Privacy Policy

1. Our Privacy Commitment

This Privacy Policy explains what information Ultra Prompt LLC ("we," "us," or "our") collects from users of Ultra Prompt, how we use it, who we share it with, and what choices you have. It applies to all users of ultraprompt.co and related services.

By using Ultra Prompt, you agree to the collection and use of information as described in this policy.

2. Information We Collect

Account Information

When you create an account, we collect and store the following on our authentication and database infrastructure (Supabase):

• Email address
• Password (stored as a secure hash, we never see your actual password)
• Display name (if provided)
• Account creation date and last sign-in timestamp
• Subscription tier (free, Pro Monthly, Pro Annual, Lifetime, Business Hub, or Enterprise) and Pro-status flag
• Onboarding state (whether you completed onboarding, your selected role and library categories)
• Industry selection (Business Hub users only, used to surface the right template verticals)
• Free-tier usage counter and reset month (used to enforce free-tier limits)
• Stripe customer reference (for users with paid subscriptions; we do not store payment card data)

Usage Data

To improve the product and understand how it's being used, we collect:

• Number of prompt generations (to enforce free tier limits and track usage)
• Feature usage patterns at an aggregate level via Google Analytics (which pages are visited, which templates are opened), only if you have accepted analytics cookies via our cookie banner
• Subscription tier and billing status
• General session activity (sign-in and sign-out events, session duration)
• Feature-interaction events for the Next Move feature (which follow-up move you open, build, or copy, plus the template id and name involved), stored per-account in Supabase so we can learn which follow-ups actually help. Collected only if you have accepted analytics cookies, and never including your prompt text or anything you type

Locally Stored Data (Your Device)

Ultra Prompt is designed so that as much of your data as possible stays on your device. The following information is stored in your browser's local storage (and similar device-only storage) and is never transmitted to Ultra Prompt LLC's servers, except where explicitly noted:

Storage Key	What It Holds	Sent to Us?
Your API keys (BYOK)	API keys you enter for Anthropic, OpenAI, Google, xAI, Perplexity, Ollama, or LM Studio, used only to make calls from your browser to those providers	No
Prompt history & drafts	Prompts you've generated, unsaved drafts, and your favorites, stored locally so you can return to them	No
Favorite templates	The templates you've marked as favorites for quick access	No
Custom templates	Templates you create or import yourself	No
Onboarding choices	Your selected role, interests, and library categories	Yes (synced to your Supabase profile for sign-in continuity)
Free-tier counter	Local mirror of how many free generations you've used this month	Yes (the authoritative copy is on Supabase; this is a local cache)
Cookie consent	Your accept/decline choice for analytics cookies	No
Interface preferences	Business-Hub-vs-Personal mode, selected industry, UI state flags	Partially (industry is synced to your profile so it persists across devices)

You can clear all locally stored data at any time by clearing your browser's site data for ultraprompt.co, or by using the "Reset to Defaults" option inside the app. Clearing local storage will sign you out and remove any unsaved prompt drafts on that device.

Account & Service Communications

If you have an Ultra Prompt account, we may occasionally email you about your account and the service itself: things like confirming your email, resetting your password, important changes to features you use, billing notices, and one-to-one help if something you set up (for example, an API or MCP key) does not appear to be working. These messages come from a real person or from our verified addresses (such as founder@ultraprompt.co or support@ultraprompt.co), they are about your account rather than promotions, and we keep them rare. Marketing emails and the newsletter remain strictly opt-in and are covered separately below. If you would rather not receive even service emails beyond the strictly necessary ones (such as password resets), reply to any of them or write to support@ultraprompt.co and we will honor it.

Communications & Contact Form

If you contact us through our contact form on contact.html, the following information is sent to a Cloudflare Worker we operate (ultraprompt-contact.unpluggedfeed.workers.dev) which forwards it to our support inbox:

• Your name, email address, subject category, and message
• For enterprise inquiries: your company name, requested seat count, primary use case, and timeline

We retain support communications to respond to your inquiry and improve our service. You may request deletion of past correspondence at any time by emailing support@ultraprompt.co.

Newsletter Subscriptions

You can subscribe to our newsletter in four places: the form on our blog, the footer and mid-page forms on our landing page, and the optional email step in the Showroom demo (see "The Showroom" below). In each case your email address is submitted to Kit (formerly ConvertKit), our email service provider, which stores your email and tracks standard email-engagement signals (whether emails are opened and links clicked) so that we can send relevant updates and so that you can unsubscribe at any time. The authoritative newsletter list lives with Kit. One exception: when you provide your email in the Showroom, we also record it in our own database along with which demo you were using, so we can operate the demo experience and understand which demos people value; you can request deletion of that record at any time at support@ultraprompt.co, and unsubscribing from the newsletter is always available via the link in any email. See Kit's privacy policy at kit.com/privacy.

