Privacy Policy

Effective date: December 19, 2025

This Privacy Policy explains how Data Prompt Ltd ("we", "us", "our") collects and uses personal data when you visit our website or use our services. It is intended to meet our transparency obligations under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations 2003 (PECR).

1. Who we are (controller)

Controller: Data Prompt Ltd
Address: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom
Email: [email protected]

2. Personal data we collect

We may collect and process the following categories of personal data:

• Account and contact data: name, email address, company, billing/contact details you provide.
• Support and communications: messages you send to us, including support requests and feedback.
• Usage and technical data: information about how you use the service (e.g., feature usage, timestamps), device and browser information, IP address, and log data.
• Billing data: subscription status, invoices, and payment-related metadata (payment card details are processed by our payment processor, not stored by us).
• Website analytics data: information collected via cookies or similar technologies (see Cookies section below).

3. How we use your data and our lawful bases

We use personal data for the purposes below, relying on the lawful bases in Article 6 UK GDPR:

• Provide and operate the service (including authentication, delivering features, and account management) — contract.
• Customer support and responding to requests — contract and/or legitimate interests (supporting customers and improving service quality).
• Billing and payments (subscriptions, invoicing, fraud prevention) — contract and legal obligation.
• Security and misuse prevention (monitoring, logging, investigating suspicious activity) — legitimate interests and, where applicable, legal obligation.
• Service improvement (debugging, performance, product analytics) — legitimate interests.
• Marketing communications — consent where required under PECR (and you can opt out at any time).

4. AI training

We do not use your data to train our models. We may process data to provide the service and to maintain security, reliability, and support.

5. Sharing your data

We may share personal data with:

• Service providers (processors): hosting/infrastructure, analytics, customer support tools, and email providers acting on our instructions.
• Payment processors: to process payments and manage subscriptions.
• Professional advisers: legal, accounting, and insurance where necessary.
• Authorities: where we are required to do so by law or to protect our rights.

We require processors to protect personal data and only process it for specified purposes.

6. International transfers

Some of our service providers may process personal data outside the UK. When personal data is transferred internationally, we use appropriate safeguards such as the UK International Data Transfer Agreement (IDTA), the UK Addendum to the EU Standard Contractual Clauses, and/or adequacy regulations, as applicable.

7. Data retention

We keep personal data only for as long as necessary for the purposes described in this policy. Retention periods depend on the type of data and why we hold it. For example, we may retain billing records to meet legal and tax obligations. We also retain certain logs for security and troubleshooting for a limited period.

8. Security

We implement appropriate technical and organisational measures designed to protect personal data. However, no system is completely secure and you should take care to protect your account credentials.

9. Your rights (UK GDPR)

You have rights in relation to your personal data, including:

• Right of access
• Right to rectification
• Right to erasure
• Right to restrict processing
• Right to data portability
• Right to object (including to direct marketing)
• Right to withdraw consent (where we rely on consent)

To exercise your rights, contact us at [email protected]. We may need to verify your identity before responding.

10. Cookies and analytics (PECR)

We use cookies and similar technologies to operate the site and understand usage. Where required, we will ask for your consent before placing non-essential cookies. You can control cookies through your browser settings and (where provided) our cookie preferences.

11. Children

Our services are not directed to children and we do not knowingly collect personal data from children.

12. Changes to this policy

We may update this policy from time to time. If we make material changes, we will take reasonable steps to notify you (for example, by posting an updated version on this page).

13. Complaints

If you have a concern about how we handle your personal data, please contact us first at [email protected]. You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO):https://ico.org.uk/make-a-complaint/.