PromptAttic

This Privacy Policy explains how PromptAttic (“we”, “us”, or “our”) collects, uses, and protects personal data when you visit https://www.promptattic.com (the “Site”). We are committed to handling your data lawfully, fairly, and transparently, in line with the EU General Data Protection Regulation (GDPR) and applicable national data protection law.

Data controller

PromptAttic is the data controller responsible for the personal data processed through this Site. The controller decides why and how your data is processed. If you have any question about this policy or about how we handle your data, contact us using the contact form.

Personal data we collect

We keep data collection to a minimum. Depending on how you use the Site, we may process:

Contact data. When you submit the contact form, we collect the name, email address, reason for contact, and the content of your message, so we can read and respond to it.
Usage and device data. With your consent, we collect aggregated analytics such as pages viewed, referring page, approximate (city-level) location derived from your IP address, browser type, and device type.
Preference data. Local settings such as your light or dark theme choice and your cookie consent decision, stored on your device.

We do not knowingly collect special categories of data (such as health, political, or biometric data), and we ask that you do not include such data in messages you send us.

How and why we use your data

To respond to enquiries and provide the information or support you request.
To operate, maintain, secure, and improve the Site and its content.
To measure and understand how the Site is used, in aggregate, so we can improve our recipes.
To detect, prevent, and address technical issues, abuse, or security incidents.
To comply with our legal obligations.

Legal bases for processing

Under the GDPR, we rely on the following legal bases:

Consent (Art. 6(1)(a)). For analytics and any non-essential cookies. You may withdraw consent at any time, with no effect on processing carried out before withdrawal.
Legitimate interests (Art. 6(1)(f)). To respond to messages you send us, to keep the Site secure, and to maintain essential functionality. We balance these interests against your rights.
Legal obligation (Art. 6(1)(c)). Where we must retain or disclose data to comply with the law.

Cookies and analytics

We use a small number of cookies and similar technologies. Essential and functional storage is used to keep the Site working and to remember your preferences. Analytics cookies are only set after you accept them in our consent banner. For details, see our Cookie Policy.

Sharing and disclosure

We do not sell your personal data. We share it only where necessary with processors who act on our instructions, such as our hosting and infrastructure provider, our analytics provider, and our email delivery provider. Each processor is bound by a contract that requires appropriate safeguards. We may also disclose data where required by law, regulation, or valid legal process, or to protect our rights and the safety of others.

International transfers

Some of our processors may store or process data outside the European Economic Area (EEA). Where that happens, we rely on appropriate safeguards such as European Commission adequacy decisions or Standard Contractual Clauses to ensure your data receives an equivalent level of protection.

Data retention

We keep personal data only for as long as needed for the purpose it was collected. Contact form messages are retained for up to 24 months after our last correspondence, then deleted or anonymized. Aggregated analytics data is retained for up to 26 months. Preference data persists on your device until you clear it.

Your rights

Subject to the conditions in the GDPR, you have the right to access your personal data, to have inaccurate data corrected, to have your data erased, to restrict or object to processing, to data portability, and to withdraw consent at any time. To exercise any of these rights, contact us through the contact form. We will respond within one month. You also have the right to lodge a complaint with your local supervisory authority if you believe your data has been handled unlawfully.

Data security

We apply appropriate technical and organizational measures to protect personal data against unauthorized access, loss, or alteration, including encryption in transit and access controls. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Children’s privacy

The Site is intended for professional and adult audiences and is not directed at children under 16. We do not knowingly collect data from children. If you believe a child has provided us with personal data, contact us and we will delete it.

Changes to this policy

We may update this policy from time to time. Material changes will be reflected by the “Last updated” date above. Continued use of the Site after an update constitutes acceptance of the revised policy.

Contact us

Questions about this policy or your data? Use our contact form and we will get back to you.