Privacy Policy

1) Scope

This Policy applies to our website, web app, and Chrome extension (collectively, the “Service”). It covers personal data we process when you use Promtlo.

2) Data We Collect

• Account data: email address and basic profile info from Google Sign-In to create and authenticate your account; plan type (Free/Pro).
• Prompt data: the prompts you save (key, text, tags), and metadata like timestamps.
• Usage data: non-content events such as daily insertion counts (e.g., number of times you expand a shortcut) and counts per shortcut key (e.g., //idea). We do not collect page content or prompt text via the extension. We also do not collect full URLs or site origins at this time.
• Technical logs: IP address, timestamps, and diagnostics captured by our hosting and security providers.
• Support: content you send us when you contact reach.promtlo@gmail.com.

What we don’t do: the extension does not read everything you type. It listens for your shortcut (for example //joke) and inserts your own saved prompt. We do not sell your personal data.

3) How We Use Data

• Provide, maintain, and secure the Service (auth, sync, storage, rate-limits, abuse prevention).
• Improve performance and user experience (debugging, analytics, feature decisions).
• Communicate with you (service announcements, support, plan changes).
• Comply with law, enforce Terms, and protect rights and safety.

4) Legal Bases (GDPR)

• Contract: to provide the Service you request.
• Legitimate interests: securing and improving the Service.
• Consent: for optional cookies/analytics (where required).
• Legal obligation: where law requires us to retain or disclose data.

5) Sharing & Subprocessors

We don’t sell personal data. We share data with trusted service providers (“subprocessors”) who help run Promtlo, such as hosting, databases, authentication, and analytics. Typical providers include Vercel (hosting), Supabase/Postgres (database), Google (authentication), and similar infrastructure vendors we may add as we grow. These providers process data under contracts that protect your information.

6) International Transfers

We may process data in India, the EU, the US, or other locations where our providers operate. Where required, we use appropriate safeguards such as the EU Standard Contractual Clauses or equivalent mechanisms to protect cross-border transfers.

7) Security

We use industry-standard technical and organizational measures (e.g., HTTPS in transit; encryption at rest provided by our cloud/database providers; access controls; monitoring). No system is 100% secure; please keep your account credentials confidential.

8) Data Retention

We retain account and prompt data for as long as your account is active. If you delete prompts or close your account, we delete or anonymize related data within a reasonable period, subject to lawful retention (e.g., backups and logs typically retained up to ~30–90 days). The extension keeps only the last 30 days of local usage analytics.

9) Your Rights

• Access, correction, deletion, and portability of your personal data.
• Opt-out of certain processing (e.g., analytics cookies where applicable).
• For California residents: we do not “sell” or “share” personal information as defined by CPRA.
• For India (DPDP 2023): you may exercise the rights of access, correction, and erasure, and raise grievances with our Grievance Officer.

To exercise rights, email reach.promtlo@gmail.com. We will verify your request and respond within applicable timelines.

10) Cookies & Similar Technologies

We use cookies/local storage for essential functions (sign-in session, preferences) and may use analytics cookies to understand usage and improve features. You can control cookies via your browser settings; disabling some cookies may impact functionality.

11) Children

Promtlo is not directed to children under 13 (or under 16 in the EU). If you believe a child provided personal data, contact us and we will delete it.

12) Complaints & Contact

If you have concerns, contact us at reach.promtlo@gmail.com. You also have the right to complain to your local data protection authority where applicable.

13) Changes & Jurisdiction

We may update this Policy; material changes will be notified in-app or by email. This Policy is governed by the laws of India, and disputes are subject to the exclusive jurisdiction of the courts at Jaipur, Rajasthan, India.