Technical Data

Like most web services, we may collect basic technical data through our analytics and infrastructure providers:

• Browser type and version
• Operating system
• IP address, collected by Cloudflare (our content-delivery and security layer) and, if you have accepted analytics cookies, by Google Analytics in truncated form. IP addresses are used for security, fraud prevention, and aggregate analytics, they are not linked to your account profile in our database.
• Referring URL and pages visited within the site (Google Analytics only, with consent)

Diagnostics & Error Reports

To find and fix bugs we cannot reproduce ourselves, especially on mobile browsers, our pages include an automatic error reporter. If a page hits an unexpected JavaScript error, a report is sent to a Cloudflare Worker we operate and forwarded to our support inbox. A report contains: the error message and technical stack trace, the address of the page where it happened, your browser and operating-system identifier, your viewport size, the time, and, if you are signed in, your account email and user ID so we can follow up if the bug broke something for you specifically. Error reports never include your prompt text, Vault content, or anything you typed into a form, except to the extent a page address happens to reflect app state. This reporting is operational (it exists to keep the service working) and is not used for analytics, advertising, or profiling; reports are filtered to drop noise, are retained like support correspondence (see Section 10), and you can ask us to delete reports associated with your account at any time at support@ultraprompt.co.

Vault Content (Saved by You: Opt-In)

Ultra Prompt's Vault feature (for example, your Cookbook) lets you keep deliverables you create or import, but only when you explicitly click Save. Nothing is ever saved to your Vault automatically, in the background, or without a deliberate action by you; the prompt generator remains stateless by default. When you choose to save a Vault item, the following is stored in your private, per-user space on our database (Supabase):

• The deliverable you chose to save (for example, a recipe), as text
• A title, plus any tags, notes, or star rating you add
• For items imported from a link: the source URL you provided
• An optional photo you choose to upload (a Pro feature), stored in private, access-controlled file storage
• Standard timestamps (created, last updated, and, for items you delete, a deletion timestamp)

If you use the optional AI cleanup feature (a Pro feature that tidies a pasted or imported deliverable into a structured card), the text you submit is processed as described under "In-House AI Processing" below. You can export every Vault item, or delete individual items or all of your Vault data, at any time from within the app (see Sections 10 and 11). Deleted items are recoverable for 30 days, after which they are permanently removed.

Saved Pipelines & Playbooks

When you save a pipeline as a Playbook, its name and step configuration (the template references, settings, and connections that make up your workflow) are stored in your private, per-user space on our database so you can re-run it and reach it across your devices and through the MCP server. Playbooks hold your workflow configuration, are visible only to you, and Ultra Prompt never uses them to train AI models. Saving and accessing Playbooks is a Pro feature; see Section 10 and our Terms of Service for how Playbook retention relates to your subscription. While you build a pipeline in Power Creator, your working canvas is saved locally in your browser (so it survives a reload) until you choose to save it as a Playbook.

Agent Studio Blueprints

Agent Studio lets you design agent, skill, and persona "blueprints" and export them as paste-ready text for the platform that will run them. Blueprints you build are stored locally in your browser, not on our servers. You may export them as a .json file, import them, or create a Share Link: note that a Share Link encodes the blueprint directly in the URL, so anyone you give it to can load that blueprint. If you use the optional AI Critique feature, the blueprint text is sent to the AI provider you choose (your own connected provider, or our In-House AI, see below) to be graded. Ultra Prompt never uses your blueprints to train AI models.

My Stuff (Your Saved Facts: Opt-In)

My Stuff is an optional personal-facts layer: short facts you choose to save (for example, your ZIP code, garden zone, household setup, food limits, or the make of your truck) so templates can be pre-filled with them. Everything in My Stuff is entered or confirmed by you, nothing is inferred or captured without an explicit action. My Stuff is stored in your browser's local storage and, so it can follow you across devices, synced to your private profile row in our database, with two deliberate exceptions: food limits (such as allergies) are kept on your device only and are never synced to our servers, and the feature is designed so that people's names stay out of what templates request. My Stuff is protected by the same Row-Level Security as the rest of your profile, is never read for analytics or advertising, and is never used to train AI models. If you use Magic Fill with the In-House AI, your saved facts are included with that request so the fill can use them (processed transiently, like the rest of the request). You can view, edit, or clear any shelf of My Stuff at any time in the app or your account portal, and deleting your account removes it.

Business Hub Organization Data

If you belong to a Business Hub organization, we process a small amount of organization data to operate it: the organization's name, industry, seat count and billing state (via Stripe); each member's email, role, and an optional label entered by the organization's owner or admin; organization templates created by its admins; and any brand names the organization saves for autofill. Member information is provided to us by the organization (typically your employer), which is responsible for having the right to share it. When a seat is deactivated, business content associated with it may be retained in a dormant state for the organization; when an organization's subscription ends, its members' accounts revert to the free tier. Organization admins can see seat and membership information, but cannot read your personal (non-organization) content: your Vault, My Stuff, prompt history, and personal templates remain yours alone.

