Privacy Policy

This Privacy Policy ("Policy") describes how Prompted, together with its affiliates, subsidiaries, successors, and assigns ("Prompted," "we," "us," or "our"), collects, uses, discloses, retains, transfers, and otherwise processes information in connection with our websites, mobile applications, APIs, content, products, and services (collectively, the "Service"). This Policy also explains the choices and rights you may have regarding your information.

By accessing or using the Service, creating an account, completing a purchase, or otherwise interacting with us, you acknowledge that you have read, understood, and agree to the practices described in this Policy and to our Terms of Service. If you do not agree, you must not access or use the Service.

This Policy is incorporated into and forms part of our Terms of Service. Capitalized terms not defined here have the meaning given in the Terms of Service. Nothing in this Policy is intended to create rights enforceable by any third party except as expressly required by applicable law.

1. Scope and Applicability

This Policy applies to information we process as a controller (or equivalent role) in connection with the Service. It does not apply to information processed by third parties whose products, websites, applications, or services may be linked to or referenced by the Service, or to information processed by us solely on behalf of our business customers under a separate agreement, in which case our role may be that of a processor or service provider.

The Service is intended for users located in jurisdictions where it is lawful to provide such services. We make no representation that the Service is appropriate or available for use in any particular location, and access from territories where such use is illegal is prohibited.

2. Information We Collect

We collect information (a) you provide directly, (b) collected automatically when you use the Service, and (c) received from third parties. The categories below are illustrative and may change as the Service evolves.

2.1 Information You Provide

• Account information: name, email address, password or authentication identifiers, profile details, and preferences.
• Profile and learning data: responses, prompts, submissions, scores, projects, certificates, and other content you create or upload.
• Payment information: billing name, address, and partial payment instrument details. Full payment card numbers are processed by our payment processors and are not stored on our servers.
• Communications: messages you send to support, contact forms, surveys, reviews, and newsletter signups.
• Affiliate information: application details, payout information, and tax forms if you participate in our affiliate program.

2.2 Information Collected Automatically

• Usage data: pages viewed, features used, lessons completed, clicks, sessions, referring URLs, and similar interactions.
• Device and connection data: IP address, device identifiers, browser type, operating system, language, time zone, and approximate location derived from IP.
• Cookies and similar technologies: see Section 5.
• Logs and diagnostics: error reports, performance metrics, and security event logs.

2.3 Information From Third Parties

• Identity providers and single sign-on services (when you choose to sign in via a third party).
• Payment processors, fraud-prevention vendors, and analytics providers.
• Affiliate, advertising, and marketing partners.
• Public sources and service providers that help us maintain accurate records.

We do not knowingly collect special categories of personal data (such as health, biometric, or precise geolocation data) and ask that you do not submit such information through the Service.

3. How We Use Information

We use information for the purposes described below and for any other purpose disclosed at the time of collection or with your consent:

• Provide, operate, maintain, and improve the Service.
• Create and manage your account, authenticate users, and personalize content.
• Process transactions, manage subscriptions, and administer affiliate payouts.
• Communicate with you about the Service, including transactional messages, security notices, and customer support.
• Send marketing and promotional communications consistent with your choices.
• Develop new features, conduct research, and perform analytics.
• Detect, investigate, and prevent fraud, abuse, security incidents, and violations of our policies.
• Comply with applicable laws, regulations, court orders, and lawful requests.
• Establish, exercise, or defend legal claims and enforce our agreements.
• Train, evaluate, and improve our internal models, features, and quality assurance, in accordance with this Policy and applicable law.

4. Legal Bases for Processing (EEA, UK, and Similar Jurisdictions)

Where the EU General Data Protection Regulation, UK GDPR, or similar laws apply, we process personal data on the following legal bases: (a) performance of a contract; (b) compliance with legal obligations; (c) our legitimate interests, such as operating, securing, and improving the Service, provided those interests are not overridden by your rights; (d) your consent, where required (which you may withdraw at any time without affecting prior processing); and (e) protection of vital interests or public interest, in limited circumstances.

5. Cookies and Similar Technologies

We and our service providers use cookies, pixels, SDKs, local storage, and similar technologies ("Cookies") to operate the Service, remember your preferences, authenticate sessions, measure usage, support affiliate referrals, and deliver relevant content and advertising. Cookies may be first-party or third-party and may persist beyond a single session.

You may control Cookies through your browser or device settings, and where required by law, through an in-product consent tool. Disabling Cookies may degrade or disable certain features. We respond to Global Privacy Control ("GPC") signals where required by applicable law and treat them, where applicable, as opt-out preference signals for cross-context behavioral advertising or sale/sharing of personal information.

