Privacy Policy

Who we are

PromptVault (promptvault.fun) is a platform for storing, sharing and remixing AI-music prompts, operated from the United Kingdom. For anything in this policy — questions, requests, complaints — contact support@promptvault.fun.

What we collect, and why

Account data. Your email address, display name, handle, optional bio, avatar and social links — to run your account and show your public profile. If you sign in with Google or Discord we receive your name, email and avatar from them; we never see your password for those services. Legal basis: performing our contract with you.

Your content. The songs, lyrics, prompts, comments, likes, follows and folders you create. Visibility is under your control (private, unlisted, or public) — private content is exactly that. Legal basis: contract.

Security log. Security-relevant events on your account — sign-ins, password and email changes, uploads, and moderation or billing actions — together with the IP address and browser of the request. Sign-in/out records are kept up to 180 days; other security events are kept while your account exists. Legal basis: our legitimate interest in account security and abuse prevention.

Activity days. We record which calendar days you visited (not what you did or for how long) to power your private stats page. Legal basis: legitimate interest in understanding product usage; the data is yours to export at any time.

Billing. Payments are handled by PayPal — we never see or store card numbers or bank details. We keep your subscription tier, status and billing period, and retain billing records after account deletion where accounting law requires (up to 6 years). Legal bases: contract and legal obligation.

Emails. Transactional email (verification, password resets, security notices) is necessary to run your account. The weekly digest and product-news newsletter are separate, off-by-default opt-ins with one-click unsubscribe links. Legal basis for the opt-ins: your consent, withdrawable any time in Settings.

Error reports. If something breaks, the error (which may include your account id) is sent to our EU-hosted error-tracking service so we can fix it. Legal basis: legitimate interest in keeping the service working.

Cookies

One essential cookie: your sign-in session. No advertising cookies, no third-party trackers, no consent banner needed — there's nothing to consent to.

Who processes data for us

Our infrastructure runs on a server in the EU. Some suppliers are US companies processing limited data on our behalf: PayPal (payments), UploadThing (image hosting), Resend (email delivery). Error tracking (PostHog) is EU-hosted. Where data leaves the UK/EEA, transfers rely on the suppliers' standard contractual clauses or UK–US data-bridge participation. We never sell your data or share it for advertising.

How long we keep things

Account and content data: until you delete it or your account. Sign-in records: up to 180 days. Billing records: up to 6 years (legal requirement). Backups rotate automatically — short-term copies within 14 days, long-term archives within about 13 months.

Your rights

You can exercise most rights yourself, instantly: download everything we hold about you (Settings → Your data — a zip with JSON and CSV copies), correct your details (Settings), and delete your account and content permanently (Settings → Danger zone; security-log entries are kept in anonymised form and billing records where the law requires). You can object to our legitimate-interest processing or ask anything else via support@promptvault.fun. If you're unhappy with how we handle your data, you can complain to the UK Information Commissioner's Office (ico.org.uk).

Children

PromptVault is not intended for children under 13.

Changes

If this policy changes materially we'll say so on the site (and by email for significant changes). The date at the top is always current. See also our Terms of Service and GDPR page.