Privacy Policy

Last updated: June 8, 2026

This policy explains what personal data Prompt Panel processes, for what purpose, on what legal basis, and what rights you have under the GDPR (EU Regulation 2016/679).

1. Data controller

The controller of your data is Simplimo Artur Dąbrowski, ul. prof. Bronisława Geremka 27/33, 30-389 Kraków, Polska, NIP: 6762312764. For any data protection matters, contact contact@promptpanel.ai.

2. What data we process

Account data: your email address and your password stored as an irreversible hash. We never store your password in plain text.

Content you create: projects, prompts, snippets, and their version history.

Access request (early access): your email address and, optionally, your name, company, role, and a short note about your intended use.

Technical data: essential logs, session information, and anonymized, aggregated traffic statistics (no profiling).

3. Purposes and legal bases

Providing the service (creating and operating your account, storing content) — Art. 6(1)(b) GDPR (performance of a contract).

Handling your access request and sending an invitation — Art. 6(1)(b) GDPR (steps prior to entering a contract).

Transactional emails (verification, password reset, invitation) — Art. 6(1)(b) GDPR.

Security, abuse prevention, maintenance, and traffic statistics — Art. 6(1)(f) GDPR (legitimate interest).

4. Recipients and processors

Hosting and database: Railway.

Transactional email delivery: SendGrid (Twilio).

Content delivery, security, and cookieless analytics: Cloudflare.

These parties process data solely on our behalf under data processing agreements.

5. International transfers

Some providers (including Railway, SendGrid, and Cloudflare) may process data outside the European Economic Area, including in the USA.

Such transfers rely on safeguards required by the GDPR — primarily the Standard Contractual Clauses (SCC) approved by the European Commission.

6. Retention

We keep your account data and content for as long as your account exists. After deletion, data is removed, subject to short periods arising from backups and legal obligations.

Access request data is kept until the request is handled, then for a reasonable period to maintain a record of invitations.

7. Security

Connections to the app are encrypted (HTTPS). Passwords are stored only as a salted hash (PBKDF2), and sessions are cryptographically signed.

We apply least-privilege access to data. No system is fully secure, however — we recommend using a strong, unique password.

8. Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability, and to object to processing based on legitimate interest.

You also have the right to lodge a complaint with your data protection authority (in Poland: PUODO).

To exercise your rights, write to contact@promptpanel.ai.

9. Children

The service is not directed to anyone under 16, and we do not knowingly collect their data. If you believe we have, please contact us.

10. Cookies

We use essential cookies only, and our analytics is cookieless. See the Cookie Policy for details.

11. Changes to this policy

We may update this policy. We will notify you of material changes, and the current version is indicated by the date at the top of the page.