Privacy Policy

Last updated: September 16, 2026

This Privacy Policy describes how PromptlyAgent ("we", "us", or "our") collects, uses, and protects your personal information when you use our website https://promptlyagent.ai (the "Service").

PromptlyAgent is operated as a free community platform by Thorsten Ott, a private individual based in Germany. We are committed to protecting your privacy and complying with the EU General Data Protection Regulation (GDPR).

1. Controller and Contact

Data Controller:
Thorsten Ott
Buschgasse 56
50189 Elsdorf
Germany
Email: [email protected]

2. What Information We Collect

2.1 Information You Provide

Account Registration: When you register via OAuth providers (Google, GitHub, Facebook), we receive:

Your name
Your email address
Your profile picture (optional)
OAuth provider user ID

Community Submissions: When you submit extensions or showcases, we collect:

GitHub repository URL
Project title and description
Screenshots (if uploaded)
Category and tags
Submission metadata (date, status)

2.2 Information Collected Automatically

Usage Data: We automatically collect:

IP address (anonymized in analytics)
Browser type and version
Pages visited and time spent
Submission views count
Referrer URL
Device information

Cookies: We use essential cookies for:

Session management (keeping you logged in)
Cookie consent preferences
Security (CSRF protection)

Analytics Cookies: With your consent, we use Google Analytics to understand how users interact with our Service. You can opt out via our cookie banner or browser settings.

3. Legal Basis for Processing (GDPR Art. 6)

We process your personal data based on the following legal grounds:

Consent (Art. 6(1)(a) GDPR): For analytics cookies and marketing communications
Contract Performance (Art. 6(1)(b) GDPR): To provide the Service and manage your account
Legitimate Interests (Art. 6(1)(f) GDPR): To maintain and improve the Service, prevent abuse, and ensure security
Legal Obligation (Art. 6(1)(c) GDPR): To comply with applicable laws and respond to legal requests

4. How We Use Your Information

We use your personal data to:

Provide and maintain the Service
Create and manage your account
Display your community submissions
Enable OAuth authentication
Track submission views and popularity
Communicate with you about your submissions or account
Analyze usage patterns to improve the Service
Detect and prevent abuse, spam, or security issues
Comply with legal obligations

5. Data Sharing and Third Parties

We share your data with the following third parties:

5.1 OAuth Providers

Google, GitHub, Facebook: When you use OAuth login, these providers process your authentication data according to their own privacy policies.

5.2 Analytics

Google Analytics: With your consent, we use Google Analytics for usage statistics. Google may process data in the USA. We have enabled IP anonymization and signed a Data Processing Amendment with Google.

You can opt out: Google Analytics Opt-out Browser Add-on

5.3 Hosting and Infrastructure

Our Service is hosted on servers that may be located within the EU or in countries with adequate data protection levels. We ensure appropriate safeguards are in place for any data transfers outside the EU.

We do not sell your personal data to third parties.

6. Data Retention

We retain your personal data for as long as:

Account Data: Until you delete your account
Community Submissions: Until you delete them or we remove them for policy violations
Analytics Data: 26 months (Google Analytics default for EU)
Logs and Security Data: Maximum 90 days

After these periods, data is automatically deleted or anonymized, unless we are legally required to retain it longer.

7. Your Rights Under GDPR

As an EU resident, you have the following rights:

Right of Access (Art. 15 GDPR): Request a copy of your personal data
Right to Rectification (Art. 16 GDPR): Correct inaccurate data (you can update most data in your account settings)
Right to Erasure (Art. 17 GDPR): Request deletion of your data ("right to be forgotten")
Right to Restriction (Art. 18 GDPR): Limit how we use your data
Right to Data Portability (Art. 20 GDPR): Receive your data in a machine-readable format
Right to Object (Art. 21 GDPR): Object to processing based on legitimate interests
Right to Withdraw Consent (Art. 7(3) GDPR): Withdraw consent for analytics at any time

To exercise your rights, contact us at: [email protected]

We will respond to your request within 30 days.

8. Right to Lodge a Complaint

If you believe we have not adequately addressed your privacy concerns, you have the right to lodge a complaint with the German data protection authority:

Die Bundesbeauftragte für den Datenschutz und die Informationsfreiheit (BfDI)
Graurheindorfer Str. 153
53117 Bonn
Germany
Website: www.bfdi.bund.de

You may also contact your local state data protection authority (Landesdatenschutzbehörde).

9. Data Security

We implement appropriate technical and organizational measures to protect your data:

HTTPS encryption for all data transmission
Secure password storage (hashed and salted)
Regular security updates
Access controls and authentication
CSRF protection

However, no method of transmission over the Internet is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

10. Children's Privacy

Our Service is not intended for children under 16 years of age (as per GDPR Art. 8). We do not knowingly collect personal data from children. If you are a parent or guardian and believe your child has provided us with personal data, please contact us at [email protected].

11. International Data Transfers

Your data may be transferred to and processed in countries outside the European Economic Area (EEA), including the United States (for Google Analytics and OAuth providers).

We ensure adequate protection through:

EU-US Data Privacy Framework (for Google)
Standard Contractual Clauses (SCCs)
Adequacy decisions by the European Commission

12. Cookies and Tracking

We use the following types of cookies:

Cookie Type	Purpose	Duration	Consent Required
Essential	Session, CSRF, Authentication	Session / 1 year	No (necessary)
Analytics	Google Analytics	Up to 2 years	Yes

You can manage your cookie preferences through the cookie banner that appears on your first visit, or by adjusting your browser settings.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by:

Posting the new Privacy Policy on this page
Updating the "Last updated" date
Sending you an email notification (for significant changes)

You are advised to review this Privacy Policy periodically for any changes.

14. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us:

Email: [email protected]
Mail: Thorsten Ott, Buschgasse 56, 50189 Elsdorf, Germany