Privacy notice

Effective: 15 October 2026

Controller

Progizer Bt

Registered office

Fajsz

Company registration number

03-06-116726

Tax number

32155659-1-03

E-mail

bsprog007@gmail.com

1. What this notice covers

This notice covers the PromptChat services operated by the controller named above ("we"):

• the license portal (portal.promptchat.com): sign-up, sign-in, licenses, subscriptions and payments;
• the PromptChat website and the demo installation (demo.promptchat.com).

When a reseller or another company runs PromptChat on its own server, that company is responsible for the data handled there (for example, the visitors chatting on its website, or the users signing in there with Google), and its own privacy notice applies.

2. What data we handle, why, and on what legal basis

User account

• Data: name, e-mail address, password (only as an irreversible hash), the chosen language, the time of sign-up.
• Purpose: creating the account, signing in, managing licenses.
• Legal basis: performance of a contract (GDPR Art. 6(1)(b)).
• Retention: until the account is deleted.

Sign-in with Google

If you choose "Sign in with Google" or "Sign up with Google", Google shares with us, with your consent, your name, e-mail address, the address of your profile picture and your Google account ID. We use these only to create your account and sign you in; if you already have an account with the same e-mail address, the Google sign-in is linked to it.

We don't ask for access to your Gmail, contacts, Google Drive or any other Google data. We don't sell the data received from Google, don't use it for advertising, and don't share it with third parties. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

You can remove the connection at any time in your Google account settings (myaccount.google.com/permissions).

• Legal basis: performance of a contract (GDPR Art. 6(1)(b)).
• Retention: until the account is deleted.

Licenses, subscriptions, billing

• Data: company name, country, VAT number, phone number, the chosen plan, license and order details, payment status.
• Card payments are handled by Stripe: we never see or store card details.
• Purpose: fulfilling orders, invoicing.
• Legal basis: performance of a contract; keeping accounting records is a legal obligation (GDPR Art. 6(1)(c), Hungarian Accounting Act C of 2000, section 169).
• Retention: until the contract ends; accounting records for 8 years.

License data from PromptChat installations

Licensed PromptChat installations check in with the portal regularly to keep their license valid. They send the installation's ID, domain, IP address and version, and the usage data needed to check the plan's limits: the number and names of the workspaces, users, AI assistants and channels, and the number of conversations and AI replies in the last 30 days. Installations never send the content of conversations.

• Purpose: validating the license, checking the plan's limits, troubleshooting and support.
• Legal basis: performance of a contract; for the names of an installation's users, legitimate interest (GDPR Art. 6(1)(f)): checking the number of users the license allows.
• Retention: until the license is deleted; only the latest usage report is kept.

Sign-in session and security

• Data: IP address, browser identifier (user agent), time of sign-in.
• Purpose: keeping you signed in, preventing abuse.
• Legal basis: legitimate interest (GDPR Art. 6(1)(f)).
• Retention: until the session expires, at most 30 days.

Service e-mails and correspondence

We send the e-mails the service needs (for example, password reset, invitations, license issued, payment notices). We don't send newsletters or marketing e-mails. If you write to us, we keep your message and the details needed to answer it until the matter is closed, and for at most 1 year after that.

The demo installation

The data entered while trying demo.promptchat.com (company name, users' names and e-mail addresses, uploaded content and test conversations) is handled to let you try the product, until the account is deleted; we delete it at any time on request. To write an AI reply in a conversation, the configured AI provider receives the message being answered.

3. Who can access the data

Only we and the processors below can access the data, and only for the stated purpose:

• Contabo GmbH (Aschauer Straße 32a, 81549 Munich, Germany) – server hosting. The servers are in the European Union (France).
• Stripe Payments Europe, Ltd. (1 Grand Canal Street Lower, Dublin 2, Ireland) – card payments, subscriptions, invoices.
• Google Ireland Ltd. (Gordon House, Barrow Street, Dublin 4, Ireland) – sign-in with Google, delivery of service e-mails (Gmail), and the website's fonts (Google Fonts).
• On the demo installation, the AI provider configured for conversations (for example OpenAI, Anthropic or Google) – it only receives the message being answered.

We may disclose data to an authority where the law requires it.

4. Transfers outside the EU

The parent companies of Stripe and Google are based in the United States. Any transfer relies on the EU–US Data Privacy Framework and the European Commission's Standard Contractual Clauses.

5. Cookies

The portal only uses cookies it needs to work: the sign-in session cookie and one that remembers whether the sidebar is open. The chosen language is remembered in your browser's local storage. The portal doesn't use analytics, tracking or advertising cookies.

On the website, only if you agree in the cookie banner, we measure visits with Google Analytics cookies (named _ga…, kept for up to 2 years): how many visitors come, from where, and which parts they look at. Google Ireland Ltd. does the measuring; data may also go to the United States (see section 4). Legal basis: consent (GDPR Art. 6(1)(a)). You can withdraw it at any time with the "Cookie settings" link at the bottom of the website.

6. Security

Connections are encrypted (HTTPS), passwords are stored only as irreversible hashes, the services' secret keys are stored encrypted, and only the operator can access the servers.

7. Your rights

You can ask us to:

• tell you what data we hold about you, and give you a copy;
• correct inaccurate data;
• delete your data (except what the law requires us to keep);
• restrict the processing;
• hand over your data in a machine-readable format (portability);
• stop processing based on legitimate interest (objection).

Send your request by e-mail (bsprog007@gmail.com); we answer within one month at the latest.

8. Complaints

If you feel your rights were violated, please write to us first. You can lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH; Falk Miksa utca 9–11, 1055 Budapest, Hungary; ugyfelszolgalat@naih.hu; naih.hu) or the data protection authority of your country, or go to court.

9. Changes

We may update this notice; the current version is always on this page, with the date above.