Privacy Policy

1. Our Privacy Commitment

This Privacy Policy explains what information Ultra Prompt LLC ("we," "us," or "our") collects from users of Ultra Prompt, how we use it, who we share it with, and what choices you have. It applies to all users of ultraprompt.co and related services.

By using Ultra Prompt, you agree to the collection and use of information as described in this policy.

2. Information We Collect

Account Information

When you create an account, we collect and store the following on our authentication and database infrastructure (Supabase):

• Email address
• Password (stored as a secure hash — we never see your actual password)
• Display name (if provided)
• Account creation date and last sign-in timestamp
• Subscription tier (free, Pro Monthly, Pro Annual, Lifetime, Business Hub, or Enterprise) and Pro-status flag
• Onboarding state (whether you completed onboarding, your selected role and library categories)
• Industry selection (Business Hub users only — used to surface the right template verticals)
• Free-tier usage counter and reset month (used to enforce free-tier limits)
• Stripe customer reference (for users with paid subscriptions; we do not store payment card data)

Usage Data

To improve the product and understand how it's being used, we collect:

• Number of prompt generations (to enforce free tier limits and track usage)
• Feature usage patterns at an aggregate level via Google Analytics (which pages are visited, which templates are opened) — only if you have accepted analytics cookies via our cookie banner
• Subscription tier and billing status
• General session activity (sign-in and sign-out events, session duration)
• Feature-interaction events for the Next Move feature (which follow-up move you open, build, or copy, plus the template id and name involved), stored per-account in Supabase so we can learn which follow-ups actually help. Collected only if you have accepted analytics cookies, and never including your prompt text or anything you type

Locally Stored Data (Your Device)

Ultra Prompt is designed so that as much of your data as possible stays on your device. The following information is stored in your browser's local storage (and similar device-only storage) and is never transmitted to Ultra Prompt LLC's servers, except where explicitly noted:

Storage Key	What It Holds	Sent to Us?
Your API keys (BYOK)	API keys you enter for Anthropic, OpenAI, Google, xAI, Perplexity, Ollama, or LM Studio — used only to make calls from your browser to those providers	No
Prompt history & drafts	Prompts you've generated, unsaved drafts, and your favorites — stored locally so you can return to them	No
Favorite templates	The templates you've marked as favorites for quick access	No
Custom templates	Templates you create or import yourself	No
Onboarding choices	Your selected role, interests, and library categories	Yes (synced to your Supabase profile for sign-in continuity)
Free-tier counter	Local mirror of how many free generations you've used this month	Yes (the authoritative copy is on Supabase; this is a local cache)
Cookie consent	Your accept/decline choice for analytics cookies	No
Interface preferences	Business-Hub-vs-Personal mode, selected industry, UI state flags	Partially (industry is synced to your profile so it persists across devices)

You can clear all locally stored data at any time by clearing your browser's site data for ultraprompt.co, or by using the "Reset to Defaults" option inside the app. Clearing local storage will sign you out and remove any unsaved prompt drafts on that device.

Account & Service Communications

If you have an Ultra Prompt account, we may occasionally email you about your account and the service itself: things like confirming your email, resetting your password, important changes to features you use, billing notices, and one-to-one help if something you set up (for example, an API or MCP key) does not appear to be working. These messages come from a real person or from our verified addresses (such as founder@ultraprompt.co or support@ultraprompt.co), they are about your account rather than promotions, and we keep them rare. Marketing emails and the newsletter remain strictly opt-in and are covered separately below. If you would rather not receive even service emails beyond the strictly necessary ones (such as password resets), reply to any of them or write to support@ultraprompt.co and we will honor it.

Communications & Contact Form

If you contact us through our contact form on contact.html, the following information is sent to a Cloudflare Worker we operate (ultraprompt-contact.unpluggedfeed.workers.dev) which forwards it to our support inbox:

• Your name, email address, subject category, and message
• For enterprise inquiries: your company name, requested seat count, primary use case, and timeline

We retain support communications to respond to your inquiry and improve our service. You may request deletion of past correspondence at any time by emailing support@ultraprompt.co.

Newsletter Subscriptions

If you subscribe to our newsletter via the form on our blog, your email address is submitted directly to Kit (formerly ConvertKit), our email service provider. Kit stores your email and tracks standard email-engagement signals (whether emails are opened and links clicked) so that we can send relevant updates and so that you can unsubscribe at any time. We do not maintain a duplicate newsletter list on our own servers — the authoritative copy lives with Kit. You can unsubscribe using the link in any email or by contacting us at support@ultraprompt.co. See Kit's privacy policy at kit.com/privacy.

