Privacy Policy
Optional visitor analytics · updated 25 October 2026
Only with your consent, we record visit time, a safe page path without queries or private parameters, referral source, marketing campaign labels, approximate country from our network provider, screen-width category, estimated active time and a random session identifier. We use this to improve the site and evaluate marketing. Sessions reset after 30 minutes of inactivity and are limited to one tab. This analytics store excludes full URLs, prompt content, email, IP addresses and links to your account. Your choice is saved locally and the identifier in session storage. Raw events are deleted by daily cleanup after 90 days; daily summaries without identifiers are kept for up to 24 months. You can withdraw consent through Analytics settings to stop future collection. We respect Do Not Track and Global Privacy Control. Essential account and payment records follow the separate rules in this notice.
Effective date: 2026-11-08
Controller
The data controller is Digital Gold Technologies LLC (USA), operator of golden-prompts.com. Contact: support@golden-prompts.com.
Data we store
Your email and authentication information; prompts generated in the ateliers and the inputs that produced them; usage counts and plan status.
Legal basis for processing
We process data to provide the account and services you request, to protect the service against fraud and abuse, and to meet legal obligations. Optional analytics and marketing use consent where required. You can withdraw consent without affecting earlier lawful processing.
Fraud prevention
To prevent repeated free trials, automated abuse and fraudulent code redemptions, our server-side security records may include the account, IP address and a coarse privacy-preserving client marker. We do not collect browser user-agent strings. These records are used only for security and entitlement enforcement, never for advertising.
Payments
New purchases are paused pending payment-provider selection. Before reopening sales, we will identify the provider and update the information about its processing. Payment reconciliation requires customer and order identifiers, payment status, amounts and refund or dispute records. Do not send card numbers or security codes to our support or prompt fields.
Cookies
Essential cookies for authentication and session state. We do not run advertising trackers.
Data retention
Account data (email, authentication, saved prompts and usage counters) is retained while your account is active and deleted within 30 days of account deletion, except records subject to a specific legal duty or an active dispute or security investigation. Any retained exception is restricted to the purpose and period that justify it. Order, tax and dispute records have retention periods determined by the applicable law and the actual payment provider; a new provider has not yet been selected. Fraud-prevention usage records and the canonical free-trial ledger are kept for no more than 12 months. IP addresses attached to creator-code redemption records are anonymised after 30 days. Raw product events are deleted after 180 days. Pending Team invitations expire after 30 days. Operational email-delivery logs and stranded queue payloads are deleted or anonymised after no more than 30 days. We keep only the minimum suppression record needed to honour an unsubscribe or protect delivery after a bounce or complaint; it is not used for marketing.
Security measures
We apply appropriate technical and organisational measures to protect your data: encryption in transit (HTTPS/TLS) and at rest, hashed credentials, role-based access controls, row-level security on our database, least-privilege service keys, audit logging, and regular dependency and security reviews. Card data must be entered only in the selected provider's secure checkout, never in a prompt or support message.
Privacy-first product analytics and feedback
For signed-in users, we record a limited set of product events so we can understand whether key features work: the event name, product surface, interface language, free or paid access status and timestamp. On the first app-open event in a browser session, we may also record first-party attribution values supplied in the landing URL (UTM source, medium and campaign) and the hostname of an external referring site; we do not store the full referrer URL or its query string. These product events never contain prompt text, prompt inputs, your IP address or your browser's user-agent. Raw product events are deleted after 180 days. If you voluntarily rate a saved prompt, we store your verdict, selected issue and any optional model name or note you submit, linked to that saved prompt and your account. Feedback does not create another copy of the prompt text and is removed when the linked prompt or account is deleted. We do not use advertising trackers.
Your rights
You can request export or deletion of your account data at any time by writing to support@golden-prompts.com.
Contact
support@golden-prompts.com
Service providers and international processing
Cloudflare provides website hosting, network delivery and security, including Turnstile anti-bot verification. It can process network and device signals needed to deliver and protect the service. Supabase provides account authentication, the application database and private storage. Resend delivers account-confirmation, password-reset and other operational emails and processes recipient addresses, message content and delivery status for that purpose. Support correspondence is handled through Zoho Mail. These providers are used for their stated service functions, not as advertising partners.
These services may process data in the United States and other countries, including through their subprocessors. We use the applicable data-processing agreements and, where required for a restricted transfer, appropriate safeguards such as standard contractual clauses. You can request information about the relevant safeguards at support@golden-prompts.com. A US company address does not mean all data remains in one country.
Paid generation is disabled. No generation or image/video classification provider is represented here as already activated or approved. Before enabling those features, we will identify the actual providers, the inputs and outputs shared with them, their retention and deletion rules, training restrictions and any necessary international-transfer safeguards. Do not assume a provider processes nothing, keeps nothing or never uses data for training unless its applicable terms support that statement.
Where enabled, safety screening can consider prompt text, reference media and generated results to enforce our content rules. An uncertain result must not be released merely because a classifier timed out. Automated screening can make mistakes; account restrictions and disputed moderation decisions can be referred to support for review. We do not use these tools to make decisions producing legal or similarly significant effects solely through automation.
We do not sell your personal data. Where applicable, you may request access, correction, erasure, restriction or portability, object to processing based on legitimate interests, withdraw consent and complain to your local data-protection authority. Identity verification must be proportionate. We respond within applicable statutory deadlines, and explain any lawful retention or limitation rather than promising deletion of records that must be preserved.