In-House AI Processing

Several optional features, AI Refine, AI Preview, Rate My Prompt, Magic Fill, Send to AI, Agent Studio AI Critique, and Vault AI cleanup, can be powered by our In-House AI. These are primarily paid-plan features metered as a monthly allowance of AI credits; signed-in free users may also receive a small introductory allowance where offered. If you use Magic Fill with In-House AI selected, the facts you have saved in My Stuff (see "My Stuff" above) are included with the request so the fill can use them, that is the feature working as designed, and those facts are processed transiently like the rest of the request. Rather than sending your content to a third-party frontier model (such as those operated by OpenAI, Anthropic, or Google), our In-House AI runs an open-weights model (gpt-oss-120B) on Cloudflare's Workers AI platform under our own account. When you invoke one of these features with the "In-House" provider selected, the text you submit is sent to that service, processed to return your result, and metered against your monthly allowance. It is processed transiently, not added to your account profile, not retained after the request beyond what is necessary to operate and meter the feature, and Ultra Prompt does not use it to train AI models. Because it is an open model running on general-purpose AI infrastructure rather than a frontier model, results may be less capable than a top-tier commercial model. If you prefer a frontier model, you may select your own API key (BYOK) or a local model instead, your content is then sent to that provider (or stays on your machine) and does not pass through our In-House AI, subject to that provider's own privacy and training policies.

MCP Server & API Keys

Ultra Prompt offers an optional MCP (Model Context Protocol) server that lets you use the Ultra Prompt library and prompt-building tools from inside a compatible MCP client you choose to connect (such as Claude Desktop or Cursor). To use it, you generate an MCP key from your account; the key is stored in our database and linked to your account so we can authenticate your requests and apply your plan's limits. When your client makes a request, the tool inputs it sends (a template selection, field values, a search query) are processed by our MCP server to return a result and are processed transiently: we do not store the content of your MCP tool requests, and Ultra Prompt does not use them to train AI models. We meter the number of calls per month (the free tier is limited; Pro is unlimited) by storing a per-key call count, the count records how many calls were made, not their content. The MCP server itself does not call any AI model. The MCP client you connect is operated by you or a third party and is governed by that application's own privacy policy; we are not party to how it handles the prompts you build. You can revoke access at any time by deleting your MCP key in your account settings.

The Showroom (Public Demo)

Our public demo pages (the "Showroom," at /try) let you talk to demonstration agents we host, without an account. Here is exactly what is processed when you do: the messages you type are sent to our demo server and processed by an AI model to produce the reply, conversation content is not stored; we keep only operational counters (session and message counts, rate-limit state) to run the demo and prevent abuse, which include your IP address held briefly (roughly 48 hours) for rate-limiting. Do not enter passwords, financial details, health information, or other people's personal information in a demo, it is a public demonstration, not a secure channel. If you choose to enter your email to continue a session, it is recorded in our database with the demo you were using and subscribed to our newsletter via Kit, as described under "Newsletter Subscriptions" above; providing it is optional, and you can unsubscribe or request deletion at any time. Demo pages also carry the automatic error reporter described under "Diagnostics & Error Reports."

3. What We Do NOT Collect

Data Type	Collected by Us?	Why Not
API Keys (Anthropic, OpenAI, Grok, Gemini, etc.)	Not collected	Stored in your browser's local storage only. Not collected or stored by Ultra Prompt LLC. API requests pass through a Cloudflare CORS proxy that is not designed to log or retain key values.
Prompt Content (what you type or generate)	Not collected	Prompts are generated and stored locally in your browser. Ultra Prompt LLC does not collect or store prompt content. AI requests pass through a Cloudflare CORS proxy not designed to log content. Exceptions: content you explicitly save to a Vault is stored in your private, per-user Vault at your request (see Section 2); text you submit to an In-House AI feature, a Showroom demo, or an MCP tool call is processed transiently by our servers to return your result (not stored); and My Stuff facts you save are synced to your private profile as described in Section 2. Ultra Prompt never trains AI models on any of this content.
Payment Card Details	Not collected	All payment processing is handled by Stripe. We receive only a transaction confirmation, never your card details.
AI Model Responses	Not collected	In the BYOK lane, API calls are routed through your browser and a Cloudflare CORS proxy to your AI provider; in the In-House lane and the Showroom, our worker generates the response and returns it transiently. In neither lane does Ultra Prompt LLC store or log AI model responses. Exception: a deliverable you explicitly click Save on is stored in your private Vault at your request (see Section 2). Ultra Prompt never trains AI models on saved content.
Biometric Data	Never	We do not use facial recognition, fingerprinting, or any biometric systems.

4. How We Use Your Information

We use the information we collect for the following purposes:

To Provide the Service

• Create and manage your account
• Enforce free tier usage limits and subscription access
• Process payments and manage billing
• Respond to support inquiries

To Improve the Product

• Understand which features are most used and most valuable
• Identify performance issues and bugs
• Inform decisions about new features and the product roadmap

To Communicate With You

• Send transactional emails (account creation, password reset, billing receipts)
• Send product update notifications and feature announcements
• Send marketing communications (only with your consent; opt-out available at any time)

For Security & Legal Compliance

• Detect and prevent fraud, abuse, and unauthorized access
• Comply with applicable laws and legal obligations
• Enforce our Terms of Service

5. Analytics, Cookies & Local Storage

Consent-Gated Analytics

Google Analytics (Optional, Consent-Required)

If you accept analytics cookies, we use Google Analytics 4 (GA4) to understand how visitors interact with our website, including which pages are visited, how long users stay, and where traffic comes from. GA4 collects standard web analytics signals (truncated IP, page paths, referrer, screen size, anonymous client ID). You can additionally opt out of Google Analytics globally by installing the Google Analytics Opt-Out Browser Add-on.

