Privacy Policy

1. Who is responsible

Promptbar is operated by SAASFLOW OÜ, registration number 16834664, at Jõe tn 3-308, Kesklinna linnaosa, Tallinn, Harju maakond, 10151, Estonia. Contact us about privacy at contact@promptbar.io.

We act as a controller for information used to manage our business, customer accounts, support and service security. When a customer deploys Promptbar on its website, that customer generally decides why visitor conversations, connected content and lead details are processed, and we process that information on its behalf under applicable data processing terms.

If you interact with a prompt bar on someone else’s website, read that website’s privacy notice. The website operator is your first contact for questions about its sources, conversation collection, follow-up messages and use of your information. We can help identify the appropriate contact or assist with a request.

2. Information we handle

Account information may include your name, work email, authentication information, organization, workspace membership, role, settings and subscription records. If you choose an external sign-in service, we receive the information it supplies to authenticate and identify you.

Connected knowledge may include website pages, documents, help content, product resources and information retrieved from customer-selected integrations. Those sources can contain personal information that the customer or another publisher included. Sources may be public or supplied through a connection the customer authorizes.

Conversation information may include questions, messages, generated answers, source references, timestamps and the page where an interaction takes place. Depending on the configuration, it may also include resources selected, feedback and a conversation or visitor identifier used to maintain the interaction.

If lead capture or meeting booking is enabled, information may include the name, email, organization, role, needs and other details a visitor submits, qualification or routing results, and scheduling details. The fields and recipients depend on the website operator’s setup and the choices the visitor makes.

Technical information may include IP addresses, browser and device information, request logs, errors and service activity. Communications include information you send us for support or other inquiries. Purchases create transaction and subscription records; Paddle handles checkout and payment information through its own systems.

3. Purposes and legal bases

We use account information to provide access, manage workspaces and subscriptions, communicate about the service and answer support requests. For an individual customer, processing necessary to supply the agreed service is based on our contract. When dealing with an organization’s representatives, our basis is our legitimate interest in managing that business relationship.

Our legitimate interests also include securing the service, preventing abuse, diagnosing faults and maintaining business records. We consider the effect on individuals when relying on these interests. We process records required by accounting or other laws to meet legal obligations. Where consent is required for an optional activity, it may be withdrawn without affecting earlier lawful processing.

For customer-controlled conversations and content, we follow the customer’s instructions to retrieve relevant sources, generate answers, present resources and carry out enabled lead or booking workflows. The customer is responsible for the legal basis and notices for those activities. Some information is needed for a requested feature; for example, a meeting invitation cannot be sent without the relevant contact details.

4. AI processing and qualification

Generating an answer may involve sending a visitor’s question, relevant conversation context and selected source content to an AI processing provider. The inputs involved depend on the feature and configuration. Do not include unnecessary sensitive information, credentials or material you are not entitled to disclose in a question or connected source.

Where enabled, qualification and routing can use submitted details and conversation context to categorize an inquiry or direct it to a team, resource or booking option. The website operator chooses the business purpose and use of these results. Ask that operator about its configuration and any decision affecting you; AI results can be inaccurate.

For details about the AI providers, processing locations or data-use terms relevant to a particular feature, contact contact@promptbar.io before submitting sensitive or regulated information.

5. Recipients and integrations

Authorized members of a customer’s workspace may access conversations, source content and lead information according to their permissions. Answers and source references are shown to the visitor interacting with the prompt bar. Information sent in a conversation may therefore be available to the website operator and its authorized team.

Depending on enabled features, providers may process information for hosting, storage, authentication, AI responses, email delivery, technical monitoring and support. Connected customer tools may receive conversation, contact or scheduling information when the customer enables that workflow. Their use of information is also subject to the applicable customer arrangements and their own privacy notices.

Paddle acts as authorized reseller and merchant of record for purchases made through its checkout and processes purchase information under its own privacy notice. We receive the transaction information needed to supply the subscription and support the customer.

We may disclose information where required by law, to address abuse or protect rights and safety, or as part of a business transfer subject to applicable protections. Contact us for information about the providers and processing terms relevant to your use.

6. Website requests, cookies and browser storage

The public marketing website does not load advertising or third-party analytics scripts. Hosting and security infrastructure still receives technical connection information when a page is requested.

The marketing website loads fonts through Fontshare’s external stylesheet and font delivery services. Your browser contacts those services to display the fonts, which exposes technical request information such as your IP address and browser information to the font delivery providers.

The application and embedded prompt bars may use cookies or browser storage for sign-in, preferences, security or conversation functionality. The storage involved depends on the feature and website configuration. Where optional tracking requires consent, it must be subject to that consent.

You can manage cookies and site permissions in your browser. Blocking necessary storage may affect sign-in or other requested features. External links and connected services are subject to their own privacy practices.

• About Fontshare

7. International processing and security

Providers or connected services may process information outside your country, including outside the European Economic Area. Where European data protection law applies, transfers require an appropriate legal mechanism, such as an applicable adequacy decision, Standard Contractual Clauses or another permitted safeguard. Contact us for the locations and safeguards relevant to your information or a particular feature.

We use technical and organizational measures appropriate to the service and information involved. No online service can guarantee absolute security. Protect account credentials, review integration permissions and tell us promptly if you suspect unauthorized access.

8. Retention and deletion

Retention depends on the purpose, account status, customer instructions, settings, applicable agreements and legal requirements. We retain information for as long as needed to provide the service, handle support, protect against misuse, resolve disputes or meet legal obligations. Some transaction and business records must remain after an account closes.

Customer-controlled conversations, sources and lead records are handled according to the customer’s instructions and applicable agreements. Contact the website operator about its retention choices. Copies transferred to a customer’s other tools are subject to the arrangements for those tools.

You can contact us to request account or information deletion or ask about a specific retention period. Removal from active systems may not immediately remove backup copies or copies independently retained by other recipients.

9. Your rights and complaints

Depending on applicable law, you may request access to, correction of, deletion of or a portable copy of your personal information; restrict or object to processing; withdraw consent; and exercise rights concerning automated decisions that significantly affect you. Conditions and exceptions apply. Send requests to contact@promptbar.io. We may verify your identity or authority before responding.

Where we process information for a customer, we may direct your request to that customer or help it respond. You can complain to your local data protection authority. Our Estonian supervisory authority is the Andmekaitse Inspektsioon.

• Contact Promptbar about privacy
• Estonian Data Protection Inspectorate

10. Children and policy changes

Promptbar accounts are intended for adults and professional use. Customers control the audiences and notices for their own websites and must meet applicable requirements if children can interact with a prompt bar. Contact us if you believe a child’s information has been collected without the required authorization.

We may update this policy as the service or legal requirements change. The date above identifies this version. We will provide additional notice when required by law or when a change materially affects how we handle personal information.