Privacy Notice

PromptFlow Store is operated by Ali Awais, who is the data controller for the personal data described in this notice. This means we decide how and why your personal data is processed when you use this site.

• Account data — email address, password (stored only as a secure hash by our authentication provider), and profile details you provide.
• Order data — products purchased, order status and timestamps. Payment card details are collected and processed by Paddle; we never see or store your card number.
• Content you create — prompts, projects, articles, media files, and scheduled posts you save in the app.
• Usage and device data — pages visited, approximate location, device/browser identifiers, and IP address, used for security and analytics.
• Support messages — messages you send us when asking for help.

• Providing the service — account creation, delivering purchases, storing your content (legal basis: performance of a contract).
• Security and fraud prevention — protecting accounts and payments (legal basis: legitimate interests).
• Product improvement and analytics — understanding how the service is used (legal basis: legitimate interests).
• Customer support — responding to your requests (legal basis: legitimate interests / contract).
• Legal obligations — tax and accounting records where required (legal basis: legal obligation).

• Paddle (Merchant of Record) — for the sale of products, payment processing, subscription and order management, tax compliance, and invoicing. Paddle is the controller of payment-related data it collects at checkout.
• Service providers / subprocessors — hosting, database, authentication, analytics, and email delivery providers that process data on our behalf under contract.
• Professional advisers — legal and accounting advisers where needed.
• Authorities — where disclosure is required by law.

We keep your personal data only as long as needed for the purposes above — for example, account data while your account is active, and order records as required for tax and accounting. When data is no longer needed it is deleted or anonymised.

Depending on your country, you may have the right to access, correct, delete, restrict, or port your personal data, to object to processing, and to withdraw consent where processing is based on consent. You may also have the right to complain to your local data protection authority. To exercise any of these rights, contact us via the site; we respond within one month.

We use appropriate technical and organisational measures to protect your data, including encryption in transit, hashed credentials, access controls, and row-level isolation of user data in our database.

We use essential cookies and local storage to keep you signed in and operate the service, and may use analytics cookies to understand usage. You can manage or disable non-essential cookies in your browser settings; essential cookies are required for sign-in to work.

We may update this notice from time to time. The version on this page applies from its "last updated" date. Material changes will be highlighted on the site.