Privacy, terms and cookies

1. Who we are

Prompted (promptedbrand.com, platform.promptedbrand.com, api.promptedbrand.com and docs.promptedbrand.com) is operated by SEOtoolbox.io, Inc., a Delaware corporation, 651 N Broad St., Suite 206, Middletown, Delaware 19709, United States (“we”, “us”).

We decide how personal data about our website visitors, account holders and people who contact us is used, and we are responsible for it. When a customer puts personal data about other people into their workspace (for example team members they invite or the recipients of a report), the customer decides how it is used and we process it on their behalf.

Questions or requests about your data: [email protected].

2. What we collect

• Account details: name, email address, password (stored only as a one-way hash), your Google account identifier if you sign in with Google, language, theme and other preferences, two-factor settings (encrypted) and when you last used the app.
• Workspace content: your website, brand details, competitors, topics and prompts, Brand kit facts and sources, briefs, drafts and images, reports and their recipients, team members and invitations, and connections you add (such as WordPress, Slack or a product feed), whose credentials we store encrypted.
• AI answers and public web data: the answers AI engines give to your prompts, the pages they cite, and public pages of your website and product catalogue that we read for your Brand kit and Shopping.
• Usage and technical data: IP address, browser and device details, pages and actions in the app, sign-in attempts (for security), API requests (for rate limits) and server logs. If you accept analytics and advertising cookies, also how you found us and use the site and the app, collected by Google Analytics and Google Ads.
• Messages and enquiries: what you send us, including the details in a sales enquiry (name, work email, company, website, team size, message) and the privacy consent you gave with it.
• Report and pitch activity: when a customer emails a report, we record whether each recipient opened the email or the report link (using an image and a personal link in the email). When a shared pitch is opened, we record the visit and the time spent on each section.
• Payment details: when you choose a paid plan, our payment provider handles your card. We receive only limited details such as the card type, its last four digits and your billing details. We never store full card numbers.

3. Why we use it

• To provide the service: run scans, show your results, and write the briefs, drafts, summaries and suggestions you ask for.
• To send the emails and messages the service relies on: email verification, password resets, notifications, approvals, and the reports and Slack messages you set up.
• To keep accounts and the service secure, prevent abuse and enforce our terms.
• To support you and to improve and develop our services, including our own AI models. For this we use usage data and workspace content, de-identified and aggregated where we can.
• With your consent, to measure visits and the ads that bring people to Prompted (Google Analytics and Google Ads).
• To send product news and marketing emails, only if you agreed to receive them. Every such email has an unsubscribe link.
• To meet our legal obligations, for example tax and accounting rules.

We do not sell personal data. We do not allow third-party AI providers to train their models on your content: they process it only to return results to us.

The AI Visibility Index reports we publish describe how AI engines talk about brands. They are based on AI answers, not on personal data.

4. Legal basis

If you are in the European Economic Area, the United Kingdom or Switzerland, we rely on these legal bases:

• Contract: to provide the service you signed up for and to manage your account.
• Legitimate interests: to keep the service secure, prevent abuse, improve and develop our services (including our own AI models) and answer business enquiries. We balance these against your rights, and you can object at any time.
• Consent: for marketing emails, analytics and advertising cookies, and for the privacy consent given with a sales enquiry. You can withdraw consent at any time.
• Legal obligation: where the law requires us to keep or share data.

5. Who we share it with

We share personal data only as needed to run the service:

• Service providers that work on our behalf under contract: cloud hosting and database (Google Cloud, United States), content delivery and security (Cloudflare), email delivery (Mailgun, with data kept in the EU region), website analytics and ad measurement (Google, only with your consent), AI model providers (to analyse answers and write the content you ask for) and our payment provider.
• Services you connect yourself, such as WordPress, Slack, Google Merchant Center, Shopify or WooCommerce, which receive or send data as you direct.
• People in your workspace or agency, according to the roles your admins set, and the recipients of reports or pitches you choose to share.
• Authorities or others when the law requires it, or to protect our rights, users or the public.
• A buyer or successor if our business is sold or merged, under this policy.

We are based in the United States and store data there. When we transfer personal data from the EEA, the UK or Switzerland, we use safeguards such as the European Commission’s Standard Contractual Clauses or the Data Privacy Framework, where they apply.

6. How long we keep it

• Account and workspace data: as long as your account or workspace exists. When you delete a workspace, its data is removed from our live systems right away and from backups within 30 days.
• In-app notifications: 90 days.
• Server logs and security records: up to 90 days.
• Report and pitch activity: as long as the report or pitch exists.
• Sales enquiries: up to 24 months after our last contact, unless you become a customer.
• Billing records: as long as tax and accounting law requires, usually 7 years.

7. Your rights

Depending on where you live, you can ask us to give you a copy of your personal data, correct it, delete it, export it, restrict or object to how we use it, and withdraw consent you gave. Residents of California and other US states with privacy laws have similar rights to know, correct and delete their data, and we do not sell or share personal data for advertising.

To use these rights, email [email protected]. We answer within 30 days and may need to confirm your identity first. If your data sits in a customer’s workspace, we may refer you to that customer. You can also complain to your local data protection authority.

Security: data is encrypted in transit, credentials and secrets are encrypted at rest, passwords are hashed, two-factor sign-in is available, and access is limited to people who need it.

The service is for businesses and is not meant for anyone under 16.

8. Cookies

We use the cookies the sites need to work and to remember your preferences. With your consent, we also use Google Tag Manager, Google Analytics and Google Ads cookies to see how people find and use Prompted and to measure our ads; Google then receives information such as the pages you visit, your device and an approximate location from your IP address. You can accept or reject these in the cookie banner and change your choice at any time. See the Cookies tab for the full list.

9. Changes

We will post changes here and update the date above. If a change is significant, we will tell account holders by email before it takes effect.