Technical Data

Like most web services, we may collect basic technical data through our analytics and infrastructure providers:

• Browser type and version
• Operating system
• IP address — collected by Cloudflare (our content-delivery and security layer) and, if you have accepted analytics cookies, by Google Analytics in truncated form. IP addresses are used for security, fraud prevention, and aggregate analytics — they are not linked to your account profile in our database.
• Referring URL and pages visited within the site (Google Analytics only, with consent)

Vault Content (Saved by You — Opt-In)

Ultra Prompt's Vault feature (for example, your Cookbook) lets you keep deliverables you create or import — but only when you explicitly click Save. Nothing is ever saved to your Vault automatically, in the background, or without a deliberate action by you; the prompt generator remains stateless by default. When you choose to save a Vault item, the following is stored in your private, per-user space on our database (Supabase):

• The deliverable you chose to save (for example, a recipe), as text
• A title, plus any tags, notes, or star rating you add
• For items imported from a link: the source URL you provided
• An optional photo you choose to upload (a Pro feature), stored in private, access-controlled file storage
• Standard timestamps (created, last updated, and — for items you delete — a deletion timestamp)

If you use the optional AI cleanup feature (a Pro feature that tidies a pasted or imported deliverable into a structured card), the text you submit is processed as described under "In-House AI Processing" below. You can export every Vault item, or delete individual items or all of your Vault data, at any time from within the app (see Sections 10 and 11). Deleted items are recoverable for 30 days, after which they are permanently removed.

Saved Pipelines & Playbooks

When you save a pipeline as a Playbook, its name and step configuration (the template references, settings, and connections that make up your workflow) are stored in your private, per-user space on our database so you can re-run it and reach it across your devices and through the MCP server. Playbooks hold your workflow configuration, are visible only to you, and Ultra Prompt never uses them to train AI models. Saving and accessing Playbooks is a Pro feature; see Section 10 and our Terms of Service for how Playbook retention relates to your subscription. While you build a pipeline in Power Creator, your working canvas is saved locally in your browser (so it survives a reload) until you choose to save it as a Playbook.

Agent Studio Blueprints

Agent Studio lets you design agent, skill, and persona "blueprints" and export them as paste-ready text for the platform that will run them. Blueprints you build are stored locally in your browser, not on our servers. You may export them as a .json file, import them, or create a Share Link — note that a Share Link encodes the blueprint directly in the URL, so anyone you give it to can load that blueprint. If you use the optional AI Critique feature, the blueprint text is sent to the AI provider you choose (your own connected provider, or our In-House AI — see below) to be graded. Ultra Prompt never uses your blueprints to train AI models.

In-House AI Processing

Several optional, Pro-only features — AI Refine, AI Preview, Rate My Prompt, Magic Fill, Agent Studio AI Critique, and Vault AI cleanup — can be powered by our In-House AI. Rather than sending your content to a third-party frontier model (such as those operated by OpenAI, Anthropic, or Google), our In-House AI runs an open-weights model (gpt-oss-120B) on Cloudflare's Workers AI platform under our own account. When you invoke one of these features with the "In-House" provider selected, the text you submit is sent to that service, processed to return your result, and metered against your monthly allowance. It is processed transiently — not added to your account profile, not retained after the request beyond what is necessary to operate and meter the feature, and Ultra Prompt does not use it to train AI models. Because it is an open model running on general-purpose AI infrastructure rather than a frontier model, results may be less capable than a top-tier commercial model. If you prefer a frontier model, you may select your own API key (BYOK) or a local model instead — your content is then sent to that provider (or stays on your machine) and does not pass through our In-House AI, subject to that provider's own privacy and training policies.

MCP Server & API Keys

Ultra Prompt offers an optional MCP (Model Context Protocol) server that lets you use the Ultra Prompt library and prompt-building tools from inside a compatible MCP client you choose to connect (such as Claude Desktop or Cursor). To use it, you generate an MCP key from your account; the key is stored in our database and linked to your account so we can authenticate your requests and apply your plan's limits. When your client makes a request, the tool inputs it sends (a template selection, field values, a search query) are processed by our MCP server to return a result and are processed transiently — we do not store the content of your MCP tool requests, and Ultra Prompt does not use them to train AI models. We meter the number of calls per month (the free tier is limited; Pro is unlimited) by storing a per-key call count — the count records how many calls were made, not their content. The MCP server itself does not call any AI model. The MCP client you connect is operated by you or a third party and is governed by that application's own privacy policy; we are not party to how it handles the prompts you build. You can revoke access at any time by deleting your MCP key in your account settings.

