Privacy Policy

1. Who we are

PromptMint (the "Service", at promptmint.app) is operated by [Your registered business / proprietor name] ("we", "us"), the data fiduciary/controller responsible for your personal data. This Privacy Policy explains how we handle your data when you use the Service. It should be read together with our Terms & Conditions.

2. Data we collect

We collect the following, depending on how you use the Service:

Data you give us

• Account data — your name, email address, and a securely hashed password (we never store your password in plain text).
• Google sign-in data — if you choose "Continue with Google", we receive your name, email, and Google account identifier from Google to create or match your account. We do not receive your Google password.
• Builder inputs — the keywords, product details, and text you enter to mint prompts, plus the prompts generated for you.
• Support and contact data — the name, email, topic, and message you send through the contact form or by email.

Data we collect automatically

• Usage data — your plan, mint balance and history, and which builders you use, so we can run the Service and show your usage.
• Technical data — session identifiers, and server logs that may include your IP address, browser type, and timestamps, kept for security and troubleshooting.

Payment data

When you buy a plan, your payment is processed by Razorpay. We receive confirmation details such as a payment/order identifier, amount, status, and plan — we do not collect or store your full card number, UPI ID, or bank credentials.

3. How and why we use your data

We use your data to:

• create and manage your account and authenticate sign-ins;
• provide the Service — run the builders, mint prompts, and track your mint balance and plan;
• process payments, activate plans, and keep billing records;
• send essential service emails — verification, password resets, plan activation, and expiry reminders;
• respond to your support messages and contact-form queries;
• keep the Service secure, prevent abuse and fraud, and enforce our Terms; and
• comply with our legal obligations.

We rely on the lawful bases available to us — performing our contract with you, your consent (for example, Google sign-in), our legitimate interests in running and securing the Service, and legal compliance.

4. When we share data

We do not sell your personal data. We share it only with trusted parties who help us run the Service, and only as needed:

• Razorpay — to process payments and prevent fraud.
• Google — if you use Google sign-in.
• Email and hosting providers — to deliver service emails and host the application.
• Authorities — where required by law, regulation, legal process, or to protect our rights, users, or the public.
• A successor — in connection with a merger, acquisition, or sale of assets, subject to this policy.

These providers process data on our instructions under their own security and privacy obligations.

5. Cookies and similar technologies

We use a small number of cookies and similar technologies, chiefly a session cookie that keeps you signed in and a token that protects forms against cross-site request forgery (CSRF). These are essential for the Service to function. We do not use third-party advertising cookies. You can block cookies in your browser, but the Service may not work correctly without the essential ones.

6. How long we keep data

We keep your personal data for as long as your account is active and as needed to provide the Service. After you close your account, we retain limited data where necessary to meet legal, tax, accounting, or dispute-resolution obligations, and then delete or anonymise it. Payment and invoice records may be retained for the period required by applicable financial and tax law.

7. How we protect your data

We take reasonable technical and organisational measures to protect your data, including password hashing, CSRF protection, restricted admin access, and security headers. No method of transmission or storage is completely secure, so we cannot guarantee absolute security — but we work to protect your data and to notify you and the authorities of a significant breach where the law requires.

8. Your rights and choices

Subject to applicable law (including India's Digital Personal Data Protection Act, 2023, and any other laws that apply to you), you may have the right to:

• access the personal data we hold about you;
• correct inaccurate or incomplete data;
• erase your data or close your account;
• withdraw consent you previously gave (for example, disconnect Google sign-in); and
• complain to us or to the relevant data-protection authority.

You can exercise these rights, or nominate someone to act on your behalf, by emailing madmarketingclub@gmail.com. We may need to verify your identity before acting on a request, and we will respond within the timelines the law requires.

9. Children

The Service is not directed to children, and you must be 18 or older to use it. We do not knowingly collect data from children. If you believe a child has provided us data, contact us and we will delete it.

10. International transfers

Some of our providers may process data on servers located outside your country. Where we transfer data across borders, we take steps to ensure it remains protected in line with this policy and applicable law.

11. Changes to this policy

We may update this Privacy Policy from time to time. We will change the "Last updated" date above and, for material changes, take reasonable steps to notify you. Please review it periodically.

12. Contact and grievances

For any privacy question, request, or complaint, contact us:

• Data controller / operator: [Your registered business / proprietor name]
• Address: [Your full registered business address, City, State, PIN, Country]
• General privacy contact: madmarketingclub@gmail.com
• Grievance Officer: [Name of Grievance Officer] — madmarketingclub@gmail.com

You can also reach us through our contact page. We aim to resolve privacy grievances within the timeframe required by law in India.