GDPR & Processing
Privacy & GDPR
Last updated: 7 October 2026
Data Controller
ma-kom agentur UG (haftungsbeschränkt)
Merkelbach 12, 74541 Vellberg, Germany
Email: mail@promptopoly.com
Managing Director: Pascal Sanwald
We have not appointed a data protection officer. The controller named above is the contact for all data protection questions.
Purpose of Processing
Promptopoly processes personal data to provide user accounts, repository and workspace functions, license and payment processing, support, security, monitoring, and optional integrations.
Processed Data
- Contact data such as name and email address
- Account data, roles, and permissions
- Workspace, repository, and team metadata
- Billing and payment references
- Security and monitoring data for stability and abuse prevention
Legal Basis
Processing is carried out pursuant to Art. 6(1)(b) GDPR for contract performance, Art. 6(1)(c) GDPR for legal obligations, and Art. 6(1)(f) GDPR based on legitimate interests in security, availability, abuse protection, and product operation.
Server Logs, Retention and Provision of Data
When you open the website and the interfaces, the web server log records IP address, time, requested address and browser identifier (Art. 6(1)(f) GDPR: operation, troubleshooting, security). They are stored on our hosting, rotated daily and deleted after seven rotations, i.e. after about 8 days.
- Customer account and workspace data: until the account is deleted, afterwards only as far as retention is required by law.
- Invoice and payment data: 8 years (tax and commercial law retention, Art. 6(1)(c) GDPR).
- Gateway logs: see section "AI gateway" (excerpt 90 days, responses 7 days).
- Consent log: 3 years.
Name and email address are required for the account and the contract; without them we cannot perform the contract. All other details are voluntary. No decision based solely on automated processing with legal effect (Art. 22 GDPR) takes place.
Cookies and Tracking
We use cookies and similar technologies. You can consent or decline via our cookie banner. You can change or withdraw your choice at any time via the "Cookie settings" link in the footer of every page.
| Technology | Purpose | Duration | Provider |
|---|---|---|---|
| promptopoly_session | Authentication and session | Session | own |
| cookieConsent_v2 | Stores your cookie consent | 1 year | own |
| _gclid | Google Click Identifier (only after consent) | 90 days | |
| _ga, _gid | Google Analytics (only after consent) | up to 2 years |
The Google script (Google Ads, Google Analytics) is only loaded after your explicit consent (Consent Mode v2, basic mode). Before your choice and after a refusal no connection to Google is made and no marketing or analytics cookies are set. The legal basis is your consent (Art. 6(1)(a) GDPR, section 25(1) TDDDG), which you can withdraw at any time with effect for the future.
Consent log. To prove your choice (Art. 7(1) GDPR; Art. 6(1)(c) and (f) GDPR) we store your decision, a session identifier, a hash of your IP address and a hash of the browser identifier (no plain-text values), and delete the entry after 3 years.
Processors
- Webspace-Verkauf.de ISP e.K., Grub am Forst — server hosting in Germany
- Stripe Payments Europe, Ltd. — Payment processing (Ireland)
- Google Ireland Limited — Marketing measurement (only after consent)
- Anthropic Ireland, Limited, Dublin (processing by Anthropic, PBC, USA) — AI models (Claude) behind the AI gateway, lowest priority in the provider chain
- OpenAI Ireland Ltd., Dublin (processing by OpenAI OpCo, LLC, USA) — AI models (GPT) behind the AI gateway
- Google LLC, Mountain View (USA) — AI models (Gemini API, paid tier) behind the AI gateway
AI gateway and the providers behind it
Our AI gateway (promptopoly.com/api/v1/proxy) forwards requests to AI providers. We process the transmitted texts (prompts and responses) only for forwarding, billing and abuse prevention; per call we log time, key, model, provider, token count and cost. In addition we store an excerpt of your input (the first 200 characters) for 90 days and the model response for 7 days; afterwards both are deleted or redacted. The per-call metadata (without prompt content) is kept as billing evidence until the statutory retention period ends (8 years, Section 147 AO, Section 257 HGB). The purposes are billing, troubleshooting, abuse prevention and not executing a repeated call twice (idempotency); the legal basis is Art. 6(1)(b) and (f) GDPR. If a provider fails, the gateway may pass the request to the next provider in the chain configured for your key. The providers a key may use can be restricted per key.
| Provider | Seat / processing | Contract | Transfer basis |
|---|---|---|---|
| Anthropic Ireland, Limited (Claude) | Ireland; processing in the USA by Anthropic, PBC | Data processing addendum (part of the Commercial Terms) | EU standard contractual clauses (art. 46(2)(c) GDPR); Anthropic is not certified under the EU-US Data Privacy Framework |
| OpenAI Ireland Ltd. (GPT) | Ireland; processing in the USA by OpenAI OpCo, LLC | Data Processing Addendum of 17 Sep 2026 | EU standard contractual clauses, module 2/3 (art. 46(2)(c) GDPR); OpenAI is not certified under the EU-US Data Privacy Framework |
| Google LLC (Gemini API, paid tier) | USA | Google Cloud Data Processing Addendum | EU-US Data Privacy Framework (art. 45 GDPR, Google LLC is certified), supplemented by EU standard contractual clauses |
Under their terms, the API providers do not use transmitted content to train their models. If you store your own provider key in the gateway, your own contract with that provider applies to those calls. The providers retain transmitted content for a limited time under their terms, for example for abuse detection; the providers set those periods.
OpenRouter and Mistral are currently not used; no keys are stored for them and requests are not routed there. We will add them here before we use them.