3. What We Do NOT Collect

Data Type	Collected by Us?	Why Not
API Keys (Anthropic, OpenAI, Grok, Gemini, etc.)	Not collected	Stored in your browser's local storage only. Not collected or stored by Ultra Prompt LLC. API requests pass through a Cloudflare CORS proxy that is not designed to log or retain key values.
Prompt Content (what you type or generate)	Not collected	Prompts are generated and stored locally in your browser. Ultra Prompt LLC does not collect or store prompt content. AI requests pass through a Cloudflare CORS proxy not designed to log content. Exception: content you explicitly save to a Vault is stored in your private, per-user Vault at your request (see Section 2), and text you submit to an In-House AI feature is processed transiently to return your result. Ultra Prompt never trains AI models on this content.
Payment Card Details	Not collected	All payment processing is handled by Stripe. We receive only a transaction confirmation — never your card details.
AI Model Responses	Not collected	API calls are routed through your browser and a Cloudflare CORS proxy to your AI provider. Ultra Prompt LLC does not store or log AI model responses. Exception: a deliverable you explicitly click Save on is stored in your private Vault at your request (see Section 2). Ultra Prompt never trains AI models on saved content.
Biometric Data	Never	We do not use facial recognition, fingerprinting, or any biometric systems.

4. How We Use Your Information

We use the information we collect for the following purposes:

To Provide the Service

• Create and manage your account
• Enforce free tier usage limits and subscription access
• Process payments and manage billing
• Respond to support inquiries

To Improve the Product

• Understand which features are most used and most valuable
• Identify performance issues and bugs
• Inform decisions about new features and the product roadmap

To Communicate With You

• Send transactional emails (account creation, password reset, billing receipts)
• Send product update notifications and feature announcements
• Send marketing communications (only with your consent; opt-out available at any time)

For Security & Legal Compliance

• Detect and prevent fraud, abuse, and unauthorized access
• Comply with applicable laws and legal obligations
• Enforce our Terms of Service

5. Analytics, Cookies & Local Storage

Consent-Gated Analytics

Google Analytics (Optional, Consent-Required)

If you accept analytics cookies, we use Google Analytics 4 (GA4) to understand how visitors interact with our website — including which pages are visited, how long users stay, and where traffic comes from. GA4 collects standard web analytics signals (truncated IP, page paths, referrer, screen size, anonymous client ID). You can additionally opt out of Google Analytics globally by installing the Google Analytics Opt-Out Browser Add-on.

Cookies and Similar Technologies We Use

Ultra Prompt uses the following categories of cookies and local-storage entries. Strictly-necessary entries (sign-in tokens, your stored preferences) are required for the service to function and are not consent-gated. Analytics entries are loaded only with your consent.

Category	Examples	Purpose	Consent Required?
Strictly necessary	Supabase sign-in tokens; your accept/decline choice for analytics; your selected library and onboarding state	Allow you to sign in, remember your preferences, and operate the cookie banner itself	No
Functional	Prompt history, favorites, drafts, BYOK API keys, Business-Hub mode, selected industry	Save your work locally so you can return to it	No (your own data, stored on your device)
Analytics	Google Analytics 4 (_ga, _ga_* cookies, client ID)	Understand aggregate site usage and improve the product	Yes — opt-in via cookie banner
Advertising / tracking	None	We do not run advertising, retargeting pixels, or cross-site tracking on Ultra Prompt	N/A

You can control cookies through your browser settings. Disabling strictly-necessary cookies will prevent sign-in and will reset your preferences on every visit.

Global Privacy Control (GPC) and Do Not Track

We honor the Global Privacy Control (GPC) signal as a valid request to opt out of any "sale" or "sharing" of personal information under the California Consumer Privacy Act (CCPA) and equivalent state laws, even though, as stated in Section 7, we do not sell or share personal information for cross-context behavioral advertising. We also treat browsers sending a "Do Not Track" header as having declined analytics cookies for that visit.

Email Communications

Our marketing emails may include standard tracking pixels (provided by Kit, our email service provider) that indicate whether an email was opened and whether links were clicked. This helps us understand engagement and send more relevant communications. You can opt out of all marketing emails at any time using the unsubscribe link included in every email. If you wish to opt out of email tracking only (receiving emails without open/click tracking), you may request this by contacting us at support@ultraprompt.co.

