Skip to content
PromtExpressPromtExpress

Privacy Policy

Last updated: October 7, 2026

1. Data controller

The data controller is Hakan Güven (sole trader, Turkey), trading as Promtexpress, operating the Service at promtexpress.com.

Contact details:
Korkutreis Mh. Lale Cd. No:17/20, Çankaya / Ankara, Türkiye
Phone: +90 537 606 52 28
Email: hello@promtexpress.com

2. Personal data we process

We process the following categories of personal data:

  • Account data: name, email address, password hash, country (when supplied at signup), authentication provider identifiers (e.g. Google ID).
  • Usage data: prompts you submit, generated prompt outputs, generation timestamps, audit logs.
  • AI provider keys: the API keys you add in Settings, stored encrypted (AES-256-GCM) together with the provider name, the model you chose, and the last four characters for display.
  • Feedback: messages you send from the Feedback page.
  • Billing data (purchases before October 2026 only): Paddle customer ID and transaction IDs. We never stored card numbers; payment data is held by Paddle. The Service no longer takes payments.
  • Technical data: IP address, browser/user-agent, device type, language preference, referrer; logged for security and troubleshooting.
  • Communications: support tickets, magic-link emails sent via our email provider.

3. Purposes and legal bases

We process personal data for the following purposes:

  • Performance of the contract — to provide the Service, authenticate users, store your AI provider keys, and deliver generated prompts.
  • Legitimate interest — to detect abuse, prevent fraud, secure infrastructure, and improve product quality.
  • Legal obligation — to keep transactional records and respond to lawful requests.
  • Consent — for optional marketing emails, where applicable, with the right to withdraw at any time.

4. Subprocessors and recipients

We share personal data only with the processors needed to operate the Service:

  • Paddle.com Market Limited — Merchant of Record for purchases made before October 2026 only (UK). No data is sent to Paddle for current use of the Service.
  • Brevo — transactional email delivery (France/EU).
  • Google LLC — OAuth sign-in (when chosen by the user) (USA/EU).
  • Cloudflare, Inc. — CDN, DDoS protection, analytics (global).
  • The AI provider you choose — OpenAI, Anthropic, Google, DeepSeek, or OpenRouter, whichever API key is active on your account — receives the prompts you submit, under your own account with that provider.
  • Hosting — server is operated in a managed colocation facility in Europe.

We do not sell personal data and we do not share it for advertising profiling.

5. Retention

We keep personal data for as long as your account is active. After account deletion, we erase or anonymise personal data within 90 days unless we are required to retain certain records for tax or legal reasons (typically up to 10 years for billing records). Audit logs are retained up to 12 months for security purposes.

6. Your rights

Subject to applicable law (KVKK, GDPR, and similar regimes), you have the right to:

  • access the personal data we hold about you;
  • request correction of inaccurate data;
  • request deletion (the "right to erasure") where legal grounds apply;
  • request restriction or object to processing;
  • request portability of data you provided;
  • withdraw consent at any time, where processing is based on consent;
  • lodge a complaint with the Turkish Personal Data Protection Authority (KVKK) or the competent supervisory authority in your jurisdiction.

To exercise any of these rights, email hello@promtexpress.com. We respond within 30 days.

7. International transfers

Some of our processors are located outside Türkiye and the EEA. We rely on appropriate safeguards — such as Standard Contractual Clauses or processor adequacy decisions — to protect international transfers. The list of recipients above identifies the relevant jurisdictions.

8. Security

We implement technical and organisational measures appropriate to the risk, including encrypted transport (TLS), encrypted storage of secrets at rest (AES-256-GCM), least-privilege access controls, and audit logging. No system is perfectly secure; if we become aware of a personal data breach affecting you, we will notify you and, where required, the supervisory authority within 72 hours.

9. Children

The Service is not directed to children under 18. We do not knowingly process personal data of minors. If you believe a minor has created an account, contact us and we will erase the account.

10. Changes to this policy

We may update this Privacy Policy. The "Last updated" date at the top of the page reflects the most recent change. Material changes will be notified by email or in-product banner.