PROMPTFORGE · LEGAL & TRUST
Privacy policy
Draft · launch review pendingUpdated 26 October 2026
1. Data processed
Account data includes email and authentication identifiers. Work data includes messages, files, projects and code. Payment data includes order and transaction information needed for reconciliation. Application logs omit prompts and code and scrub PII and secrets. The new global IP limiter uses a keyed hash rather than storing raw IP addresses in its events.
2. Purposes and controls
Data is used for authentication, requested outputs, saved work, quota accounting, payment reconciliation, transactional email and service security. Opting into “Hide sensitive information” redacts newly stored messages and drafts, while the direct session response is unchanged. Heuristic redaction can miss information; avoid unnecessary sensitive data and secrets.
3. Processors and transfers
Depending on the enabled feature and configuration, necessary data may be processed by Supabase, Google (generative AI, text-to-speech), Anthropic (Claude), Groq, OpenRouter, render/sandbox providers, Cloudflare R2 and Resend. Processing may occur outside Vietnam. Before launch, the owner must verify active processors, data regions, processing agreements and applicable transfer and assessment obligations.
4. Cookies, retention and your rights
Essential cookies maintain login sessions. Local storage holds theme, language, drafts and onboarding preferences. This slice installs no optional advertising trackers. Saved work supports continued use. Subject to applicable law, you can request access, correction, deletion, processing restrictions, consent withdrawal and complaints through support. Withdrawal may affect features. The owner must publish specific retention periods and request procedures before launch; payment records may require statutory retention.
4a. Your website inbox
When a website or online shop you exported with PromptForge sends a form or an order, PromptForge stores that content (the name, phone number, email, address and items your customer entered) on your behalf so you can read it in your Website inbox and receive email alerts. You are the controller of your customers’ data; PromptForge processes it only as you configure. Messages are deleted automatically after 365 days, or as soon as you delete them or the inbox. If you enable automatic payment confirmation, only the order code, amount and transaction reference from your SePay account are used to match orders.
5. Legal framework and incidents
This draft references Personal Data Protection Law 91/2025/QH15 and Decree 356/2025/ND-CP, effective 1 January 2026, rather than relying solely on Decree 13/2023/ND-CP. The owner must assess incidents and meet applicable notification duties. A policy page and technical safeguards alone do not establish full legal compliance.