プライバシーポリシー

1. Who we are and what this policy covers

Promptora (“we”, “us”, or “our”) operates aiphotoeditingprompts.online, including the AI photo prompt library, account features, guides, and optional AI-assisted tools (the “Service”). We are the controller of the personal data described in this policy, except where a third-party service processes data for its own purposes. This policy applies to the website, our support emails, and any related services that link to it. It does not apply to third-party websites, apps, or AI models that you use separately.

2. Key points

• You can browse, search, and copy prompts without creating an account.
• Signing in is optional. If you sign in with Google, we receive your basic Google profile and create a Supabase account record.
• We use analytics and similar technologies to understand how the Service is used. You can opt out as described below.
• If you use an AI feature, the prompt and any reference image you submit are processed by us and by third-party AI model providers to produce the result. Do not upload sensitive personal data.
• We do not sell your personal information, and we do not use your prompts or images to train our own AI models.
• You can request access to, correction of, or deletion of your personal data, or object to certain processing.

3. Information you provide to us

We collect the information you choose to give us, including:

• Account data. If you sign in with Google, we receive your Google account identifier, name, email address, and profile image. We do not receive your Google password. We use Supabase to create and manage your account.
• User Content. Prompts you submit, reference images you upload, generated outputs, saved prompts, collections, likes, coloring progress, comments, feedback, support messages, and reports you send to us.
• Payment and transaction data. If you purchase credits or a paid plan, our payment processor collects your payment details. We receive transaction status, amount, currency, the credits or plan purchased, and limited billing details such as country or the last four digits of a card, if the processor provides them. We do not store full payment card numbers.
• Communications. The content of emails, reports, and other messages you send to us, together with your contact details.

4. Information collected automatically

When you visit or use the Service, we and our service providers may automatically collect standard technical information, including your IP address, approximate location derived from your IP address, device and browser type, operating system, language, referring and exit pages, pages viewed, timestamps, clicks and other interactions, error and performance logs, and an anonymous visitor identifier stored in your browser. We use this information to operate, secure, analyze, and improve the Service, and to understand which prompts and languages are useful.

5. Cookies and similar technologies

We use cookies, local storage, and similar technologies. Strictly necessary technologies keep you signed in, protect the Service, balance traffic, remember your language, and store your cookie choices. Functional technologies remember your anonymous visitor identifier, liked prompts, saved items, and coloring progress. Analytics technologies, including Google Analytics 4 and Microsoft Clarity, may set cookies and collect usage data such as pages viewed, clicks, mouse movements, and session replays. We do not use advertising cookies or cross-site behavioral tracking cookies. You can block or delete cookies in your browser, but blocking strictly necessary cookies may prevent sign-in. You can opt out of Google Analytics with Google’s opt-out browser add-on, and you can opt out of Microsoft Clarity by using its opt-out page or blocking clarity.ms. You can also object to or withdraw consent for analytics at any time by emailing [email protected]; we will stop using analytics for your browser where required by law.

6. How we use information and our legal bases

We use personal data to:

• Provide the Service, create and manage accounts, process prompts and images, deliver outputs, and administer credits and plans.
• Remember your preferences and personalize your experience.
• Respond to support requests, reports, and questions.
• Monitor, secure, debug, and improve the Service, including detecting fraud, abuse, and policy violations.
• Measure traffic and understand how the Service is used.
• Comply with legal obligations, enforce our Terms, and protect our rights and the rights of others.
• Evaluate or carry out a business transaction, such as a merger or acquisition, subject to appropriate safeguards.

7. Legal bases for EEA and UK users

Where the GDPR or UK GDPR applies, we rely on the following legal bases: performance of a contract (providing the Service you request), legitimate interests (operating, securing, and improving the Service, and understanding its use), consent (where we ask for it, such as for certain cookies or communications), and legal obligation (tax, accounting, and lawful requests). Where we rely on legitimate interests, you may object as described in the rights section below.

8. AI features and your content

If you use an AI generation feature, the prompt text and any reference image you submit are transmitted to our backend and to third-party AI model providers that generate the result. Those providers may process the data in the United States or other countries. We do not use your prompts or images to train our own models. Where an AI provider offers a setting that prevents training on submitted content, we use that setting; otherwise, the provider’s own terms and privacy policy govern its processing. Generated outputs may be stored in your account or generation history. If you choose to share an output publicly, it may be visible to others. Do not submit government identification, health information, financial account details, precise location, or other sensitive personal data, and do not upload images of other people without their permission. We may review prompts, images, and outputs for safety, security, and policy enforcement.

9. How we share information

We do not sell, rent, or trade your personal information. We share personal data only as described below:

• Service providers. We use vendors that help us host and operate the Service, including Vercel (hosting), Supabase (authentication, database, and storage), Cloudflare (DNS, content delivery, and asset storage), Google (sign-in and analytics), Microsoft (Clarity analytics), our AI model providers, our payment processor, and our email and support tools. These providers process data on our behalf under contractual obligations.
• Legal and safety. We may disclose information if we believe it is necessary to comply with law or a valid legal request, protect the rights or safety of any person, investigate fraud or abuse, or enforce our Terms.
• Business transfers. If we are involved in a merger, acquisition, financing, reorganization, or sale of assets, personal data may be transferred as part of that transaction, subject to appropriate safeguards.
• With your consent. We may share information for other purposes when you ask us to or consent.
• Public content. If you submit a prompt or other content for public display, we may publish it together with your display name or profile image.