6. Third-Party Services

Ultra Prompt integrates with the following third-party services, each with their own privacy practices:

Supabase

We use Supabase for user authentication and database storage. Your account information (email, password hash, usage data) is stored in Supabase's infrastructure. Supabase is SOC 2 compliant and stores data on AWS infrastructure. Supabase Privacy Policy →

Stripe

Payments are processed by Stripe. When you subscribe to a paid plan, your payment information is entered directly into Stripe's secure form — we never receive or store your card details. Stripe is PCI DSS Level 1 compliant. Stripe Privacy Policy →

Cloudflare

We use Cloudflare for two distinct purposes. First, as our content-delivery network and security layer for ultraprompt.co — Cloudflare receives standard network-traffic data (IP addresses, user agents, request paths) for every page load to provide DDoS protection and global edge delivery. Second, we operate several Cloudflare Workers on our own account:

• A transparent CORS proxy for Anthropic (Claude) API requests. This Worker forwards your API request from your browser to Anthropic's servers and is not designed to log or store your API key or prompt content.
• A contact-form Worker at ultraprompt-contact.unpluggedfeed.workers.dev that receives submissions from our contact form (name, email, message, optional enterprise details) and forwards them to our support inbox.
• An In-House AI Worker at up-ai.unpluggedfeed.workers.dev that powers our optional Pro AI features (see "In-House AI Processing" in Section 2). It receives the text you submit for those features, forwards it to Cloudflare Workers AI to generate a result, verifies your Pro status and meters usage via Supabase, and is not designed to retain your submitted content after the request completes.
• A link-import Worker at up-fetch.unpluggedfeed.workers.dev used only when you import a link into a Vault. Because a browser cannot fetch other websites directly, this Worker retrieves the single public web page you submit, extracts the relevant content, and returns it to your browser. It processes only the specific URL you provide, at the moment you submit it, is limited to signed-in Pro users, and is not designed to retain page content after returning it.
• An MCP-server Worker at up-mcp.unpluggedfeed.workers.dev that serves the Ultra Prompt library and prompt-building tools to MCP clients you connect (see "MCP Server & API Keys" in Section 2). It authenticates your MCP key, meters call counts, and returns prompt/library content; it does not store the content of your requests and does not call any AI model.

Cloudflare may collect standard network traffic metadata under its own privacy policy. Cloudflare Privacy Policy →

Kit (formerly ConvertKit)

We use Kit as our email service provider for our newsletter and product update emails. If you subscribe via the newsletter form on our blog, your email address is submitted directly to Kit's servers and stored on Kit's infrastructure. Kit handles email delivery, subscription management, unsubscribe processing, and standard email-engagement tracking (open and click signals). Kit is a US-based company. Kit Privacy Policy →

Google Analytics

As described in Section 5, we use Google Analytics 4 to understand aggregate site usage — but only after you have accepted the analytics-cookie banner. Google processes truncated IP addresses, page paths, anonymous client IDs, and standard browser information. We do not enable Google Signals, advertising features, or cross-site identity linking. Google Privacy Policy →

AI Providers (User-Connected)

When you connect your own API keys to Ultra Prompt, your prompts are sent directly from your browser to those providers (Anthropic, OpenAI, xAI, Google, Perplexity, or local Ollama / LM Studio instances on your own machine). We are not party to those data transfers. Each provider's own privacy policy governs how they handle your prompt data. Where Ultra Prompt's Cloudflare CORS proxy is in the request path (currently for Anthropic), the proxy is designed as a transparent pass-through and is not designed to inspect or retain your keys or prompts.

Information We Receive From Third Parties

We do not purchase, license, or otherwise receive personal information about you from data brokers, advertising networks, or other third-party data sources. The only information we hold about you is what you provide directly (via account creation, the contact form, or the newsletter form) or what is collected through the consent-gated analytics described above.

7. Data Sharing & Selling

We may share your information only in the following limited circumstances:

• Service Providers (Processors): With the trusted third-party vendors listed in Section 6 (Supabase, Stripe, Cloudflare, Kit, Google Analytics) solely to the extent necessary to provide the service. These vendors are contractually limited to processing information on our behalf for the purposes we specify.
• Legal Requirements: If required by law, valid court order, subpoena, or government request, we may disclose information as legally obligated. Where permitted by law, we will notify affected users before disclosure.
• Protection of Rights: To investigate, prevent, or take action regarding suspected fraud, abuse, threats to physical safety, violations of our Terms of Service, or other illegal activity.
• Business Transfers: In the event of a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or part of our assets, your information may be transferred as part of that transaction. We will notify you before your information becomes subject to a different privacy policy, and you will have the opportunity to delete your account.
• With Your Consent: For any other purpose, only with your explicit prior consent.