Cookies and Similar Technologies We Use

Ultra Prompt uses the following categories of cookies and local-storage entries. Strictly-necessary entries (sign-in tokens, your stored preferences) are required for the service to function and are not consent-gated. Analytics entries are loaded only with your consent.

Category	Examples	Purpose	Consent Required?
Strictly necessary	Supabase sign-in tokens; your accept/decline choice for analytics; your selected library and onboarding state	Allow you to sign in, remember your preferences, and operate the cookie banner itself	No
Functional	Prompt history, favorites, drafts, BYOK API keys, Business-Hub mode, selected industry	Save your work locally so you can return to it	No (your own data, stored on your device)
Analytics	Google Analytics 4 (_ga, _ga_* cookies, client ID)	Understand aggregate site usage and improve the product	Yes, opt-in via cookie banner
Advertising / tracking	None	We do not run advertising, retargeting pixels, or cross-site tracking on Ultra Prompt	N/A

You can control cookies through your browser settings. Disabling strictly-necessary cookies will prevent sign-in and will reset your preferences on every visit.

Global Privacy Control (GPC) and Do Not Track

We honor the Global Privacy Control (GPC) signal as a valid request to opt out of any "sale" or "sharing" of personal information under the California Consumer Privacy Act (CCPA) and equivalent state laws, even though, as stated in Section 7, we do not sell or share personal information for cross-context behavioral advertising. We also treat browsers sending a "Do Not Track" header as having declined analytics cookies for that visit.

Email Communications

Our marketing emails may include standard tracking pixels (provided by Kit, our email service provider) that indicate whether an email was opened and whether links were clicked. This helps us understand engagement and send more relevant communications. You can opt out of all marketing emails at any time using the unsubscribe link included in every email. If you wish to opt out of email tracking only (receiving emails without open/click tracking), you may request this by contacting us at support@ultraprompt.co.

6. Third-Party Services

Ultra Prompt integrates with the following third-party services, each with their own privacy practices:

Supabase

We use Supabase for user authentication and database storage. Your account information (email, password hash, usage data) is stored in Supabase's infrastructure. Supabase is SOC 2 compliant and stores data on AWS infrastructure. Supabase Privacy Policy →

Stripe

Payments are processed by Stripe. When you subscribe to a paid plan, your payment information is entered directly into Stripe's secure form, we never receive or store your card details. Stripe is PCI DSS Level 1 compliant. Stripe Privacy Policy →

Cloudflare

We use Cloudflare for two distinct purposes. First, as our content-delivery network and security layer for ultraprompt.co, Cloudflare receives standard network-traffic data (IP addresses, user agents, request paths) for every page load to provide DDoS protection and global edge delivery. Second, we operate several Cloudflare Workers on our own account:

• A transparent CORS proxy for Anthropic (Claude) API requests. This Worker forwards your API request from your browser to Anthropic's servers and is not designed to log or store your API key or prompt content.
• A contact-form Worker at ultraprompt-contact.unpluggedfeed.workers.dev that receives submissions from our contact form (name, email, message, optional enterprise details) and forwards them to our support inbox.
• An In-House AI Worker at up-ai.unpluggedfeed.workers.dev that powers our optional In-House AI features (see "In-House AI Processing" in Section 2, primarily paid-plan features, with a small introductory allowance for signed-in free users where offered). It receives the text you submit for those features, forwards it to Cloudflare Workers AI to generate a result, verifies your plan and meters your AI-credit usage via Supabase, and is not designed to retain your submitted content after the request completes.
• A link-import Worker at up-link-fetch.unpluggedfeed.workers.dev used only when you import a link into a Vault. Because a browser cannot fetch other websites directly, this Worker retrieves the single public web page you submit, extracts the relevant content, and returns it to your browser. It processes only the specific URL you provide, at the moment you submit it, is limited to signed-in Pro users, and is not designed to retain page content after returning it.
• An MCP-server Worker at up-mcp.unpluggedfeed.workers.dev that serves the Ultra Prompt library and prompt-building tools to MCP clients you connect (see "MCP Server & API Keys" in Section 2). It authenticates your MCP key, meters call counts, and returns prompt/library content; it does not store the content of your requests and does not call any AI model.

Cloudflare may collect standard network traffic metadata under its own privacy policy. Cloudflare Privacy Policy →

Kit (formerly ConvertKit)

We use Kit as our email service provider for our newsletter and product update emails. If you subscribe via the newsletter form on our blog, your email address is submitted directly to Kit's servers and stored on Kit's infrastructure. Kit handles email delivery, subscription management, unsubscribe processing, and standard email-engagement tracking (open and click signals). Kit is a US-based company. Kit Privacy Policy →

Google Analytics

As described in Section 5, we use Google Analytics 4 to understand aggregate site usage, but only after you have accepted the analytics-cookie banner. Google processes truncated IP addresses, page paths, anonymous client IDs, and standard browser information. We do not enable Google Signals, advertising features, or cross-site identity linking. Google Privacy Policy →

Resend

We use Resend, a US-based transactional email provider, to deliver certain emails we send: contact-form and error-report forwarding to our support inbox, Business Hub invitation emails, and the Showroom welcome email. Resend processes the recipient address and message content transiently to deliver the email. Resend Privacy Policy →

Our Cloudflare Workers

Beyond the workers enumerated in the Cloudflare subsection above (contact form, In-House AI, link import, MCP server), we operate a small number of additional Cloudflare Workers: the Showroom demo server (processes demo conversations transiently and keeps operational counters, as described in Section 2), a field-suggestion embedding worker (when certain smart-fill features run, short field text is processed transiently by an embedding model on Cloudflare Workers AI to rank suggestions, never stored, never used for training), the invitation worker (sends Business Hub invites via Resend), and two internal utility workers that handle link previews and our own marketing-image hosting and process no user data.

