Privacy Policy
What we collect when you use Studio Prompts, why, who processes it on our behalf, how long we keep it and the choices you have. We collect the minimum needed to run the library, bill you and stop abuse.
Last updated Version 1.1-draft
Contents
1. Who is responsible
[OPERATOR: legal entity name — launch blocker], [OPERATOR: registered address — legal review required], is the data controller for personal data processed through www.studioprompts.com. Privacy questions and requests: legal@studioprompts.com.
2. What we collect
| Data | Examples | Source |
|---|---|---|
| Account | Email address, password hash, display name, avatar, marketing preference, sign-in provider ids | You, when you register or sign in |
| Billing | Order amount and currency, product purchased, payment status, last four digits and brand of card, billing country, invoices | Our payment processor; we never receive full card numbers |
| Usage | Prompts viewed, copied or unlocked, likes and favourites, searches, template downloads, MCP tool calls, daily quota counters | Generated as you use the Service |
| Technical | IP address (pseudonymised for analytics), user agent, coarse country, a first-party visitor id, referrer, pages viewed | Your browser and our servers |
| Support | Messages you send us, the name and email you provide, ticket history | You |
| Programs | Affiliate referral codes and clicks, payout details (PayPal email, Wise details or bank details), creator submissions and payout records | You and your referrals’ activity |
| Custom requests | Reference URLs, briefs and delivery email | You |
| Preferences | Theme, whether you paused the moving gallery, dismissed sale bars, the page you were on before signing in, campaign parameters from the link you arrived on | Your browser (cookies / local storage) |
| MCP and OAuth | Connected clients you authorised, access tokens (stored hashed), tool names called, outcomes, timings and the id of the design involved — never the prompt text you received | Generated when you connect an AI tool |
We do not intentionally collect special-category data (health, religion, etc.). Please do not include it in support messages or briefs.
3. Why we use it and our legal bases
- Providing the Service and fulfilling purchases — performance of our contract with you (account, billing, entitlements, unlock history, deliveries).
- Security, fraud prevention and fair-use enforcement — our legitimate interest in protecting the library and other members (rate limits, daily quotas, duplicate-account detection, abuse investigation).
- Product analytics and improving the library — our legitimate interest, using aggregated or pseudonymised data wherever possible.
- Transactional email (receipts, security notices, delivery updates, support replies) — performance of contract and legitimate interest.
- Marketing email about new drops and offers — your consent, which you can withdraw at any time via the unsubscribe link or account settings.
- Affiliate attribution and payouts — performance of contract with affiliates and our legitimate interest in accurately rewarding referrals.
- Legal obligations — tax and accounting records, responding to lawful requests.
6. International transfers
Our processors may store or process data outside your country. Where data moves out of the EEA, the UK or Switzerland, we rely on adequacy decisions or standard contractual clauses and equivalent safeguards.
7. How long we keep data
| Data | Retention |
|---|---|
| Account and unlock history | For as long as your account exists, then deleted or anonymised within 30 days of closure |
| Orders, payments, invoices | As long as required by tax and accounting law (typically 7–10 years) |
| Support tickets | 3 years after resolution |
| Analytics events | Raw events 13 months; aggregated statistics indefinitely |
| Security and rate-limit logs | Up to 90 days |
| Affiliate clicks and attributions | The cookie window plus the commission holding period, then aggregated |
| Marketing consent records | For the life of the consent plus 3 years |
8. Your rights
Depending on where you live you may have the right to access, correct, delete or export your personal data, to object to or restrict certain processing, to withdraw consent, and to complain to a supervisory authority. You can manage most account data yourself in account settings; for anything else email legal@studioprompts.com. We respond within 30 days and may ask you to verify your identity first.
California residents: we do not sell or share personal information for cross-context behavioural advertising, and we do not use sensitive personal information other than to provide the Service.
How to make a request, how we verify you and how quickly we answer is described on the Privacy Requests page (www.studioprompts.com/privacy-requests). Members can delete their account from Account → Settings.
9. Privacy choices for U.S. residents
Residents of California and of other states with comprehensive privacy laws (for example Colorado, Connecticut, Virginia, Utah, Texas and Oregon) have rights to know what personal data we collect, to access, correct and delete it, to obtain a portable copy, to opt out of sale, sharing for cross-context behavioural advertising, targeted advertising and certain profiling, and not to be discriminated against for exercising those rights. We extend the same choices to everyone.
- We do not sell personal data and we do not share it for cross-context behavioural advertising, so there is no sale or sharing to opt out of. We do not use personal data for targeted advertising or for profiling with legal or similarly significant effects.
- We honour the Global Privacy Control signal as an opt-out request where that right applies; because we do not sell or share personal data, receiving the signal does not change how we treat your data today.
- We do not knowingly collect or use sensitive personal information other than account credentials and payment-related details needed to provide the Service.
- California “Shine the Light”: we do not disclose personal information to third parties for their own direct-marketing purposes.
- To exercise a right, follow the Privacy Requests page: email privacy@studioprompts.com or use the contact form with the subject “Privacy request”. You do not need an account, you may use an authorised agent, and you can appeal a decision you disagree with.
Categories of personal information collected in the last 12 months, their sources, purposes and recipients are those listed in sections 2, 3 and 5; retention periods are in section 7.
10. Security
Premium prompt text is stored separately from public metadata and only released after a server-side entitlement check. Access tokens for MCP are stored hashed. Card details never touch our servers. Access to production data is limited to staff who need it and is logged. No system is perfectly secure; if we learn of a breach affecting you we will notify you as required by law.
11. Children
The Service is not directed at children under 16 and we do not knowingly collect their data. If you believe a child has provided us data, contact legal@studioprompts.com and we will delete it.
12. Changes to this policy
We will post any changes here and update the date above. Material changes are announced on the Service or by email before they take effect.