Privacy Policy

LMA TECH LTDA, a company registered in Brazil under CNPJ 64.160.688/0001-50, with its registered office at R. Rio Tamisa, 41, Jardim dos Lagos, Indaiatuba-SP, 13340-229, Brazil, runs Prompy and is the controller of your personal data.

For any privacy question or request, write to hello@prompy.io. The same address reaches our data protection contact (the encarregado under the LGPD).

Account data

We use Clerk to sign you in. Clerk gives us your account ID, your email address, your phone number if you sign in by text message, and the details of the sign-in method you choose.

Billing data

Creem handles checkout and billing. We never see your full card number. Creem tells us what you bought, the payment status and, where Creem provides them, signals that help us prevent fraud.

What you create

We store the prompts we write for you, the filters and effort level you chose, any text you add, and the images we generate and upscale for you.

Technical and security data

To protect accounts, stop fraud and enforce limits, we use your IP address and signals from your device and browser. In our database we store these only as keyed hashes, never in plain form. The operational logs of our hosting provider may include your IP address for up to 30 days. We also keep a log of security events, such as sign-ins, API key changes and payment events.

API keys are stored only as hashes, plus the last 4 characters so you can recognize them.

Product analytics

We measure how people use Prompy, such as which features they open and how many images they generate. These events never include your email address, prompt text or IP address.

Error logs

When something breaks, we record the error to fix it. We remove credentials, cookies, API keys and signed links from these logs before they are stored.

Two decisions are made automatically. When you start a trial, a fraud check uses the signals described above to allow the trial, offer a plan without the trial, or block it. When you generate, a moderation check can block a request or an image.

If an automated decision affects you, you can ask us to have a person review it. Write to hello@prompy.io.

We share data only with the providers below, each limited to its role. We do not sell your data.

We may also disclose data when the law requires it, or to protect our rights and the safety of others.

Our servers are in the eastern United States. If you live in Brazil, the European Union or elsewhere, your data travels to the United States, and some providers above may process it in other countries. Where the LGPD or the GDPR requires it, we rely on the transfer safeguards those laws allow.

We keep this short list in your browser:

• Session cookie. Keeps you signed in. Prompy does not work without it.
• Device cookie. A long-lived first-party cookie that helps us spot repeated trials from the same device.
• Theme preference. Saved in local storage so the site remembers light or dark mode.
• Analytics. PostHog stores an identifier to count visits and feature use. Session replay is off on billing and generation screens.

Under the LGPD in Brazil and the GDPR in the European Union, you can ask us to:

• confirm whether we process your data and give you a copy;
• correct data that is wrong or incomplete;
• delete your data, or anonymize or block data we do not need;
• send your data to you or to another provider in a portable format;
• tell you which companies we share your data with;
• stop a use of your data that relies on our legitimate interest;
• withdraw a consent you gave;
• have a person review an automated decision.

To use any of these rights, email hello@prompy.io from the address on your account. We may ask you to confirm who you are. We answer LGPD requests within 15 days.

You can also complain to a data protection authority: the ANPD in Brazil, or the supervisory authority where you live in the European Union.

You can delete your account at any time. Within 30 days we delete your profile, your images, your prompts and your API keys.

The law requires us to keep the credit ledger, billing records and security log for longer. We keep them pseudonymized, without your name or email, for the periods in the table above.

Prompy is not for anyone under 18. We do not knowingly collect data from children. If you believe a child has given us data, write to hello@prompy.io and we will delete it.

• All traffic to Prompy uses HTTPS.
• Images live in private storage. You get a download link only after we check the image is yours, and the link expires after 15 minutes.
• We store API keys, IP addresses and fraud signals only as hashes.
• Our security log only accepts new entries, and we export a copy every day to storage that cannot be changed.
• Admin access is separate from the app and requires multi-factor authentication.

We may update this policy. The date at the top shows the latest version. When a change matters to you, we tell you by email or in the app before it takes effect.

Questions about this policy or your data go to hello@prompy.io.