No sale and no sharing for advertising. We do not disclose personal information to advertising networks, data brokers, social media platforms for retargeting, or any other party in exchange for monetary or other valuable consideration. We do not engage in profiling for automated decisions that produce legal or similarly significant effects about you.

8. International Data Transfers

Ultra Prompt LLC is based in the United States. The infrastructure we use to operate the service is also primarily located in the United States:

• Supabase (authentication and database) — your account data is stored on Amazon Web Services infrastructure located in the United States.
• Stripe (payment processing) — payment data is processed by Stripe, Inc. in the United States.
• Cloudflare (content delivery, CORS proxy, contact form) — Cloudflare operates a global edge network; static content may be cached on edge servers worldwide, while our Workers run primarily on Cloudflare's US infrastructure.
• Kit (email service) — email subscriber data is stored by Kit in the United States.
• Google Analytics (if you accept analytics) — Google may process analytics data on infrastructure in the United States and other jurisdictions.

If you access Ultra Prompt from outside the United States — including from the European Economic Area, the United Kingdom, Switzerland, Brazil, Canada, or elsewhere — your personal information will be transferred to and processed in the United States. Data protection laws in the United States may differ from, and may offer less protection than, the laws of your country of residence.

Where required by applicable law, we rely on appropriate safeguards for cross-border transfers, including (where applicable) the Standard Contractual Clauses approved by the European Commission, the UK International Data Transfer Addendum, the Swiss Federal Data Protection and Information Commissioner's approved clauses, and equivalent mechanisms recognized under the laws of other jurisdictions. By using Ultra Prompt, you acknowledge and consent to the transfer, storage, and processing of your information in the United States and any other country where our service providers operate.

Business customers requiring a Data Processing Agreement (DPA) or Standard Contractual Clauses to be executed with Ultra Prompt LLC may request one at support@ultraprompt.co.

9. Data Security & Breach Notification

We take reasonable technical and organizational measures to protect your information from unauthorized access, loss, alteration, or disclosure. These measures include:

• HTTPS / TLS encryption for all data in transit between your browser, our infrastructure, and our service providers
• Passwords stored using industry-standard hashing (handled by Supabase using bcrypt-class algorithms); plaintext passwords are never stored or transmitted in clear text
• API keys for third-party AI providers stored only in your browser's local storage on your own device — never on our servers
• Role-based access controls limiting which Ultra Prompt personnel can view production data
• Regular review of our service providers' security certifications (Supabase: SOC 2 Type II; Stripe: PCI DSS Level 1; Cloudflare: ISO 27001 / SOC 2; Google Analytics: ISO 27001 / SOC 2/3)
• Monitoring for unusual sign-in activity and rate limiting on authentication endpoints

No method of transmission over the internet or method of electronic storage is 100% secure. While we use commercially reasonable means to protect your information, we cannot guarantee absolute security.

Breach Notification

In the event of a personal data breach that creates a risk to the rights and freedoms of affected individuals, we will:

• Notify the competent supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of the breach, as required under Article 33 of the General Data Protection Regulation (GDPR) and the UK GDPR;
• Notify affected users without undue delay where the breach is likely to result in a high risk to their rights and freedoms, as required under GDPR Article 34;
• Comply with the breach-notification timelines and content requirements of applicable US state laws (which generally require notice to affected residents within 30 to 60 days of discovery and, in some cases, notice to state attorneys general or other regulators);
• Provide affected users with a description of the breach, the categories of information involved, the steps we are taking, and resources to protect themselves.