Moonshot AI (Kimi, China). There is no EU Commission adequacy decision for Moonshot and no contract with us. The models are not preselected and are never chosen automatically or as a fallback when a provider fails. The gateway uses them only if you request the model explicitly. Before first use it tells you: "Processing in China, no EU-level data protection"; the request is only executed after you confirm. Do not use Moonshot for personal or confidential content.
Licence and subscription check of the AnnexEdit Mac app
The AnnexEdit Mac app (also from ma-kom agentur UG) uses Promptopoly to check licences and subscriptions. On activation the app sends your licence key, app version, platform (macOS) and processor architecture to this interface (promptopoly.com/markedit/v1). After that, at launch and about every 6 hours, it sends only the licence key (header X-MarkEdit-Key) and receives subscription tier and expiry date in return. The app stores the result in your Mac's Keychain and keeps working for up to 14 days without a connection. Without a licence key it does not call this interface.
We process the licence key, subscription status, and IP address and time in the server log (retention as in the section on server logs). The legal basis is performance of the contract, namely unlocking the functions you bought (Art. 6(1)(b) GDPR). If a Promptopoly account is connected to your licence, the functions described under "AI Features" apply as well (writing assistant, sync, workspace mirror, template catalogue, skills), and only on your action. After a skill run the app reports skill, status, duration and output format, never document content. The app's privacy policy is at annexedit.com/privacy.
AI Features (AI Act)
Which functions use AI:
- AI gateway: forwards your requests, at your initiative, to the providers named above. Outputs are AI-generated; as the operator of your application you are responsible for labelling them towards your users (Art. 50 AI Act).
- Writing assistant of the AnnexEdit Mac app: on your action the app sends the text around the cursor to our interface; a provider named in this policy generates a suggestion.
- Prompt Coach (/coach): rule-based evaluation, no AI.
AI providers receive data only through one of these actions. We do not use your content to train AI models.
Storage and Security
Access tokens are processed securely; sensitive secrets are not stored in plaintext unnecessarily. Access to data and workspaces is role- and permission-based. Monitoring and operational data are processed as data-efficiently as possible.
Cost Check and Lead File
Calculator. On /kostencheck you work out what AI calls cost. Your inputs (number of clients, calls, model, text lengths) are sent to our server for this, calculated there and not stored. You do not need to provide any personal data for the result.
Report by email. Only if you would like to receive the report do you enter your email address. We then store the email address, language, your calculator inputs, the origin of the visit (e.g. flyer, ad, campaign identifier from the link), and the time and version of your consent. The purpose is to send you the report and to answer your questions about it. We do not send a newsletter.
Legal basis is your consent (Art. 6(1)(a) GDPR). The entry only takes effect once you click the link in the confirmation email (double opt-in); the confirmation email contains nothing but this link. To prevent abuse (e.g. mass sign-ups of other people's addresses), we store IP address and browser identifier only as a hash value, not in plain text (Art. 6(1)(f) GDPR).
Retention. The confirmation link is valid for 7 days; unconfirmed entries are deleted after that. If you unsubscribe, your entry is anonymised immediately: the email address is replaced by a hash marker, links and identifiers are deleted, and only a counter for origin statistics remains. Confirmed entries with no contact for 12 months are anonymised in the same way.
Recipients. The data is stored on our hosting in Germany (see processors); we send the email via the mailbox mail@promptopoly.com on the same server. The data is not passed on to third parties.
Withdrawal. You can withdraw your consent at any time with effect for the future, via the unsubscribe link in the report or informally to mail@promptopoly.com. Your rights under Art. 15–21 GDPR and your right to lodge a complaint with the supervisory authority (State Commissioner for Data Protection and Freedom of Information Baden-Württemberg) remain unaffected.
Integrations at Your Initiative
If you use the Git integration, we transmit content on your action to the service you chose (GitHub, GitLab, Gitea; for GitHub and GitLab the USA or another third country, for Gitea the server you specify). The terms of that service apply, with which you have your own contract. Without this action no transfer takes place.
Data Transfers to Third Countries
Google Ireland Limited (marketing measurement) and the AI providers Anthropic, OpenAI and Google (Gemini) may transfer data to the USA. For Google the basis is the EU-US Data Privacy Framework, under which Google LLC is certified, supplemented by EU standard contractual clauses. Anthropic and OpenAI are not certified under the Data Privacy Framework; transfers to them rely solely on EU standard contractual clauses, and we have assessed the transfer risks. US authorities may access data under US law, and legal remedies equivalent to European standards are not guaranteed in every case. You can prevent these transfers by declining marketing cookies and not using the AI features or the AI gateway. Moonshot (China) and Git providers outside the EU are used only at your explicit choice, see above.
Your Rights
You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to withdraw consent (Art. 7(3) GDPR). Contact us at mail@promptopoly.com.
Right to object (Art. 21 GDPR): You may object at any time, on grounds relating to your particular situation, to processing we base on legitimate interests (Art. 6(1)(f)). We will then stop processing the data unless we demonstrate compelling legitimate grounds.
Right to lodge a complaint: You may complain to a supervisory authority, e.g. the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart.
Users in the United Kingdom and Switzerland: The UK GDPR and Data Protection Act 2018 or the Swiss Federal Act on Data Protection (revFADP) also apply to you. Your rights correspond to those listed above; you may also complain to the Information Commissioner’s Office (ICO, ico.org.uk) or the Federal Data Protection and Information Commissioner (FDPIC, edoeb.admin.ch). We safeguard transfers to third countries as described above.
Changes
We reserve the right to update this privacy policy as needed. The current version is always available on this page. For significant changes, we will inform active users by email.