10. International data transfers

We and our service providers may process personal data in the United States, the European Economic Area, the United Kingdom, Singapore, and other countries where we or our providers operate. These countries may have data protection laws that differ from those in your country. Where required, we rely on appropriate safeguards, such as standard contractual clauses approved by the European Commission or the UK International Data Transfer Addendum, together with supplementary measures where appropriate. You can contact us for more information about the safeguards we use.

11. Data retention

We retain personal data for as long as necessary for the purposes described in this policy:

• Account data is retained while your account is active and for a reasonable period after you request deletion, to allow us to process the request and maintain backup and security records.
• User Content is retained until you delete it or delete your account, except where it has been shared publicly or is needed for legal, security, or abuse-prevention purposes.
• Server and security logs are typically retained for a limited period, usually no longer than 90 days, unless a longer period is needed to investigate an incident.
• Analytics data is retained according to the provider’s settings, typically for up to 14 months.
• Support and report records are typically retained for up to 24 months after the matter is closed.
• Payment and tax records are retained for the period required by applicable law, which is often seven years.
• Aggregated or de-identified data that cannot reasonably be linked to you may be retained indefinitely.

12. Security

We use reasonable technical and organizational measures designed to protect personal data, including HTTPS encryption, access controls, least-privilege permissions, database security controls, monitoring, and backups. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we become aware of a breach that is likely to result in a high risk to your rights and freedoms, we will notify you and the relevant authorities as required by law.

13. Your privacy rights

Depending on where you live, you may have some or all of the following rights:

• Access. Request a copy of the personal data we hold about you.
• Correction. Ask us to correct inaccurate or incomplete data.
• Deletion. Ask us to delete personal data, subject to legal exceptions.
• Restriction and objection. Ask us to restrict certain processing or object to processing based on legitimate interests.
• Portability. Request a portable copy of data you provided to us, where the law provides this right.
• Withdraw consent. Withdraw consent at any time where we rely on consent; withdrawal does not affect processing that already occurred.
• Non-discrimination. We will not discriminate against you for exercising your privacy rights.
• Complaint. Lodge a complaint with your local data protection authority.

14. How to exercise your rights

To make a request, email [email protected] with the subject line “Privacy Request”. Tell us what you want and include enough information for us to verify your identity and locate your data. We may ask for additional verification to protect your account. We will respond within the time required by applicable law, generally within 30 days, and we will explain any extension. You may use an authorized agent where the law allows it; we may require written permission and verification. If we deny your request, you may appeal by replying with the subject line “Privacy Appeal”.

15. California and other U.S. state privacy notices

If you are a California resident, the categories of personal information we collect are: identifiers (such as name, email address, IP address, and device identifiers); commercial information (such as purchases and credits); internet or network activity (such as pages viewed and interactions); geolocation data (approximate location derived from IP address); audio, visual, or similar information (such as images you upload); and inferences drawn from the above. We collect these categories from you, automatically, and from service providers. We use them for the purposes described in this policy. We do not sell personal information or share it for cross-context behavioral advertising, and we do not knowingly sell or share the personal information of consumers under 16. We retain data as described in the retention section. California residents may request to know, access, correct, or delete personal information, and may designate an authorized agent, by contacting us as described above. You also have the right not to receive discriminatory treatment for exercising these rights. Residents of other U.S. states with comprehensive privacy laws may have similar rights, including the right to appeal a decision. California residents may also request information about our disclosure of personal information to third parties for their direct marketing purposes; we do not disclose personal information for that purpose.

16. Do Not Track and Global Privacy Control

Some browsers send “Do Not Track” signals. Because we do not sell personal information or share it for cross-context behavioral advertising, we do not currently respond differently to Do Not Track signals. Where required, we honor Global Privacy Control signals for opt-out rights. You can also use the cookie and analytics controls described in this policy.

17. Marketing communications

We send transactional and service-related messages, such as sign-in, security, purchase, and support messages. We do not currently send marketing newsletters. If we introduce marketing communications, we will provide a way to opt out, and where required, we will ask for your consent first. You can opt out of marketing messages without affecting service messages.

18. Children’s privacy

The Service is not directed to children under 13, or under 16 where the law of your country requires a higher age for data protection consent. We do not knowingly collect personal data from children below the applicable age. If you are under 18, you should use the Service only with the involvement and permission of a parent or guardian. If we learn that we have collected personal data from a child without the required consent, we will delete it. If you believe a child has provided us with personal data, contact us at [email protected].

19. Third-party services and links

The Service may link to third-party websites, tools, or AI models, and may embed third-party features. We are not responsible for the privacy practices of those third parties. We encourage you to review their privacy policies before providing them with personal data. If you use a third-party AI model with a prompt from our library, that provider’s terms and privacy policy apply to your use of its service.

20. Automated decision-making

We do not make decisions that produce legal effects or similarly significant effects concerning you based solely on automated processing. We may use automated tools for content moderation, spam and fraud prevention, security, and analytics. Where appropriate, humans review automated decisions, and you can contact us to request human review of a moderation decision that affects you.

21. Changes to this policy

We may update this policy from time to time. We will post the updated version on this page and change the effective date at the top. If a change is material, we will provide additional notice, such as an email or a prominent notice on the Service, where required by law. Continued use of the Service after the effective date means you accept the updated policy to the extent permitted by law. Where the law requires consent, we will ask for it.

22. Contact us

For privacy questions, requests, or complaints, contact Promptora at [email protected]. We aim to respond within 30 days. If you are in the EEA or the UK, you also have the right to complain to your local data protection authority.