10. Data Retention

We retain your personal information for as long as your account is active or as needed to provide the service. Specifically:

• Account data is retained while your account is active and for up to 12 months after deletion to comply with legal obligations and to resolve disputes, unless a longer period is required by applicable law
• Usage data is retained for up to 24 months for analytics, security, and product improvement purposes, after which it is aggregated or deleted
• Email communications and support correspondence are retained for up to 36 months to manage your preferences and support history, or until you request deletion
• Billing records and transaction history are retained for the period required by US federal and state tax and accounting laws (generally 7 years)
• Analytics data in Google Analytics is configured with a 14-month retention period for user and event data at the property level
• Vault content you save is retained until you choose to delete it. Deleted Vault items are recoverable for 30 days, after which they are permanently removed; uploaded photos are deleted from file storage when you delete the associated item or your account
• Saved Playbooks are retained while your Pro subscription is active. Ultra Prompt is not obligated to retain or provide access to your Playbooks after your Pro subscription ends (see our Terms of Service), and we recommend exporting your own copies before any cancellation or downgrade
• Agent Studio blueprints are stored on your own device (browser local storage), not on our servers; clearing your browser data removes them, and any .json exports or Share Links you create are under your control
• Content above your plan's limits after a downgrade — for example, Vault items beyond the free-tier cap, or Playbooks after a lapse from Pro — may become read-only or inaccessible until you re-subscribe. Export of your own data remains available at any time, so nothing is ever permanently trapped

When you delete your account, we will delete or anonymize your personal information within 30 days, except where retention is required by law, where information has been aggregated and de-identified, or where retention is needed to resolve a dispute, enforce our Terms of Service, or prevent fraud.

11. Your Privacy Rights

Regardless of where you live, the following core rights are available to all Ultra Prompt users. To exercise any of these rights, contact us at support@ultraprompt.co or use the in-app "Delete My Account" option in your account settings.

Right to Access

You may request a copy of the personal information we hold about you. We will provide it in a portable, machine-readable format (such as JSON or CSV) within 30 days of verification.

Right to Correction

You may request that we correct inaccurate or incomplete information. You may also update much of this information directly in your account settings.

Right to Deletion

You may request deletion of your account and associated personal data at any time, either through the in-app "Delete My Account" option or by emailing support@ultraprompt.co. We will process deletion requests within 30 days, subject to the limited retention exceptions described in Section 10.

Right to Data Portability

You may request a machine-readable export of your account data (profile information, custom templates, prompt history that is server-side, subscription metadata).

Right to Opt Out of Marketing

You may opt out of marketing emails at any time using the unsubscribe link in any email, or by contacting us directly. Note: you cannot opt out of transactional emails (account creation confirmations, billing receipts, security alerts) while your account is active.

Right to Withdraw Consent

Where we rely on your consent (for analytics cookies, marketing communications, or other purposes), you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

Right to Non-Discrimination

We will not deny service, charge different prices, or provide a lower quality of service to you because you exercised any of your privacy rights.

How to Exercise Your Rights — Verification

To protect your information, when you submit a rights request we will verify your identity using the email address associated with your Ultra Prompt account. We may ask you to confirm the request from that email or to provide additional information sufficient to verify the request. We do not require you to create an account in order to make a rights request; users without an Ultra Prompt account may contact support@ultraprompt.co directly. You may also designate an authorized agent to submit a request on your behalf, in which case we will require written authorization from you and verification of the agent's identity, to the extent permitted by law.

Response Time

We aim to acknowledge rights requests within 2 business days and to complete them within 30 days. Where a request is complex or where we have received numerous requests, we may extend this period by up to an additional 60 days, with notice to you.

12. US State Privacy Rights

Residents of certain US states have additional rights under their state's comprehensive privacy laws. The rights below are extended to residents of every state listed, regardless of whether the law is currently in effect on the date you read this policy.

California (CCPA / CPRA)

If you are a California resident, you have the rights described in Section 11 (access, correction, deletion, portability, opt-out of marketing, non-discrimination), plus the following additional rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act:

• Right to Know. You may request that we disclose the categories of personal information we have collected about you, the categories of sources, the business or commercial purpose for collecting it, the categories of third parties with whom we share it, and the specific pieces of personal information we have collected.
• Right to Opt Out of Sale or Sharing. As stated in Section 7, we do not sell personal information and we do not share personal information for cross-context behavioral advertising. We honor the Global Privacy Control (GPC) signal as a valid opt-out request.
• Right to Limit Use and Disclosure of Sensitive Personal Information. Ultra Prompt does not collect or process Sensitive Personal Information as defined under the CPRA (which includes government identifiers, account log-in combinations, precise geolocation, racial or ethnic origin, religious beliefs, union membership, contents of mail/email/text messages not addressed to us, genetic data, biometric information, health information, and information concerning sex life or sexual orientation). Because we do not collect SPI, there is no use of SPI to limit; if this changes, we will update this policy and provide a "Limit the Use of My Sensitive Personal Information" link.
• Categories of Personal Information Collected (CCPA categories). In the 12 months preceding the date of this policy, we have collected the following categories: identifiers (email, account ID); commercial information (subscription and purchase history); internet or other network activity information (browsing within ultraprompt.co, with consent); inferences drawn for product improvement only.
• Shine the Light (Cal. Civ. Code § 1798.83). We do not share personal information with third parties for their direct-marketing purposes.