6. How We Share Information

We do not sell personal information for monetary consideration. We may share information in the following circumstances:

• Service providers: vendors that help us operate the Service (hosting, storage, email, analytics, customer support, payment processing, fraud detection, AI infrastructure) under contractual obligations of confidentiality and data protection.
• Affiliates and partners: where you engage with referral, affiliate, or co-marketing programs.
• Business transfers: in connection with a merger, acquisition, financing, reorganization, bankruptcy, receivership, sale of assets, or transition of service to another provider, subject to standard confidentiality protections.
• Legal and safety: to comply with applicable law, regulation, legal process, or governmental request; to enforce our terms; to protect the rights, property, safety, or security of Prompted, our users, or others; and to detect or prevent fraud, abuse, or security incidents.
• With your direction or consent: including when you choose to share content publicly or with integrations you authorize.
• Aggregated or de-identified data: we may share information that has been aggregated or de-identified in a manner that cannot reasonably be used to identify you.

Some sharing of online identifiers and usage data with advertising or analytics partners may constitute a "sale" or "sharing" under certain U.S. state laws. Where applicable, you can exercise your opt-out rights as described in Section 11.

7. International Data Transfers

We operate globally and may transfer, store, and process your information in countries other than the country in which you reside, including the United States. These countries may have data-protection laws that differ from those in your jurisdiction. Where required, we use appropriate safeguards, such as Standard Contractual Clauses, the UK International Data Transfer Addendum, adequacy decisions, or other lawful transfer mechanisms. By using the Service, you acknowledge such transfers.

8. Data Retention

We retain personal information for as long as is necessary to fulfill the purposes described in this Policy, including providing the Service, complying with legal, accounting, tax, or reporting obligations, resolving disputes, and enforcing our agreements. Retention periods are determined based on the nature of the information, the purposes for which it is processed, and applicable legal requirements. When information is no longer required, we delete or anonymize it in a commercially reasonable manner.

9. Security

We implement reasonable administrative, technical, and physical safeguards designed to protect personal information against loss, unauthorized access, disclosure, alteration, and destruction. However, no system is completely secure. To the maximum extent permitted by law, we make no warranty, express or implied, regarding the security of the Service, and you use the Service at your own risk. You are responsible for safeguarding your credentials and for any activity occurring under your account.

10. Your Rights and Choices

Depending on your jurisdiction, you may have rights with respect to your personal information, including the rights to: access; correct; delete; restrict or object to certain processing; receive a copy of your information in a portable format; opt out of targeted advertising, sale, or sharing of personal information; opt out of certain automated decision-making, including profiling that produces legal or similarly significant effects; and withdraw consent.

You may exercise these rights by contacting us through our contact page or account settings. We may need to verify your identity before fulfilling your request and may decline requests as permitted by law. You will not be discriminated against for exercising your rights. If we are unable to satisfy your request, you may have the right to appeal or lodge a complaint with a supervisory authority in your jurisdiction.

11. U.S. State Privacy Disclosures

This section provides additional disclosures for residents of California and other U.S. states with comprehensive privacy laws (including but not limited to Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and Delaware). Categories of personal information collected and disclosed may include: identifiers; customer records; commercial information; internet or other electronic network activity; geolocation (general); professional or employment information (where you provide it); inferences drawn from the foregoing; and audio or visual content (where you submit it). These categories are collected and disclosed for the business purposes described in this Policy.

California residents have rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA/CPRA"), including the right to know, delete, correct, opt out of "sale" or "sharing," limit the use of sensitive personal information, and to be free from discrimination for exercising privacy rights. We do not knowingly sell or share for cross-context behavioral advertising the personal information of consumers under 16 without affirmative authorization. You may submit a request through our contact page. An authorized agent may submit a request on your behalf with appropriate proof of authorization.

Where required, we honor opt-out preference signals such as Global Privacy Control. Residents of other U.S. states have analogous rights as set forth in their state laws and may exercise those rights using the same contact methods.

12. Marketing Communications

We may send marketing communications consistent with your preferences and applicable law, including the U.S. CAN-SPAM Act, Canada's CASL, and the EU ePrivacy Directive. You may opt out at any time by following the unsubscribe instructions in our messages or by adjusting your account preferences. We may continue to send transactional or service-related messages, including security alerts, billing notices, and policy updates.

