subscriptions, Team packs and credit packs are paid through Paddle, our Merchant of Record; customers in Latin America can also pay for one-time credit packs through MercadoPago. We never receive or store your full card number or CVV. We store transaction metadata (what you bought, amount, currency, transaction ID) and, for subscriptions, the plan, status, billing period and the credits each payment granted, so we can manage renewals, plan features and refunds.
2.4 Analytics and Advertising Measurement
With your consent, given through our cookie banner, we use Google Analytics 4, Google Ads conversion measurement and Cloudflare Web Analytics to understand how visitors find and use PromptArch: pages viewed, referring site and campaign (UTM) parameters, country, device type, and events such as sign-ups and purchases. Until you accept, Google's tags run in Consent Mode with analytics and advertising storage denied, so they set no cookies and send only cookieless signals without identifiers, and Cloudflare Web Analytics does not load. If you accepted and then buy through Paddle, we pass your Google Analytics client ID to the checkout and report the purchase to Google Analytics from our server, so the purchase can be attributed to your visit.
2.5 Use Without an Account and Abuse Prevention
When you use features without an account (trying a prompt build, the Enhancer or the AI lint score), we process your IP address to enforce daily limits. It is held in a rate-limit counter that expires within 24 hours and is not linked to any account. These features use Cloudflare Turnstile, which processes browser and device signals to tell people from bots. The text you submit is sent to our AI provider to generate the result and is not saved to an account.
2.6 Teams, Public Prompts and Referrals
If you join a team, your display name, email address and role are visible to its other members, together with the prompts and Standards you share with the team and team activity (such as team builds). If you publish a prompt, its title, generated output, quality score and domain become public at its link and may be indexed by search engines; your inputs are never published. If you sign up through a referral link, we record the referral so the person who referred you can receive their reward; a cookie holds the referral code for up to 30 days.
2.7 API Keys
When you create an API key, we store only a cryptographic hash of it, together with its name, its expiry date and when it was last used. Requests made with your key, including from the PromptArch CLI or MCP server, are processed like requests from your account.
3. How We Use Your Information
- Provide the service: authenticate your account, process prompt builds, manage credits, store your prompt library, and operate teams and API access.
- Process payments: fulfill credit purchases and subscriptions, grant plan credits and features, issue refunds, and prevent fraud.
- Improve the product: analyze aggregate usage patterns to enhance domain coverage, quality scoring, and user experience.
- Communicate: send transactional emails (magic link sign-in, payment receipts) and respond to support requests.
- Measure marketing: with your consent, understand which campaigns and referrals bring visitors, sign-ups and purchases (Section 2.4).
- Security and compliance: detect abuse (including bot traffic and signup-bonus, coupon or referral abuse), enforce rate limits, and comply with legal obligations.
4. Data Sharing
We do not sell your personal data. We share information only with:
- Supabase: database and authentication provider (stores your profile and prompt data).
- Anthropic: AI model provider (receives your prompt inputs to generate outputs; inputs are not used for model training per Anthropic's API terms).
- Paddle: Merchant of Record (handles subscription and pack payments, tax, and compliance).
- MercadoPago: payment processor for one-time credit packs in Latin America.
- Cloudflare: hosting, rate limiting, bot protection (Turnstile) and, with your consent, web analytics.
- Google: sign-in, if you choose it, and, with your consent, Google Analytics 4 and Google Ads conversion measurement.
- GitHub: sign-in, if you choose it.
- Sentry: error monitoring (receives anonymized error reports, not prompt content).
- Other users: the members of your team, and the public for prompts you choose to publish (Section 2.6).
5. Data Retention
We keep your account data, saved prompts and Standards for as long as your account is active. Rate-limit counters tied to an IP address expire within 24 hours.
When you delete your account, we remove from our database, at that moment, your profile, prompts, Standards, API keys, credit and transaction history, subscription records, referrals and team memberships; teams you own are deleted together with their pooled credits. We keep two things to prevent abuse: a one-way hash of your email address and the codes of the coupons you redeemed, so the signup bonus and coupons cannot be claimed again. Team activity and team credit records you created stay with the team, with the link to your account removed. Paddle and MercadoPago keep their own payment records as the law requires, and residual copies may persist in our database provider's encrypted backups until those backups expire.
6. Your Rights
Depending on your jurisdiction, you may have the right to:
- Access the personal data we hold about you.
- Request correction of inaccurate data.
- Request deletion of your data.
- Object to or restrict processing of your data.
- Request a portable copy of your data.
You can download a copy of your data (JSON export) and delete your account yourself from your Profile page. If you have an active subscription, cancel it before deleting your account. You can withdraw your analytics and advertising consent at any time by clearing this site's cookies, which brings the cookie banner back.
To exercise any of these rights, contact us at support@promptarch.ai.
7. Cookies and Local Storage
Always on (essential): Supabase authentication cookies that keep you signed in; cookie_consent (your banner choice, 1 year); NEXT_LOCALE (your language); pa_ref (a referral code, up to 30 days); pa_active (a once-a-day activity marker, 24 hours); and pa_builder_mode (your builder preference). Your theme and attribution-footer preferences are kept in your browser's local storage.
Only after you accept in the cookie banner: Google Analytics and Google Ads cookies (such as _ga), and campaign attribution data (UTM parameters and referrer, first and last visit) kept in local storage. Cloudflare Web Analytics loads only after you accept and does not set cookies.
If you reject, none of the consent-based cookies or scripts load, and the Service works the same.
8. Security
We use industry-standard security measures including HTTPS encryption, Row Level Security on all database tables, hashed storage of API keys, webhook signature verification for payments, bot protection, and rate limiting on API endpoints. However, no method of electronic transmission or storage is 100% secure.
9. Children's Privacy
PromptArch is not intended for anyone under the age of 16, and you must be at least 16 to create an account. We do not knowingly collect personal information from children under 16; if you believe a child has given us personal data, contact us and we will delete it.
10. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by updating the "Last updated" date at the top of this page and, where practical, by email or an in-app notice. Continued use of the service after changes constitutes acceptance of the updated policy.
11. Contact Us
If you have questions about this Privacy Policy or your data, contact us at support@promptarch.ai.