AI Providers (User-Connected)

When you connect your own API keys to Ultra Prompt, your prompts are sent directly from your browser to those providers (Anthropic, OpenAI, xAI, Google, Perplexity, or local Ollama / LM Studio instances on your own machine). We are not party to those data transfers. Each provider's own privacy policy governs how they handle your prompt data. Where Ultra Prompt's Cloudflare CORS proxy is in the request path (currently for Anthropic), the proxy is designed as a transparent pass-through and is not designed to inspect or retain your keys or prompts.

Information We Receive From Third Parties

We do not purchase, license, or otherwise receive personal information about you from data brokers, advertising networks, or other third-party data sources. The information we hold about you is what you provide directly (via account creation, the features you use, the contact form, or a newsletter form), the consent-gated analytics described above, and the operational data described in Sections 2 and 6 (automatic error reports and short-lived demo counters that keep the service working).

7. Data Sharing & Selling

We may share your information only in the following limited circumstances:

• Service Providers (Processors): With the trusted third-party vendors listed in Section 6 (Supabase, Stripe, Cloudflare, Kit, Google Analytics, Resend) solely to the extent necessary to provide the service. These vendors are contractually limited to processing information on our behalf for the purposes we specify.
• Legal Requirements: If required by law, valid court order, subpoena, or government request, we may disclose information as legally obligated. Where permitted by law, we will notify affected users before disclosure.
• Protection of Rights: To investigate, prevent, or take action regarding suspected fraud, abuse, threats to physical safety, violations of our Terms of Service, or other illegal activity.
• Business Transfers: In the event of a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or part of our assets, your information may be transferred as part of that transaction. We will notify you before your information becomes subject to a different privacy policy, and you will have the opportunity to delete your account.
• With Your Consent: For any other purpose, only with your explicit prior consent.

No sale and no sharing for advertising. We do not disclose personal information to advertising networks, data brokers, social media platforms for retargeting, or any other party in exchange for monetary or other valuable consideration. We do not engage in profiling for automated decisions that produce legal or similarly significant effects about you.

8. International Data Transfers

Ultra Prompt LLC is based in the United States. The infrastructure we use to operate the service is also primarily located in the United States:

• Supabase (authentication and database), your account data is stored on Amazon Web Services infrastructure located in the United States.
• Stripe (payment processing), payment data is processed by Stripe, Inc. in the United States.
• Cloudflare (content delivery, CORS proxy, contact form), Cloudflare operates a global edge network; static content may be cached on edge servers worldwide, while our Workers run primarily on Cloudflare's US infrastructure.
• Kit (email service), email subscriber data is stored by Kit in the United States.
• Google Analytics (if you accept analytics), Google may process analytics data on infrastructure in the United States and other jurisdictions.
• Resend (transactional email), email delivery is processed by Resend in the United States.

If you access Ultra Prompt from outside the United States, including from the European Economic Area, the United Kingdom, Switzerland, Brazil, Canada, or elsewhere, your personal information will be transferred to and processed in the United States. Data protection laws in the United States may differ from, and may offer less protection than, the laws of your country of residence.

Where required by applicable law, we rely on appropriate safeguards for cross-border transfers, including (where applicable) the Standard Contractual Clauses approved by the European Commission, the UK International Data Transfer Addendum, the Swiss Federal Data Protection and Information Commissioner's approved clauses, and equivalent mechanisms recognized under the laws of other jurisdictions. By using Ultra Prompt, you acknowledge and consent to the transfer, storage, and processing of your information in the United States and any other country where our service providers operate.

Business customers requiring a Data Processing Agreement (DPA) or Standard Contractual Clauses to be executed with Ultra Prompt LLC may request one at support@ultraprompt.co.

9. Data Security & Breach Notification

We take reasonable technical and organizational measures to protect your information from unauthorized access, loss, alteration, or disclosure. These measures include:

• HTTPS / TLS encryption for all data in transit between your browser, our infrastructure, and our service providers
• Passwords stored using industry-standard hashing (handled by Supabase using bcrypt-class algorithms); plaintext passwords are never stored or transmitted in clear text
• API keys for third-party AI providers stored only in your browser's local storage on your own device, never on our servers
• Role-based access controls limiting which Ultra Prompt personnel can view production data
• Regular review of our service providers' security certifications (Supabase: SOC 2 Type II; Stripe: PCI DSS Level 1; Cloudflare: ISO 27001 / SOC 2; Google Analytics: ISO 27001 / SOC 2/3)
• Monitoring for unusual sign-in activity and rate limiting on authentication endpoints

No method of transmission over the internet or method of electronic storage is 100% secure. While we use commercially reasonable means to protect your information, we cannot guarantee absolute security.

