Privacy
Policy

Promptive, Inc. ("Promptive," "we," "us," or "our") operates the platform available at getpromptive.ai (the "Service"). This Privacy Policy explains what personal data we collect, how we use it, and what rights you have. It applies to visitors to our website and to subscribers who use our platform.

If you are accessing the Service on behalf of your employer or another organisation, "you" includes that organisation, and you represent that you have authority to accept this policy on their behalf.

1. Who We Are

Promptive, Inc. is responsible for personal data collected through the website and platform. Our primary contact for privacy matters is listed in Section 12.

2. Information We Collect

A. Account and Registration Data

When you create an account or start a free trial, we collect:

• First and last name
• Work email address
• Company name and your role within it
• Password (stored as a salted hash; we never store your plaintext password)
• If you register via Google OAuth, your Google account name, email address, and profile picture URL

B. Subscription and Billing Data

When you subscribe to a paid plan, payments are processed by our third-party payment processor (Stripe). We receive a tokenised payment reference, the last four digits of your card, card type, billing country, and subscription status. We do not store full card numbers or CVV codes on our servers.

C. Product and Configuration Data

To provide the Service, we store data you enter or configure, including:

• Brand names, product names, and website domains you are tracking
• Competitor names and domains you define
• Prompt text and prompt templates you create or save
• Alert rules and notification preferences
• AI engine responses retrieved on your behalf (i.e., what ChatGPT, Claude, Gemini, and Perplexity return when your tracked prompts are submitted)
• Annotations, tags, and notes you add within the platform

D. Usage and Log Data

We automatically collect technical information when you use the Service:

• IP address and approximate geographic location (city/region level)
• Browser type and version, operating system
• Pages viewed, features used, actions taken, and timestamps
• Referral source (how you arrived at our site)
• Error logs and performance metrics

E. Communications Data

If you contact our support team, respond to a survey, or send us an email, we retain the content of those communications and any contact details you provide.

3. How We Use Your Information

We use the data we collect to:

• Provide and operate the Service — deliver AI visibility monitoring, citation tracking, sentiment scoring, and alerts as described on our pricing page
• Manage your account — create and authenticate your account, process subscription payments, send receipts and renewal reminders
• Improve the platform — analyse usage patterns to fix bugs, improve performance, and prioritise new features; this analysis uses aggregated or de-identified data wherever possible
• Communicate with you — send transactional emails (password resets, billing notices, security alerts) and, with your consent, product update emails (roughly monthly; unsubscribe anytime)
• Ensure security and prevent fraud — detect and investigate unauthorised access, abuse, or violations of our Terms of Service
• Comply with legal obligations — respond to lawful requests from courts or regulatory authorities

4. How We Share Your Information

We do not sell your personal data. We do not share your data with third parties for their own marketing purposes.

We share data only in the following circumstances:

• Service providers — companies we engage to help operate the Service, including cloud hosting (Vercel/AWS), payment processing (Stripe), transactional email (e.g., SendGrid), and customer support tooling. These providers act on our instructions and are contractually bound to protect your data.
• Analytics — we use Google Analytics (GA4) on our marketing website to understand visitor behaviour. Google Analytics collects usage data subject to Google's Privacy Policy. We have enabled IP anonymisation. You can opt out via Google's opt-out browser add-on.
• AI model providers. Promptive uses third-party AI models in two ways. (1) Visibility tracking: we send your tracked prompts to AI engines (OpenAI/ChatGPT, Anthropic/Claude, Google/Gemini, Perplexity) to see how they answer. (2) Autopilot: to plan and write content and site fixes, we send relevant inputs to AI models, including your site's page content, your brand and voice settings, your tracked prompts, and, if you connect Google Search Console, the search queries and page performance figures for your site. These requests are routed through OpenRouter and processed by the providers above under their API terms, which do not permit using API inputs to train their models. We send only what a task needs, and we never send your account credentials, payment details, or OAuth tokens to any AI provider.
• Platforms you connect. When you connect a website platform (WordPress, Shopify, Webflow, HubSpot, GitHub, Vercel, or Lovable), Promptive sends the changes you approve, or that you have set Autopilot to make, back to that platform on your behalf. We read only the content needed to make those changes.
• Business transfers — if Promptive is acquired, merges with another company, or transfers substantially all its assets, your data may be transferred as part of that transaction. We will notify you before your data becomes subject to a different privacy policy.
• Legal compliance — we may disclose your data when required by law, valid court order, or to protect the rights, safety, or property of Promptive or others.

5. Cookies and Tracking Technologies

We use the following types of cookies:

• Essential cookies — required for the platform to function (e.g., authentication sessions). These cannot be disabled without breaking the Service.
• Analytics cookies — Google Analytics cookies (e.g., _ga, _gid) that help us understand how visitors use our marketing website. You can opt out via your browser settings or the Google Analytics opt-out add-on.
• Preference cookies — may be used to remember your UI preferences (e.g., theme, language) within the platform.

We do not use advertising or cross-site tracking cookies. You can control non-essential cookies through your browser settings.

6. Data Retention

• Account data — retained for the duration of your active account plus 90 days following account closure or deletion, to allow for dispute resolution and legal compliance.
• AI engine response data and prompt data — retained for the duration of your subscription. Upon account closure, this data is deleted within 90 days unless you request earlier deletion or we are required by law to retain it.
• Billing records — retained for 7 years in accordance with tax and accounting regulations.
• Server and access logs — retained for 12 months, then deleted or anonymised.
• Support communications — retained for 3 years from the date of last contact.

You may request deletion of your personal data at any time (see Section 8). Note that some data may be retained in anonymised or aggregated form for analytics purposes after deletion.

