Privacy Policy

1. Who this policy covers, and who we are

This Privacy Policy is issued by PromptSec ("PromptSec", "we", "us"), operating from India. [Legal entity name and registered address to be inserted here before this page is published — e.g. "PromptSec Technologies Private Limited, registered at ___."] It applies to promptsec.in and the PromptSec browser extension, dashboard, and admin console (together, the "Service").

This policy distinguishes between three different people we handle data about:

• Website visitors — anyone browsing promptsec.in or submitting our contact form.
• Customer accounts — the admins and team members at a company that has signed up for PromptSec.
• Monitored end users — employees at a customer company whose AI-tool prompts PromptSec inspects. For this group, our customer is the data controller and we act as their data processor: our customer decides what gets captured (via their privacy-level and policy configuration), and we process it on their instructions. Requests from an end user about their own data should go to their employer first; we support the employer in fulfilling that request.

2. What we collect

From website visitors: name, email, phone number, company, and organization size, only if you submit our contact form. Standard server request logs (IP address, user agent, timestamp) for operating and securing the site — not tied to an advertising profile.

From customer accounts: the name and email of each person a customer invites into their PromptSec tenant, their role, and their login activity (for security purposes — see §6).

From monitored end users, by default: that an AI tool was used, which tool, the policy decision (allowed, redacted, warned, or blocked), which categories of sensitive data were detected (for example "contains a credit card number"), a timestamp, and the extension version. Not the prompt content itself.

From monitored end users, only if the customer has explicitly configured a higher capture level: a hash of the prompt, the prompt with sensitive spans redacted, a short snippet, or (only for a specific user, tool, category, and time window the customer defines) the full prompt. If your employer has turned this on, they are responsible for telling you.

What we never collect, regardless of configuration: your browsing activity outside AI-tool tabs, cookies or session state from unrelated sites, or personal communications outside the scope of AI-tool use.

3. Cookies and tracking

promptsec.in does not set third-party advertising or analytics cookies today. The dashboard and admin console use a single first-party session cookie (ps_session) to keep you signed in; it's HttpOnly and cannot be read by page scripts. We may add privacy-respecting product analytics in the future — if we do, this section and, where legally required, an on-site consent mechanism will be updated before that happens, not after.

4. How we use what we collect

We use the data described in §2 to:

• Operate the Service — authenticate you, enforce your organization's policies, show your dashboard and audit log.
• Respond to contact-form submissions and support requests.
• Secure the Service — detect and investigate suspicious login activity, abuse, or security incidents.
• Send transactional email — invitations, password resets, MFA and security-alert notices, billing receipts. We do not send marketing email to monitored end users, and any future marketing email to a customer contact will carry a working unsubscribe link.
• Meet legal, tax, and accounting obligations.

We do not use customer or end-user data to train shared models, improve our detectors, market to end users, or sell/share it with third parties, without explicit opt-in. We do not currently run a data-analytics or model-improvement program that end-user data would feed into.

5. Who we share data with

We share data with the infrastructure and service providers that operate the Service on our behalf, under contract, and only to the extent each needs it to do its job — never for that provider's own purposes. As of September 4, 2026, these are:

• Amazon Web Services (Bedrock) — only when a customer has opted into cloud-escalation classification for ambiguous prompts; off by default.
• Neon or Render (managed Postgres) — primary database.
• Render — backend application hosting.
• Vercel — website and dashboard hosting.
• Razorpay and/or Stripe — payment processing. We never receive or store your full card number.
• Resend — transactional email delivery.
• Sentry — error monitoring, where a customer deployment has it configured.

We do not yet publish a standalone, continuously-maintained sub-processor list with change notifications — that's on our roadmap. Until it exists, the list above is the authoritative one; email info@promptsec.in if you need it confirmed for a vendor-review questionnaire.

We otherwise disclose data only if required by law, to enforce our agreements, or to protect the rights, property, or safety of PromptSec, our customers, or others.

6. Security

Sensitive columns (MFA secrets, notification-destination credentials) are encrypted at rest with AES-256-GCM. All traffic to the Service runs over TLS. Access to customer data is scoped by role, and tenant data is isolated at the database layer via PostgreSQL row-level security, not application logic alone. See our Security page for the full, honest technical picture, including what's still on the roadmap (we do not yet offer bring-your-own-key encryption or per-tenant infrastructure isolation). No system is perfectly secure; if you believe you've found a vulnerability, see §11.

7. Data retention

We keep data only as long as needed for the purposes in §4, or as required by law. Account and telemetry data for an active tenant is retained for the duration of the customer relationship. When a customer deletes their account, we begin a 7-day recovery window (in case of accidental deletion), after which the data is permanently and irreversibly deleted. Contact-form submissions from website visitors are kept only as long as needed to respond to the inquiry, and are not retained for marketing purposes.

8. Where data is processed

The Service is currently operated from a single hosting region (US, via our infrastructure providers in §5). Customer-selectable data residency (choosing, for example, to keep a tenant's data in-region for India or the EU) is on our roadmap but not available today — if that matters for your compliance program, ask us at info@promptsec.in before signing up, rather than assuming it. Where we transfer personal data internationally, we rely on the legal mechanisms available to us today; we have not yet executed Standard Contractual Clauses or a UK addendum as a matter of course, since we do not yet have the customer volume in jurisdictions that require them — we will put these in place as needed and will update this section when we do.

9. Your rights

Depending on where you're located, you may have rights to access, correct, delete, restrict, or export your personal data, and to object to certain processing (for example under India's Digital Personal Data Protection Act, the EU/UK GDPR, or US state privacy laws). Here's honestly how that works today:

• If you're a monitored end user, start with your employer's PromptSec admin — they control your account and can request a change or deletion on your behalf. We'll support them in fulfilling it.
• If you're a customer account holder or a website visitor, email info@promptsec.in with your request. We handle these manually today — there is no self-service export or deletion button yet — and we will confirm receipt and respond within 30 days.
• We do not sell personal data, so there is nothing to opt out of in that sense; we also honor a request not to have your data shared with the sub-processors in §5 beyond what's needed to run the Service, to the extent that's compatible with continuing to provide it.

10. Children's privacy

The Service is a workplace product. It is not directed at, marketed to, or knowingly used to collect data from children under 16. If you believe a child's data has reached us, contact us at info@promptsec.in and we will delete it.

11. Grievance officer / privacy contact

For any privacy question, complaint, or a grievance under India's Digital Personal Data Protection Act, 2023, contact: [Grievance Officer name to be inserted], reachable at info@promptsec.in. We aim to acknowledge every privacy inquiry within 2 business days and resolve it within 30 days. The same address also handles security vulnerability reports — see our Contact page.

12. Changes to this policy

We'll update the effective date above whenever this policy changes, and post the revised version here. For a material change — one that expands what we collect or how we use it — we'll also notify customer admins directly rather than relying on them to notice.