Breach Notification

In the event of a personal data breach that creates a risk to the rights and freedoms of affected individuals, we will:

• Notify the competent supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of the breach, as required under Article 33 of the General Data Protection Regulation (GDPR) and the UK GDPR;
• Notify affected users without undue delay where the breach is likely to result in a high risk to their rights and freedoms, as required under GDPR Article 34;
• Comply with the breach-notification timelines and content requirements of applicable US state laws (which generally require notice to affected residents within 30 to 60 days of discovery and, in some cases, notice to state attorneys general or other regulators);
• Provide affected users with a description of the breach, the categories of information involved, the steps we are taking, and resources to protect themselves.

10. Data Retention

We retain your personal information for as long as your account is active or as needed to provide the service. Specifically:

• Account data is retained while your account is active and for up to 12 months after deletion to comply with legal obligations and to resolve disputes, unless a longer period is required by applicable law
• Usage data is retained for up to 24 months for analytics, security, and product improvement purposes, after which it is aggregated or deleted
• Email communications and support correspondence are retained for up to 36 months to manage your preferences and support history, or until you request deletion
• Billing records and transaction history are retained for the period required by US federal and state tax and accounting laws (generally 7 years)
• Analytics data in Google Analytics is configured with a 14-month retention period for user and event data at the property level
• Vault content you save is retained until you choose to delete it. Deleted Vault items are recoverable for 30 days, after which they are permanently removed; uploaded photos are deleted from file storage when you delete the associated item or your account
• Saved Playbooks are retained while your Pro subscription is active. Ultra Prompt is not obligated to retain or provide access to your Playbooks after your Pro subscription ends (see our Terms of Service), and we recommend exporting your own copies before any cancellation or downgrade
• Agent Studio blueprints are stored on your own device (browser local storage), not on our servers; clearing your browser data removes them, and any .json exports or Share Links you create are under your control
• Content above your plan's limits after a downgrade: for example, Vault items beyond the free-tier cap, or Playbooks after a lapse from Pro, may become read-only or inaccessible until you re-subscribe. Export of your own data remains available at any time, so nothing is ever permanently trapped
• Error reports (see "Diagnostics & Error Reports" in Section 2) are retained on the same footing as support correspondence, up to 36 months, or until you ask us to delete reports associated with your account
• My Stuff facts synced to your profile are retained while your account is active and removed on account deletion; food limits never leave your device
• Showroom demo data: the operational counters and rate-limit records (including IP) expire automatically within roughly 48 hours; an email address you provide at the demo gate is retained in our database until you unsubscribe or request deletion
• MCP keys and per-key call counts are retained while your account holds the key; deleting a key removes it, and account deletion removes all of yours
• Business Hub organization content (organization templates, dormant-seat business content) belongs to the organization and is retained while the organization's subscription is active, independent of any individual member's account deletion

When you delete your account, we will delete or anonymize your personal information within 30 days, except where retention is required by law, where information has been aggregated and de-identified, or where retention is needed to resolve a dispute, enforce our Terms of Service, or prevent fraud.

11. Your Privacy Rights

Regardless of where you live, the following core rights are available to all Ultra Prompt users. To exercise any of these rights, contact us at support@ultraprompt.co or use the in-app "Delete My Account" option in your account settings.

Right to Access

You may request a copy of the personal information we hold about you. We will provide it in a portable, machine-readable format (such as JSON or CSV) within 30 days of verification.

Right to Correction

You may request that we correct inaccurate or incomplete information. You may also update much of this information directly in your account settings.

Right to Deletion

You may request deletion of your account and associated personal data at any time, either through the in-app "Delete My Account" option or by emailing support@ultraprompt.co. We will process deletion requests within 30 days, subject to the limited retention exceptions described in Section 10.

Right to Data Portability

You may request a machine-readable export of your account data (profile information, custom templates, prompt history that is server-side, subscription metadata).

Right to Opt Out of Marketing

You may opt out of marketing emails at any time using the unsubscribe link in any email, or by contacting us directly. Note: you cannot opt out of transactional emails (account creation confirmations, billing receipts, security alerts) while your account is active.

Right to Withdraw Consent

Where we rely on your consent (for analytics cookies, marketing communications, or other purposes), you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

Right to Non-Discrimination

We will not deny service, charge different prices, or provide a lower quality of service to you because you exercised any of your privacy rights.

How to Exercise Your Rights: Verification

To protect your information, when you submit a rights request we will verify your identity using the email address associated with your Ultra Prompt account. We may ask you to confirm the request from that email or to provide additional information sufficient to verify the request. We do not require you to create an account in order to make a rights request; users without an Ultra Prompt account may contact support@ultraprompt.co directly. You may also designate an authorized agent to submit a request on your behalf, in which case we will require written authorization from you and verification of the agent's identity, to the extent permitted by law.