7. Security

We take the security of your data seriously. Technical and organisational measures we employ include:

• TLS encryption for all data in transit
• Encryption of sensitive data at rest
• Passwords stored as salted hashes (bcrypt or equivalent)
• Role-based access controls for internal staff
• Incident response procedures and breach notification obligations

No system is 100% secure. In the event of a data breach that affects your personal data, we will notify you in accordance with applicable law.

8. Your Rights

All Users

• Access — you can access much of your personal data directly within the platform. You may also request a copy of all data we hold about you.
• Correction — you can update your account information in your profile settings at any time.
• Deletion — you may request deletion of your account and associated personal data by emailing admin@getpromptive.ai.
• Marketing opt-out — you may unsubscribe from marketing emails at any time using the unsubscribe link in each email or by emailing us.

California Residents (CCPA / CPRA)

California residents have additional rights including the right to know what personal information we collect, share, or sell (we do not sell personal information), the right to deletion, and the right to opt out of the sale or sharing of personal information. To exercise these rights, contact us at admin@getpromptive.ai.

We will respond to verifiable requests within 45 days. We will not discriminate against you for exercising any of these rights.

9. International Data Transfers

Promptive is based in the United States. If you are located outside the US, your data will be transferred to and processed in the United States and potentially other countries where our service providers operate. By using the Service, you consent to this transfer.

10. Children's Privacy

The Service is designed for business use and is not directed at individuals under the age of 16. We do not knowingly collect personal data from children under 16. If we learn we have inadvertently collected such data, we will delete it promptly. If you believe a minor has provided us with personal data, please contact us at admin@getpromptive.ai.

11. Changes to This Policy

We may update this Privacy Policy from time to time. For material changes (changes that meaningfully expand how we use your data or reduce your rights), we will notify you at least 30 days in advance by email and by posting a prominent notice on the platform. The "Last updated" date at the top of this page reflects when the most recent changes took effect.

Continued use of the Service after any change becomes effective constitutes your acceptance of the revised policy. If you do not agree to a material change, you may close your account before the change takes effect.

12. Shopify and Other Connected Stores

If you install Promptive on a Shopify store, we access the store's products, collections, pages, blog articles, files, and navigation menus needed to analyse and improve your site, using only the permissions shown when you install. We do not access customer records, orders, or payment information. Access tokens are encrypted at rest. When you uninstall the app, we stop accessing your store immediately and delete the store data we hold within 30 days. We honour Shopify's mandatory privacy requests (customer data request, customer redact, and shop redact) within the timeframes Shopify requires.

13. Google API Services and User-Connected Integrations

Limited Use Disclosure

Promptive's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

What Google Data We Access

If you choose to connect your Google account to Promptive, we request the following read-only OAuth scopes on your behalf:

• Google Analytics (analytics.readonly) — to retrieve traffic metrics, sessions, organic search performance, and related data from your Google Analytics property.
• Google Search Console (webmasters.readonly) — to retrieve search impression, click-through rate, query, and page performance data from your Search Console property.

We access only the minimum data necessary to deliver the features you request. We do not access your Gmail, Google Drive, contacts, calendar, or any other Google services beyond the scopes listed above.

How We Use Your Google Data

Data obtained from your connected Google accounts is used solely to:

• Display your site's Analytics and Search Console performance metrics inside your Promptive dashboard
• Generate the SEO and visibility reports that form the core of the Service you subscribed to
• Choose and prioritise the content and site improvements Autopilot makes for your site, for example finding pages that are close to ranking or questions people search for that your site does not answer yet. To do this, Search Console queries and page performance figures for your site may be sent to AI model providers through OpenRouter, only to produce work for your own site. Those providers may not use this data to train their models.

We do not:

• Use your Google data to serve, personalise, or target advertisements
• Sell, rent, or share your Google data with third parties for their own purposes
• Use your Google data to train machine-learning or AI models, ours or anyone else's
• Use one customer's Google data to produce work for another customer
• Build profiles about you or any individual using your Google data for purposes unrelated to providing the Service
• Allow humans to read your Google data unless you explicitly request support, provide consent, or we are required to do so for security or legal compliance

Security of Google OAuth Tokens

OAuth access tokens and refresh tokens obtained from Google are:

• Encrypted at rest using AES-256 (or equivalent industry-standard encryption)
• Stored in access-controlled infrastructure with least-privilege access policies
• Transmitted exclusively over TLS/HTTPS — never in plaintext
• Never logged in full in application or server logs

Retention and Deletion of Google Data

• OAuth tokens — deleted immediately when you disconnect your Google account from within Promptive, or within 30 days of account closure, whichever comes first.
• Cached Analytics and Search Console data — deleted within 30 days of disconnecting the integration or closing your account.

To request immediate deletion of your connected Google data, email admin@getpromptive.ai with the subject line "Google Data Deletion Request."

Revoking Google Access

You can disconnect your Google account at any time in either of the following ways:

• Within Promptive — go to Settings → Integrations and click "Disconnect" next to your Google account. This immediately revokes our access and queues your cached data for deletion.
• Directly via Google — visit myaccount.google.com/permissions, find "Promptive" in the list, and click "Remove Access."

Revoking access will not delete your Promptive account, but it will disable features that depend on Google Analytics and Search Console data until you reconnect.

14. Contact Us

For privacy-related questions, data access requests, or complaints, please contact:

• Email: admin@getpromptive.ai
• General: admin@getpromptive.ai
• Website: getpromptive.ai

We aim to respond to all privacy requests within 30 days. For complex requests we may require up to 90 days, in which case we will notify you of the extension.