Other US States with Comprehensive Privacy Laws

If you are a resident of any of the states below, you have rights that are substantially similar to the California rights described above: the right to confirm whether we process your personal data; the right to access your personal data; the right to correct inaccuracies; the right to delete personal data; the right to obtain a portable copy; the right to opt out of targeted advertising, the sale of personal data, and profiling in furtherance of decisions that produce legal or similarly significant effects; and the right to appeal a denial of a rights request.

• Virginia — Virginia Consumer Data Protection Act (VCDPA), effective January 1, 2023
• Colorado — Colorado Privacy Act (CPA), effective July 1, 2023
• Connecticut — Connecticut Data Privacy Act (CTDPA), effective July 1, 2023
• Utah — Utah Consumer Privacy Act (UCPA), effective December 31, 2023
• Texas — Texas Data Privacy and Security Act (TDPSA), effective July 1, 2024
• Oregon — Oregon Consumer Privacy Act (OCPA), effective July 1, 2024
• Montana — Montana Consumer Data Privacy Act (MTCDPA), effective October 1, 2024
• Iowa — Iowa Consumer Data Protection Act (ICDPA), effective January 1, 2025
• Delaware — Delaware Personal Data Privacy Act (DPDPA), effective January 1, 2025
• Nebraska — Nebraska Data Privacy Act (NDPA), effective January 1, 2025
• New Hampshire — New Hampshire Privacy Act (NHPA), effective January 1, 2025
• New Jersey — New Jersey Data Privacy Act (NJDPA), effective January 15, 2025
• Tennessee — Tennessee Information Protection Act (TIPA), effective July 1, 2025
• Minnesota — Minnesota Consumer Data Privacy Act (MCDPA), effective July 31, 2025
• Maryland — Maryland Online Data Privacy Act (MODPA), effective October 1, 2025
• Indiana — Indiana Consumer Data Protection Act (INCDPA), effective January 1, 2026
• Kentucky — Kentucky Consumer Data Protection Act (KCDPA), effective January 1, 2026
• Rhode Island — Rhode Island Data Transparency and Privacy Protection Act, effective January 1, 2026

Residents of other states that enact comprehensive privacy legislation after the effective date of this policy will likewise be afforded the same rights to the extent such laws apply to Ultra Prompt LLC.

How to Exercise State-Specific Rights

To submit a rights request under any of the laws above, email us at support@ultraprompt.co with the subject line "Privacy Rights Request" and indicate (a) the state in which you reside, (b) the right you wish to exercise, and (c) the email address associated with your account. You may also designate an authorized agent to act on your behalf, subject to the verification requirements described in Section 11. If we deny your request, you have the right to appeal our decision by replying to our denial message; we will respond to appeals within 45 days. If your appeal is denied, you may also contact your state attorney general to lodge a complaint.

Health Data and Other State-Specific Rules

Ultra Prompt does not collect consumer health data as defined under the Washington My Health My Data Act, the Nevada Consumer Health Data Privacy Law, or similar state-specific health data laws. We do not infer health conditions from user behavior.

13. International Privacy Rights

European Economic Area & United Kingdom (GDPR / UK GDPR)

If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, you have the rights described in Section 11 plus additional rights under the EU General Data Protection Regulation, the UK GDPR, and the UK Data Protection Act 2018, including the right to object to processing, the right to restrict processing, the right to data portability in a structured machine-readable format, the right not to be subject to a decision based solely on automated processing that produces legal effects (we do not engage in such processing), and the right to lodge a complaint with your local data protection supervisory authority.

Legal bases for processing under Article 6 GDPR / UK GDPR:

• Contract performance (Art. 6(1)(b)): account information, authentication, subscription management, billing
• Legitimate interest (Art. 6(1)(f)): security, fraud prevention, basic service operation, and, where applicable, product improvement on the basis of de-identified or aggregated data
• Consent (Art. 6(1)(a)): analytics cookies, marketing emails, optional newsletter subscription — you may withdraw consent at any time
• Legal obligation (Art. 6(1)(c)): tax records, accounting records, responding to legitimate legal process

Controller and contact. The data controller is Ultra Prompt LLC, contactable at support@ultraprompt.co. We do not currently maintain an EU/UK Article 27 representative or a designated Data Protection Officer because we do not engage in large-scale systematic monitoring of EU/UK residents or large-scale processing of special-category data. If this changes, we will update this policy and appoint a representative as required.

