PRIVACY POLICY

Information We Collect

1.1 Information You Provide

We may collect personal information that you submit directly, including:

• Registration and account details
• Billing and payment information
• Information provided in support requests or communications
• Content, prompts, or data submitted through the Service

1.2 Automatically Collected Data

When you use the Service, we may automatically collect:

• IP address, device information, browser details
• Usage activity, feature interactions, logs

This automatic collection applies to the authenticated application. See Cookies and Tracking below for what this website does and does not do.

1.3 Third-Party Sources

We may receive personal or usage-related information from:

• Payment processors
• Authentication providers
• Analytics and hosting partners
• Fraud prevention and security services

How We Use Your Information

PromptGuard may use personal information for purposes including, but not limited to:

• Operating, supporting, and improving the Service
• Enforcing our Terms & Conditions
• Detecting fraud, abuse, or security incidents
• Managing billing, subscriptions, and account changes
• Conducting analytics, performance monitoring, and product optimisation
• Communicating administrative updates or service-related notices
• Complying with legal obligations

We reserve the right to use aggregated, de-identified, or anonymised data for any lawful purpose.

Legal Bases (GDPR Where Applicable)

We rely on the following bases for processing:

• Performance of a contract
• Legitimate interests, including security, product efficiency, and customer management
• Compliance with legal obligations
• Consent, where explicitly required

Sharing and Disclosure

We may disclose information to:

• Service providers supporting hosting, infrastructure, analytics, and billing
• Legal authorities when required by law, subpoena, or government request
• Professional advisors (e.g., lawyers, auditors)
• Successors in the event of a merger, acquisition, or corporate transaction

PromptGuard is not responsible for the practices of third parties.

International Transfers

Your information may be transferred and processed outside your jurisdiction. We implement appropriate safeguards where required, including Standard Contractual Clauses (SCCs).

Data Retention

We retain personal data for as long as necessary to fulfil the purposes outlined in this Policy or to comply with legal, regulatory, or operational requirements. PromptGuard reserves the right to retain anonymised or aggregated data indefinitely.

Your Rights

Where applicable under GDPR or CCPA, you may have rights with respect to your personal data. Requests may be subject to verification and legal exceptions. PromptGuard reserves the right to deny requests where legally permissible or where fulfilling the request would adversely affect system integrity, security, or operations.

Cookies and Tracking

This website (promptguard.co) sets no cookies of its own and runs no advertising, no session recording, and no cross-site tracking. Dismissing the notice at the bottom of the page stores a single value in your browser's local storage so we do not show it to you again. It loads one third-party script, Vercel Web Analytics, described below.

We count page views two ways, and they are not the same.

Our own counter runs on our own servers. For each page load it records which page was opened, whether a button was clicked, whether the page was read to the end, the referring site, and any campaign tag in the link you followed. It does not record your IP address, your browser, or any cookie, identifier, or fingerprint, and each page load is tagged with a random number that is never stored in your browser — so two visits by you cannot be connected to each other, by us or by anyone reading the data. Nothing in it is sent to any third party, and the records are deleted after 90 days.

Vercel Web Analytics is a third party, and it collects more. It sets no cookie, but it identifies you by a hash computed from your request, which is discarded after 24 hours — so within a single day two of your page loads can be connected to each other, which our own counter cannot do. It records the page, the referring site, campaign tags, your country, region and city, your browser and its version, your operating system, and your device type. That data goes to Vercel and is held under their terms. We added it because it gives us a dashboard we can share; we are telling you exactly what it costs you because a security vendor that quietly adds a tracker has sold the argument it is making.

If your browser sends a Do Not Track or Global Privacy Control signal, we record nothing at all — not in our own counter, and not in Vercel's. Vercel does not honour those signals by itself; we do not load it when you send one.

The authenticated application (app.promptguard.co) stores your session in your browser so you stay signed in, and relies on our payment and authentication providers, which set their own cookies under their own policies. It carries no analytics of any kind.

Data Security

PromptGuard implements commercially reasonable technical, organisational, and administrative safeguards designed to protect personal data. However, no method of storage or transmission is completely secure, and PromptGuard does not guarantee absolute security. You acknowledge that you provide information and access the Service at your own risk, and PromptGuard shall not be liable for any unauthorised access, breach, or security incident except where required by applicable law.

Children's Information

The Service is not intended for individuals under 18. We do not knowingly collect data from such individuals. If you become aware that a child has provided us with personal information, please contact us.

Third-Party App Integrations (ChatGPT, Codex, AI Editors)

PromptGuard is available as a connected app within third-party AI platforms including ChatGPT (via the OpenAI Apps SDK), Codex, Cursor, and other MCP-compatible editors. When you connect PromptGuard through these platforms:

• Authentication: We use OAuth 2.1 (via Auth0) to authenticate your identity. We receive your email address and basic profile information from the identity provider (GitHub or Google) you use to log in. We do not receive or store your password.
• Content processing: Text submitted for scanning or PII redaction is processed in real time and is not stored beyond the duration of the request unless you have explicitly enabled logging in your PromptGuard dashboard settings.
• Code analysis: Code submitted for LLM SDK detection is analyzed in memory using pattern matching. No code is stored, transmitted to third parties, or used for model training.
• Usage data: We record metadata about tool invocations (tool name, timestamp, response status) for billing, rate limiting, and abuse prevention. This metadata does not include the content of your prompts or text.
• Third-party platform data: We do not access your conversations, files, or any data within ChatGPT, Codex, or other AI platforms beyond what you explicitly submit to a PromptGuard tool.

You can disconnect PromptGuard from any third-party platform at any time through that platform's settings. Disconnecting revokes the OAuth token and stops all data processing through that integration.

Live Analyzer Demo (promptguard.co)

The interactive analyzer on our home page no longer transmits anything. As of 11 August 2026 it renders verdicts recorded in advance from our production engine and shipped with the page; the input box is disabled and there is no request to our API or to anyone else when you use it.

• What is sent: nothing. There is no live endpoint behind that surface. It was removed rather than rate-limited, because an anonymous caller with unlimited attempts against a detection engine can use it to search for inputs that evade it.
• Third-party inference: none for this surface. Hugging Face and Groq were previously subprocessors here, because the demo forwarded scanned prompts to them to generate a reply. That no longer happens and they are no longer subprocessors for the home page.
• Retention: nothing to retain. No prompt is collected, stored, or associated with an account.

To run your own prompts through the engine, create an account and use the authenticated playground, or use a trial API key against your own environment. That traffic is governed by the rest of this Policy.

Changes to This Policy

We may revise this Policy at any time. Updated versions will be posted on this page with a revised "Last Updated" date.

Contact Information

For privacy-related inquiries, please contact:

Email: info@promptguard.coCopy
Website: promptguard.co