Privacy Policy

• Account data: your email address. You sign in with a code sent to your email, or with Google or GitHub.
• Content you submit: prompts submitted for evaluation, version history, and analysis results.
• Product usage (while signed in): we record in our own database which pages and screens you opened, which features you used, and which plan screens were shown, plus evaluation attributes such as score, prompt length, and prompt category. This does not rely on third-party cookies.
• Payment data: processed exclusively by Stripe. We do not store card numbers, expiry dates, or security codes. We keep only the outcome of the payment: plan, amount, whether it was approved or the reason it was declined, and the card's type and country of issue.
• Technical data: access logs, IP address, approximate country, and browser information, for security, error diagnostics, usage limits, and abuse prevention (including on the free tools, which need no account).
• Cookieless audience measurement (visitors): pages viewed, reading time and scroll depth, referring site, button clicks, use of the free tools and the daily training (lessons started and completed), and sign-in steps. We count visitors with an identifier that changes every day, computed on our server from the IP address and browser. It is not stored on your device, it is not linked to your account, and the IP address and browser are not stored with these events: we keep only the approximate country and the device type (mobile or desktop).
• First-visit source: a first-party cookie keeps, for up to 90 days, the site you came from, campaign parameters, and the first page you visited. If you create an account, that source is associated with it.
• Analytics and session recordings (only with your consent): usage events, pages visited, and session recordings in third-party tools (PostHog, Google Analytics, and Google Ads). With consent, browsing from before you signed in may be associated with your account. Sensitive fields such as email and password are masked in recordings.

• Performing the service you signed up for: authenticating and managing your account, processing prompt evaluations, and enforcing usage limits and subscription plans.
• Legitimate interest: security and abuse prevention, error diagnostics, cookieless audience measurement, and recording product usage and first-visit source, to understand what works and improve the service. You can object at any time (sections 6 and 8).
• Consent: third-party analytics and advertising tools and session recordings. None of these load before you accept.
• Legal obligation: tax and payment records.

We send emails about your account and your use of the service, including reminders and offers related to your plan. Every such email carries an unsubscribe link.

Every evaluation contributes one anonymous row to our public benchmark (State of Prompt Quality): scores and structural characteristics of the prompt, such as length and language. The prompt text never enters that dataset and the row is not linked to your account.

Anything you choose to publish, such as a shared evaluation link or a leaderboard entry, is visible to anyone.

• Supabase: database and authentication.
• Anthropic and OpenAI: AI models that run the evaluation, the rewrite, and the optimization. They receive the prompt text you submit.
• Google (Gemini), Groq, and Cerebras: AI models used to classify the category of an evaluated prompt (they receive an excerpt of it) and to run the daily training and the A/B tester.
• Stripe: payment processing.
• Vercel: hosting and aggregate, cookieless audience measurement.
• Sentry: error and performance monitoring. It receives technical data about the error, such as the page and browser information; we do not send it IP addresses, cookies, or the content of your prompts.
• Brevo: email delivery.
• Google and GitHub: sign-in, when you choose to use them.
• PostHog: product analytics and session recordings (only with consent).
• Google (Analytics and Ads): audience measurement and advertising campaigns (only with consent).

AI providers process content under their own terms. Some of these features run on free tiers, whose terms may allow the provider to use submitted content to improve its own services. We do not use your prompts to train models.

These providers operate mainly in the United States and the European Union, so your data may be processed outside your country.

• Confirm that processing exists and access your data.
• Correct incomplete, inaccurate, or outdated data.
• Request anonymization, blocking, or deletion of unnecessary data or data processed unlawfully.
• Data portability to another provider, upon request.
• Delete data processed on the basis of your consent.
• Know which third parties we share your data with.
• Withdraw consent at any time.
• Object to processing based on legitimate interest, such as audience measurement and product-usage records.

If you are in the European Union or the United Kingdom, you have the equivalent rights under the GDPR, including the right to complain to your country's data protection authority.

To exercise any of these rights, email our Data Protection Officer (DPO) at francisco@prompt-eval.com. We respond within the legal deadline. You may also file a complaint with Brazil's National Data Protection Authority (ANPD).

• Necessary and functional (always on): sign-in session, language, onboarding state, daily-training progress, usage limits against abuse, and the record of your choice in the cookie banner. When you arrive through a partner link, a cookie identifies the partner for 30 days.
• First-visit source: the cookie described in section 2. It is not set if you decline in the banner or browse with Global Privacy Control or Do Not Track, and it is deleted when you decline.
• Cookieless audience measurement: works without storing anything on your device. To opt out, click "Decline" in the banner or turn on Global Privacy Control or Do Not Track in your browser.
• Third-party analytics, advertising, and session recordings: PostHog, Google Analytics, and Google Ads only load after you accept in the banner. Recordings mask sensitive fields such as email and password.

To change a choice you already made, clear this site's cookies and data in your browser: the banner will show again.