Right to lodge a complaint. You have the right to lodge a complaint with your national data protection authority. In the UK, this is the Information Commissioner's Office (ico.org.uk); in EU member states, you may contact your local supervisory authority listed at edpb.europa.eu.

Brazil (LGPD)

If you are located in Brazil, you have rights under the Brazilian General Data Protection Law (Lei Geral de Proteção de Dados — Lei nº 13.709/2018, "LGPD"), including the rights to confirmation of processing, access, correction of incomplete or inaccurate data, anonymization or deletion of unnecessary data, portability, deletion of data processed with consent, information about entities with whom we share data, withdrawal of consent, and the right to lodge a complaint with the Brazilian National Data Protection Authority (ANPD). Our legal bases for processing under Article 7 LGPD mirror the GDPR bases described above. To exercise these rights, contact support@ultraprompt.co.

Canada (PIPEDA & Provincial Laws, including Quebec Law 25)

If you are located in Canada, your personal information is processed in accordance with the federal Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws (including Quebec's Law 25 / Act respecting the protection of personal information in the private sector). You have the right to access and correct your personal information, to withdraw consent, and to lodge a complaint with the Office of the Privacy Commissioner of Canada or the Commission d'accès à l'information du Québec, as applicable. Quebec residents may also designate a person to receive privacy complaints; please direct all such complaints to support@ultraprompt.co with the subject line "Quebec Privacy Officer."

Australia (Privacy Act 1988)

If you are located in Australia, the Australian Privacy Principles under the Privacy Act 1988 (Cth) apply. You may exercise your access and correction rights by contacting support@ultraprompt.co. Complaints may be lodged with the Office of the Australian Information Commissioner (oaic.gov.au).

Other Jurisdictions

If you reside in a jurisdiction with privacy laws not specifically named above and you believe Ultra Prompt LLC's processing of your information is subject to those laws, please contact support@ultraprompt.co. We will respond to legitimate rights requests to the extent applicable law requires.

14. Minors

Ultra Prompt is not directed to, and is not intended for use by, children under the age of 16. We do not knowingly collect personal information from children under 16. If you are a parent or guardian and believe your child has provided us with personal information, please contact us at support@ultraprompt.co and we will delete that information promptly.

In jurisdictions where the age threshold for parental consent is set lower (for example, the United States Children's Online Privacy Protection Act, "COPPA," sets a threshold of 13, and certain EU member states permit consent from age 13–15), Ultra Prompt nevertheless applies the higher age of 16 as a precautionary baseline.

If a minor under the age of 16 accesses Ultra Prompt by misrepresenting their age, any personal information collected as a result of that misrepresentation was obtained without our knowledge or consent. Upon discovery, we will delete any such information. Ultra Prompt LLC bears no liability for the collection of a minor's information where access was obtained through age misrepresentation. Parents and legal guardians are responsible for supervising minors' use of online services. Please refer to Section 2 of our Terms of Service for the full age misrepresentation clause.

15. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. When we make material changes, we will update the "Last Updated" date at the top of this page.

For significant changes that affect your rights or how we use your information, we will notify registered users by email at least 30 days before the changes take effect. Where applicable law requires affirmative opt-in to a material change (for example, a new processing purpose under GDPR), we will obtain that consent before the change applies to you. Your continued use of Ultra Prompt after the effective date of any changes constitutes your acceptance of the revised policy.

An archived copy of prior versions of this policy is available on request at support@ultraprompt.co.

16. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or how we handle your data, please reach out:

• Email: support@ultraprompt.co
• Company: Ultra Prompt LLC
• Registered Agent: Northwest Registered Agent, Monroe County, Illinois
• Website: ultraprompt.co
• Privacy Rights Requests: Use the in-app "Delete My Account" option for deletion, or email support@ultraprompt.co with the subject line "Privacy Rights Request" for all other requests.

We aim to acknowledge all privacy inquiries within 5 business days. For data deletion requests, we will confirm receipt within 2 business days and complete the request within 30 days, subject to the verification process described in Section 11 and the limited retention exceptions in Section 10.