What we collect
Account details: your name, email address, and password (stored only as a hash). If you sign in with Google we receive your name, email address, and profile picture from Google instead of a password.
Collaboration details: when you invite someone to a project we store the email address you enter, who invited them, and when; when you accept an invite we record which projects you can edit and, for each prompt, who sent it.
Your content: the prompts you write, files you attach, the source code generated for you, your conversations with the assistant, and your project settings.
Billing details: your plan, credit balance, and credit history. Card details are entered directly with our payment provider and never reach our servers.
Technical data: request logs containing a request identifier, account identifier, route, response status, and timing. We use these to operate and debug the service.
Why we use it, and our legal basis
To provide the service you asked for, including generating and running your apps and saving your work. Basis: performance of our contract with you.
To take payment, meter credit usage, and prevent abuse of them. Basis: performance of our contract, and our legitimate interest in protecting the service.
To keep the service secure, reliable, and free from misuse. Basis: our legitimate interest.
To meet legal obligations such as tax and accounting record-keeping. Basis: legal obligation.
We do not sell your personal data, we do not use your data to build advertising profiles, and we do not run advertising trackers.
Your content and AI processing
To generate and edit your app, your prompts and the relevant parts of your project source are sent to our model provider. We instruct providers not to use this content to train their models. We do not use your project content to train models either.
Project environment variables you enter are encrypted before storage and are never shown back to you or included in prompts.
When you turn on data for an app you build, that app gets its own separate database, sign-in service, file storage, and server functions. The accounts, records, and files its users create belong to you as the app’s operator; we host them for you, keep them isolated from every other app, and delete them when you turn the data off or delete your account.
Who processes data for us
We use a small number of processors, each under a data processing agreement, and each only for the purpose listed:
- Supabase — database, authentication, and file storage;
- Neon — the database, sign-in, file storage, and server functions for the apps you build;
- Google (Gemini API) — generating and editing your application code;
- E2B — the temporary sandbox that runs your app preview;
- Google Cloud — storage and delivery of the apps you publish;
- Stripe — subscription and payment processing;
- Resend — delivering collaborator invitation emails, only where email delivery is enabled;
- PostHog — product analytics and error reporting, measured on our servers and limited to which pages and features are used, plus the type and message of an error when something breaks.
Some of these providers process data outside your country. Where that happens we rely on the transfer safeguards those providers offer, such as standard contractual clauses.
How long we keep it
We keep your account, projects, and conversations until you delete them or close your account. Preview environments are temporary and are discarded when they expire.
An invited email address is kept with its invitation, which stops working seven days after it is sent or as soon as the project owner withdraws it. Collaborator access ends when the owner removes it or the collaborator leaves.
We keep billing and tax records for as long as the law requires. Operational logs are kept for a limited period for security and debugging.
Your rights
Depending on where you live you may have the right to access your data, correct it, delete it, restrict or object to how we use it, receive a portable copy, and withdraw consent where we rely on it.
You can download any project’s source from the builder at any time. For any other request, contact [contact@promptbuild.dev] and we will respond within the time the law allows.
You may also complain to your local data protection authority.
Cookies
We set a small number of strictly necessary cookies to keep you signed in and to protect the service. We do not use advertising or analytics cookies, so we do not show a consent banner.
We do measure how the service is used, but we do it on our servers rather than in your browser, and without storing anything on your device. Visitors who are not signed in are counted using a temporary identifier that is rebuilt each day and cannot be traced back to you. We record which page was opened, not what you typed into it.
Security
Access is scoped to your workspace and enforced in the database. Secrets are encrypted at rest, session cookies are HTTP-only, and requests are rate limited. No service can promise perfect security, so please use a strong, unique password.
Children
Prompt Build is not intended for children. We do not knowingly collect data from anyone under 16, or under the age of digital consent where that is higher.
Changes and contact
We will post any update here and, if the change is material, tell you before it takes effect.
Prompt Build, 10 Anson Road. Privacy questions and data requests: [contact@promptbuild.dev].