Privacy Policy

Last updated: May 2026

§ 1 Controller

PromptScan
Authorized representative: Julia Holtrup
Johannes-Torka-Straße 1, 41334 Nettetal, Germany
Email: info@promptscan.de
Imprint: https://www.promptscan.de/impressum

§ 2 General Information on Data Processing

We process personal data exclusively in accordance with the General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG). Legal bases for data processing include consent (Art. 6(1)(a) GDPR), contract performance (Art. 6(1)(b) GDPR), legal obligation (Art. 6(1)(c) GDPR), and legitimate interests (Art. 6(1)(f) GDPR). We use TLS/SSL encryption (HTTPS) to protect all data transmissions.

§ 3 Processed Data and Purposes

3.1 Registration and User Account

During registration we process: name, email address, password (encrypted/hash), billing address, company data (if provided). Legal basis: Art. 6(1)(b) GDPR.

3.2 Platform Usage and AI Analyses

When using analysis functions we process: prompts and search queries, generative AI responses, analysis results and rankings, usage data and logs, IP address. We recommend not entering sensitive personal data in prompts.

3.3 Payment Processing (Stripe)

For paid subscriptions, we transmit payment data to Stripe Payments Europe Ltd., Dublin, Ireland. Stripe may transfer data to the USA based on EU Commission Standard Contractual Clauses (Art. 46).

3.4 Hosting and Infrastructure (Lovable)

Our platform is operated via Lovable Technology AB, Stockholm, Sweden. Lovable processes technical access data and server log data. Legal basis: Art. 6(1)(f) GDPR.

3.5 Authentication and Database (Supabase)

For user accounts, authentication (incl. 2FA), and database services we use Supabase Inc. Data processing for EU customers takes place on European servers. Privacy policy: https://supabase.com/privacy.

3.6 Log Data

Technical information is automatically recorded with each access: IP address, date/time, browser type, operating system, pages visited, referrer URL. Storage period: 30 days.

3.7 Contact

When contacting us by email we process: name, email address, message content. Data is deleted after the inquiry is concluded unless legal retention obligations apply.

§ 4 Storage Duration

Personal data is deleted once the processing purpose ceases and no legal retention obligations apply. Statutory retention periods: 10 years (accounting records), 8 years (invoices), 6 years (business correspondence), 3 years (general limitation period).

§ 5 Data Disclosure

Personal data is only disclosed to third parties for contract performance, legal obligations, or legitimate interests. Recipients are exclusively the service providers named in this privacy policy, contractually bound as processors under Art. 28 GDPR.

§ 6 Rights of Data Subjects

You have the following rights: right of access (Art. 15 GDPR), right to rectification (Art. 16), right to erasure (Art. 17), right to restriction (Art. 18), right to data portability (Art. 20), right to object (Art. 21), and the right to withdraw consent at any time. Contact: info@promptscan.de

§ 7 Right to Lodge a Complaint

You have the right to lodge a complaint with a data protection supervisory authority. Competent authority for North Rhine-Westphalia: LDI NRW, Kavalleriestr. 2-4, 40213 Düsseldorf, https://www.ldi.nrw.de

§ 8 Newsletter and Electronic Notifications

We send newsletters, emails, and other electronic notifications only with the consent of recipients or on a legal basis. Registering for our newsletter normally only requires your email address.

Deletion and restriction of processing: We may store unsubscribed email addresses for up to three years based on our legitimate interests to demonstrate prior consent.

Data types processed: inventory data, contact data, meta/communication/process data, usage data.

Legal bases: Consent (Art. 6(1)(a) GDPR). Legitimate interests (Art. 6(1)(f) GDPR).

Opt-Out: You can cancel receipt of our newsletter at any time via the unsubscribe link at the bottom of each newsletter or by contacting us.

Brevo: Email marketing and transactional emails; Service provider: Sendinblue SAS, 7 rue de Madrid, 75008 Paris, France; Legal bases: Consent (Art. 6(1)(a) GDPR), legitimate interests (Art. 6(1)(f) GDPR); Servers in the EU; Website: https://www.brevo.com; Privacy policy: https://www.brevo.com/en/legal/privacypolicy/.

§ 9 Promotional Communication via Email, Post, Fax, or Telephone

We process personal data for promotional communication purposes via various channels such as email, telephone, post, or fax in accordance with legal requirements.

Recipients have the right to revoke consent or object to promotional communication at any time free of charge.

Legal bases: Consent (Art. 6(1)(a) GDPR). Legitimate interests (Art. 6(1)(f) GDPR).

§ 10 Web Analytics, Monitoring, and Optimization

Web analytics serves to evaluate visitor flows of our online offering and may include behavior, interests, or demographic information as pseudonymous values.

We use IP masking (pseudonymization by shortening the IP address) for user protection.

Data types processed: usage data, meta/communication/process data. Cookie storage: up to 2 years.

Legal bases: Consent (Art. 6(1)(a) GDPR). Legitimate interests (Art. 6(1)(f) GDPR).

Google Analytics: We use Google Analytics based on a pseudonymous user identification number. Google Analytics does not log individual IP addresses for EU users. Service provider: Google Ireland Limited, Dublin 4, Ireland; Privacy policy: https://policies.google.com/privacy; Opt-Out: https://tools.google.com/dlpage/gaoptout.

§ 11 Online Marketing

We process personal data for online marketing purposes, including the placement of advertising content based on potential user interests and the measurement of its effectiveness.

Opt-Out options:

• Europe: https://www.youronlinechoices.eu
• Canada: https://youradchoices.ca/
• USA: https://optout.aboutads.info

Legal bases: Consent (Art. 6(1)(a) GDPR). Legitimate interests (Art. 6(1)(f) GDPR).

§ 12 Social Media Presences

We maintain presences within social networks and process user data in this context to communicate with active users or offer information about us.

Please note that user data may be processed outside the European Union, which may create risks for users regarding the enforcement of their rights.

Google Ads and Conversion Measurement: Service provider: Google Ireland Limited, Dublin 4, Ireland; Third-country transfer basis: Data Privacy Framework (DPF).

LinkedIn Insight Tag: Service provider: LinkedIn Ireland Unlimited Company, Dublin 2, Ireland; Privacy policy: https://www.linkedin.com/legal/privacy-policy; Opt-Out: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out.

Instagram: Service provider: Meta Platforms Ireland Limited, Dublin 4, Ireland; Privacy policy: https://privacycenter.instagram.com/policy/.

Legal bases: Legitimate interests (Art. 6(1)(f) GDPR).

§ 13 Plugins and Embedded Functions and Content

We integrate functional and content elements from third-party providers into our online offering. This always requires the third-party providers to process the users' IP addresses.

Cookie storage: up to 2 years. Legal bases: Consent (Art. 6(1)(a) GDPR). Legitimate interests (Art. 6(1)(f) GDPR).

§ 14 Changes and Updates

We ask you to regularly review this privacy policy. We will adapt it as soon as changes to our data processing make this necessary. We will inform you when changes require your cooperation (e.g., consent) or other individual notification.