Response Time

We aim to acknowledge rights requests within 2 business days and to complete them within 30 days. Where a request is complex or where we have received numerous requests, we may extend this period by up to an additional 60 days, with notice to you.

12. US State Privacy Rights

Residents of certain US states have additional rights under their state's comprehensive privacy laws. The rights below are extended to residents of every state listed, regardless of whether the law is currently in effect on the date you read this policy.

California (CCPA / CPRA)

If you are a California resident, you have the rights described in Section 11 (access, correction, deletion, portability, opt-out of marketing, non-discrimination), plus the following additional rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act:

• Right to Know. You may request that we disclose the categories of personal information we have collected about you, the categories of sources, the business or commercial purpose for collecting it, the categories of third parties with whom we share it, and the specific pieces of personal information we have collected.
• Right to Opt Out of Sale or Sharing. As stated in Section 7, we do not sell personal information and we do not share personal information for cross-context behavioral advertising. We honor the Global Privacy Control (GPC) signal as a valid opt-out request.
• Right to Limit Use and Disclosure of Sensitive Personal Information. Ultra Prompt does not collect or process Sensitive Personal Information as defined under the CPRA (which includes government identifiers, account log-in combinations, precise geolocation, racial or ethnic origin, religious beliefs, union membership, contents of mail/email/text messages not addressed to us, genetic data, biometric information, health information, and information concerning sex life or sexual orientation). Because we do not collect SPI, there is no use of SPI to limit; if this changes, we will update this policy and provide a "Limit the Use of My Sensitive Personal Information" link.
• Categories of Personal Information Collected (CCPA categories). In the 12 months preceding the date of this policy, we have collected the following categories: identifiers (email, account ID); commercial information (subscription and purchase history); internet or other network activity information (analytics browsing data with consent; limited automatic error-report and demo operational data as described in Sections 2 and 6); inferences drawn for product improvement only.
• Shine the Light (Cal. Civ. Code § 1798.83). We do not share personal information with third parties for their direct-marketing purposes.

Other US States with Comprehensive Privacy Laws

If you are a resident of any of the states below, you have rights that are substantially similar to the California rights described above: the right to confirm whether we process your personal data; the right to access your personal data; the right to correct inaccuracies; the right to delete personal data; the right to obtain a portable copy; the right to opt out of targeted advertising, the sale of personal data, and profiling in furtherance of decisions that produce legal or similarly significant effects; and the right to appeal a denial of a rights request.

• Virginia: Virginia Consumer Data Protection Act (VCDPA), effective January 1, 2023
• Colorado: Colorado Privacy Act (CPA), effective July 1, 2023
• Connecticut: Connecticut Data Privacy Act (CTDPA), effective July 1, 2023
• Utah: Utah Consumer Privacy Act (UCPA), effective December 31, 2023
• Texas: Texas Data Privacy and Security Act (TDPSA), effective July 1, 2024
• Oregon: Oregon Consumer Privacy Act (OCPA), effective July 1, 2024
• Montana: Montana Consumer Data Privacy Act (MTCDPA), effective October 1, 2024
• Iowa: Iowa Consumer Data Protection Act (ICDPA), effective January 1, 2025
• Delaware: Delaware Personal Data Privacy Act (DPDPA), effective January 1, 2025
• Nebraska: Nebraska Data Privacy Act (NDPA), effective January 1, 2025
• New Hampshire: New Hampshire Privacy Act (NHPA), effective January 1, 2025
• New Jersey: New Jersey Data Privacy Act (NJDPA), effective January 15, 2025
• Tennessee: Tennessee Information Protection Act (TIPA), effective July 1, 2025
• Minnesota: Minnesota Consumer Data Privacy Act (MCDPA), effective July 31, 2025
• Maryland: Maryland Online Data Privacy Act (MODPA), effective October 1, 2025
• Indiana: Indiana Consumer Data Protection Act (INCDPA), effective January 1, 2026
• Kentucky: Kentucky Consumer Data Protection Act (KCDPA), effective January 1, 2026
• Rhode Island: Rhode Island Data Transparency and Privacy Protection Act, effective January 1, 2026

Residents of other states that enact comprehensive privacy legislation after the effective date of this policy will likewise be afforded the same rights to the extent such laws apply to Ultra Prompt LLC.

How to Exercise State-Specific Rights

To submit a rights request under any of the laws above, email us at support@ultraprompt.co with the subject line "Privacy Rights Request" and indicate (a) the state in which you reside, (b) the right you wish to exercise, and (c) the email address associated with your account. You may also designate an authorized agent to act on your behalf, subject to the verification requirements described in Section 11. If we deny your request, you have the right to appeal our decision by replying to our denial message; we will respond to appeals within 45 days. If your appeal is denied, you may also contact your state attorney general to lodge a complaint.

Health Data and Other State-Specific Rules

Ultra Prompt does not collect consumer health data as defined under the Washington My Health My Data Act, the Nevada Consumer Health Data Privacy Law, or similar state-specific health data laws. We do not infer health conditions from user behavior.

