1. Who we are
Prompt Vault – Nigel Holland is the data controller for the personal information described in this notice.
Address: Knaresborough, North Yorkshire, United Kingdom
Email: support@promptvault.uk
2. Information we collect
- Account and profile information: your name, display name, email address, password hash, account type, company name, biography, avatar, subscription tier and account status.
- Your content: prompts, templates, variable values, titles, tags, categories, visibility choices and prompt version history.
- Community and team information: favourites, team membership and invitations, public-gallery activity, reports you make and moderation records relating to submitted content.
- Support information: messages you send us and the contact details and other information included in them.
- Technical and security information: session data, IP address, browser/device information, timestamps and diagnostic or security records produced when you use the service.
- Analytics information: if you consent, Google Analytics supplies usage information such as sessions, pages viewed, approximate location, device/browser information and interactions with the service.
- Subscription information: your chosen plan, Paddle customer and subscription references, subscription status and relevant transaction references. Prompt Vault does not receive or store your full card details.
Please do not place personal, confidential or special-category information in a prompt unless you are authorised to use it and it is necessary for your task.
3. How we receive information
Most information comes directly from you when you register, build or publish content, join a team, contact support or report a prompt. We also receive limited subscription information from Paddle, team-invitation information from another Prompt Vault user, and technical information automatically when the service is used.
4. How and why we use it
| Purpose | UK GDPR lawful basis |
|---|---|
| Create and authenticate accounts; store, search, export and display prompts; provide templates, teams and requested AI tools. | Performance of our contract with you. |
| Manage subscriptions and reconcile account access with Paddle. | Performance of our contract and, where applicable, legal obligations. |
| Protect accounts, prevent misuse, moderate public content, investigate reports, troubleshoot and improve reliability. | Our legitimate interests in operating a safe, reliable service and protecting users and the public. |
| Send essential account, security, support and subscription communications. | Performance of our contract and our legitimate interests in administering the service. |
| Use Google Analytics to understand visits, usage and performance so we can improve Prompt Vault. | Your consent, which you may withdraw at any time. |
| Send optional marketing communications, if introduced. | Your consent, which you may withdraw. |
| Respond to lawful requests, enforce our terms and establish or defend legal claims. | Legal obligation and our legitimate interests. |
5. Public and private prompts
You control whether a prompt is private or submitted for public display, subject to the features available on your plan. Public prompts and their associated display name, title, content, category and tags can be viewed by other people and may be copied outside Prompt Vault. Changing or deleting a public prompt prevents future display on Prompt Vault but cannot retrieve copies already made by others.
6. AI enhancement and content moderation
When you choose Enhance with AI, the prompt content needed to perform that request is sent to OpenAI. Public content may also be checked using OpenAI’s moderation service to help identify potentially abusive, hateful, sexual, violent or otherwise unsuitable material.
Automated checks can restrict publication or send content for administrator review. A human administrator may review the prompt, its metadata, the reason it was flagged and relevant account information. These checks do not make decisions that produce legal or similarly significant effects. If you believe a moderation decision is wrong, contact us for a review.
7. Who we share information with
We share only what is reasonably necessary with:
- Paddle: our merchant-of-record and payment provider. Paddle collects checkout and payment information under its own Privacy Policy and sends us subscription information needed to provide your plan.
- OpenAI: when AI enhancement is requested and for automated safety moderation.
- Google: if you consent to analytics, Google processes website usage and device information through Google Analytics on our behalf.
- Hosting, database and email suppliers: to host the service, store information and deliver operational communications.
- Professional advisers, regulators or authorities: where reasonably necessary to comply with law, protect rights or deal with a legal claim.
We do not sell your personal information.
8. International transfers
Some suppliers may process information outside the United Kingdom. Where UK data-protection law treats a destination as not providing an adequate level of protection, we require an appropriate transfer mechanism, such as the UK International Data Transfer Agreement, the UK Addendum to approved standard contractual clauses, or another lawful safeguard.
9. How long we keep information
Account information and saved content are normally kept while your account is open. You can delete individual content or request permanent account deletion from your account page. Deletion removes the account and associated prompts, templates and team data from the active service, subject to limited retention where needed for backups, security, fraud prevention, legal obligations or legal claims.
Support messages, moderation records and security logs are kept only for as long as reasonably needed for their purpose. Paddle retains payment and transaction records under its own policy and legal duties. We periodically review retained information and securely delete or anonymise it when it is no longer needed.
10. Cookies and security
Prompt Vault uses essential session, security and preference cookies. If you consent, we also use Google Analytics cookies to measure visits and understand how the service is used. The analytics tag remains disabled until consent is recorded, and we do not use it for advertising personalisation. Paddle may use cookies during checkout for payment and fraud-prevention purposes.
You can accept, reject or later withdraw analytics consent using in the footer. See our Cookie Policy for cookie names, purposes and durations.
We use measures including password hashing, access controls, CSRF protection, encrypted connections and restricted administrator access. No online service can guarantee absolute security, so please use a unique password and contact us if you suspect unauthorised access.
11. Your data-protection rights
Depending on the circumstances, UK data-protection law gives you the right to ask for access, correction, deletion, restriction or transfer of your personal information, and to object to certain processing. Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect processing already carried out.
To exercise a right, email support@promptvault.uk. We may need to verify your identity. You also have the right to complain to the Information Commissioner’s Office (ICO), although we would appreciate the opportunity to address your concern first.
12. Children
Prompt Vault is not intended for children under 16, and we do not knowingly collect their personal information. Please contact us if you believe a child has created an account.
13. Changes to this notice
We may update this notice when the service or the law changes. We will publish the revised version here, change the date above and provide a prominent notice where a change materially affects how we use your information.