13. Automated Decision-Making and AI

Certain features of the Service use machine learning, large language models, and other automated technologies to generate content, provide feedback, score submissions, recommend lessons, or detect abuse. These features may rely on inputs you provide together with model outputs. We do not use such automated processing to make decisions that produce legal or similarly significant effects on you without appropriate safeguards or, where required, your consent. AI-generated outputs may be inaccurate or incomplete; you should independently evaluate any output before relying on it for any purpose.

14. Children's Privacy

The Service is not directed to children under the age of 13, and we do not knowingly collect personal information from children under 13 in violation of the U.S. Children's Online Privacy Protection Act ("COPPA"). If you are a parent or guardian and believe a child under 13 has provided us with personal information, please contact us so we can delete it. In some jurisdictions, the minimum age may be higher (for example, 16 under EU GDPR for certain processing activities), and we comply with applicable local requirements.

15. Third-Party Services and Links

The Service may contain links to, or interoperate with, third-party websites, applications, or services. We are not responsible for the privacy practices, security, content, or accuracy of any third party. Inclusion of links or integrations does not imply endorsement. Your use of any third-party service is subject to that third party's own terms and privacy policies, which we encourage you to review.

16. Do Not Track

Some browsers offer a "Do Not Track" ("DNT") signal. Because no common industry or legal standard for DNT has been adopted, we currently do not respond to DNT signals. We do, however, respond to legally recognized opt-out preference signals such as GPC where required.

17. Notice of Data Breach

In the event of a data security incident affecting your personal information, we will provide notice to affected individuals and applicable authorities as required by, and within the timeframes set by, applicable law. We may delay notification as necessary to address legitimate law-enforcement needs or to take measures to determine the scope of the incident and restore the integrity of our systems.

18. No Warranties; Limitation of Liability

EXCEPT WHERE PROHIBITED BY LAW, AND WITHOUT LIMITING ANY WARRANTIES OR LIMITATIONS SET FORTH IN OUR TERMS OF SERVICE, WE PROVIDE THE SERVICE AND THIS POLICY ON AN "AS IS" AND "AS AVAILABLE" BASIS. TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, PROMPTED AND ITS AFFILIATES, OFFICERS, DIRECTORS, EMPLOYEES, AGENTS, AND LICENSORS DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT, AND SHALL NOT BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY, OR PUNITIVE DAMAGES ARISING FROM OR RELATED TO YOUR USE OF, OR INABILITY TO USE, THE SERVICE OR ANY PROCESSING OF YOUR INFORMATION DESCRIBED IN THIS POLICY. SOME JURISDICTIONS DO NOT ALLOW THE EXCLUSION OF CERTAIN WARRANTIES OR THE LIMITATION OF CERTAIN DAMAGES, SO SOME OF THESE EXCLUSIONS OR LIMITATIONS MAY NOT APPLY TO YOU.

19. Indemnification

To the fullest extent permitted by law, you agree to indemnify, defend, and hold harmless Prompted and its affiliates, officers, directors, employees, agents, and licensors from and against any claims, liabilities, damages, losses, costs, or expenses (including reasonable attorneys' fees) arising out of or related to: (a) your violation of this Policy or our Terms of Service; (b) your violation of any law or the rights of any third party; or (c) information you submit to the Service.

20. Governing Law; Dispute Resolution

Except where prohibited by applicable law, this Policy and any disputes arising from or relating to it are governed by the laws of the jurisdiction set forth in our Terms of Service, without regard to conflict-of-law principles. Any disputes shall be resolved as set forth in our Terms of Service, including any binding arbitration, class-action waiver, jury-trial waiver, and forum-selection provisions, to the extent permitted by law. If our Terms of Service do not include dispute-resolution provisions, the courts of competent jurisdiction in the location of our principal place of business shall have exclusive jurisdiction.

21. Changes to This Policy

We may update this Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. When we make material changes, we will provide notice as required by applicable law, such as by posting the updated Policy on this page and updating the "Effective date" above. Your continued use of the Service after the effective date of any changes constitutes your acceptance of the revised Policy.

22. Severability; No Waiver

If any provision of this Policy is held to be invalid, unlawful, or unenforceable, that provision shall be enforced to the maximum extent permissible and the remaining provisions shall remain in full force and effect. Our failure to enforce any right or provision of this Policy shall not be deemed a waiver of such right or provision.

23. Language

This Policy is provided in English. Any translation is provided for your convenience only. In the event of any inconsistency between the English version and a translation, the English version shall control to the extent permitted by law.

24. Contact Us

If you have questions about this Policy or our privacy practices, or if you would like to exercise your rights, please contact us through our contact page. If you are located in the EEA or UK, you may also have the right to lodge a complaint with your local supervisory authority.