13. International Privacy Rights

European Economic Area & United Kingdom (GDPR / UK GDPR)

If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, you have the rights described in Section 11 plus additional rights under the EU General Data Protection Regulation, the UK GDPR, and the UK Data Protection Act 2018, including the right to object to processing, the right to restrict processing, the right to data portability in a structured machine-readable format, the right not to be subject to a decision based solely on automated processing that produces legal effects (we do not engage in such processing), and the right to lodge a complaint with your local data protection supervisory authority.

Legal bases for processing under Article 6 GDPR / UK GDPR:

• Contract performance (Art. 6(1)(b)): account information, authentication, subscription management, billing
• Legitimate interest (Art. 6(1)(f)): security, fraud prevention, basic service operation, and, where applicable, product improvement on the basis of de-identified or aggregated data
• Consent (Art. 6(1)(a)): analytics cookies, marketing emails, optional newsletter subscription, you may withdraw consent at any time
• Legal obligation (Art. 6(1)(c)): tax records, accounting records, responding to legitimate legal process

Controller and contact. The data controller is Ultra Prompt LLC, contactable at support@ultraprompt.co. We do not currently maintain an EU/UK Article 27 representative or a designated Data Protection Officer because we do not engage in large-scale systematic monitoring of EU/UK residents or large-scale processing of special-category data. If this changes, we will update this policy and appoint a representative as required.

Right to lodge a complaint. You have the right to lodge a complaint with your national data protection authority. In the UK, this is the Information Commissioner's Office (ico.org.uk); in EU member states, you may contact your local supervisory authority listed at edpb.europa.eu.

Brazil (LGPD)

If you are located in Brazil, you have rights under the Brazilian General Data Protection Law (Lei Geral de Proteção de Dados, Lei nº 13.709/2018, "LGPD"), including the rights to confirmation of processing, access, correction of incomplete or inaccurate data, anonymization or deletion of unnecessary data, portability, deletion of data processed with consent, information about entities with whom we share data, withdrawal of consent, and the right to lodge a complaint with the Brazilian National Data Protection Authority (ANPD). Our legal bases for processing under Article 7 LGPD mirror the GDPR bases described above. To exercise these rights, contact support@ultraprompt.co.

Canada (PIPEDA & Provincial Laws, including Quebec Law 25)

If you are located in Canada, your personal information is processed in accordance with the federal Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws (including Quebec's Law 25 / Act respecting the protection of personal information in the private sector). You have the right to access and correct your personal information, to withdraw consent, and to lodge a complaint with the Office of the Privacy Commissioner of Canada or the Commission d'accès à l'information du Québec, as applicable. Quebec residents may also designate a person to receive privacy complaints; please direct all such complaints to support@ultraprompt.co with the subject line "Quebec Privacy Officer."

Australia (Privacy Act 1988)

If you are located in Australia, the Australian Privacy Principles under the Privacy Act 1988 (Cth) apply. You may exercise your access and correction rights by contacting support@ultraprompt.co. Complaints may be lodged with the Office of the Australian Information Commissioner (oaic.gov.au).

Other Jurisdictions

If you reside in a jurisdiction with privacy laws not specifically named above and you believe Ultra Prompt LLC's processing of your information is subject to those laws, please contact support@ultraprompt.co. We will respond to legitimate rights requests to the extent applicable law requires.

14. Minors

Ultra Prompt is not directed to, and is not intended for use by, children under the age of 16. We do not knowingly collect personal information from children under 16. If you are a parent or guardian and believe your child has provided us with personal information, please contact us at support@ultraprompt.co and we will delete that information promptly.

In jurisdictions where the age threshold for parental consent is set lower (for example, the United States Children's Online Privacy Protection Act, "COPPA," sets a threshold of 13, and certain EU member states permit consent from age 13–15), Ultra Prompt nevertheless applies the higher age of 16 as a precautionary baseline.

If a minor under the age of 16 accesses Ultra Prompt by misrepresenting their age, any personal information collected as a result of that misrepresentation was obtained without our knowledge or consent. Upon discovery, we will delete any such information. Ultra Prompt LLC bears no liability for the collection of a minor's information where access was obtained through age misrepresentation. Parents and legal guardians are responsible for supervising minors' use of online services. Please refer to Section 2 of our Terms of Service for the full age misrepresentation clause.

15. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. When we make material changes, we will update the "Last Updated" date at the top of this page.

For significant changes that affect your rights or how we use your information, we will notify registered users by email at least 30 days before the changes take effect. Where applicable law requires affirmative opt-in to a material change (for example, a new processing purpose under GDPR), we will obtain that consent before the change applies to you. Your continued use of Ultra Prompt after the effective date of any changes constitutes your acceptance of the revised policy.

An archived copy of prior versions of this policy is available on request at support@ultraprompt.co.

16. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or how we handle your data, please reach out:

• Email: support@ultraprompt.co
• Company: Ultra Prompt LLC
• Registered Agent: Northwest Registered Agent, Monroe County, Illinois
• Website: ultraprompt.co
• Privacy Rights Requests: Use the in-app "Delete My Account" option for deletion, or email support@ultraprompt.co with the subject line "Privacy Rights Request" for all other requests.

We aim to acknowledge all privacy inquiries within 5 business days. For data deletion requests, we will confirm receipt within 2 business days and complete the request within 30 days, subject to the verification process described in Section 11 and the limited retention exceptions in Section 10.