GDPR & Processing
Privacy & GDPR
Last updated: May 2026
Data Controller
ma-kom agentur UG (haftungsbeschränkt)
Merkelbach 12, 74541 Vellberg, Germany
Email: mail@promptopoly.com
Managing Director: Pascal Sanwald
Purpose of Processing
Promptopoly processes personal data to provide user accounts, repository and workspace functions, license and payment processing, support, security, monitoring, and optional integrations.
Processed Data
- Contact data such as name and email address
- Account data, roles, and permissions
- Workspace, repository, and team metadata
- Billing and payment references
- Security and monitoring data for stability and abuse prevention
Legal Basis
Processing is carried out pursuant to Art. 6(1)(b) GDPR for contract performance, Art. 6(1)(c) GDPR for legal obligations, and Art. 6(1)(f) GDPR based on legitimate interests in security, availability, abuse protection, and product operation.
Cookies and Tracking
We use cookies and similar technologies. You can consent or decline via our cookie banner.
| Technology | Purpose | Duration | Provider |
|---|---|---|---|
| promptopoly_session | Authentication and session | Session | own |
| cookieConsent_v2 | Stores your cookie consent | 1 year | own |
| _gclid | Google Click Identifier (only after consent) | 90 days | |
| _ga, _gid | Google Analytics (only after consent) | up to 2 years |
Google Ads and Google Analytics are only activated after your explicit consent (Consent Mode v2). If you decline, no marketing or analytics cookies will be set.
Processors
- Hetzner Online GmbH — Hosting in Germany
- Stripe Payments Europe, Ltd. — Payment processing (Ireland)
- Google Ireland Limited — Marketing measurement (only after consent)
AI-Powered Features (AI Act)
Promptopoly offers AI-powered features (prompt optimizer, auto-tags, workspace analysis). These features:
- are opt-in and require your explicit consent
- use external AI models (OpenAI GPT-4, Anthropic Claude) via API interfaces
- send data to AI providers only upon explicit user action
- are not used for AI model training
- are subject to the privacy policies of the respective AI providers
AI-generated content on this website is labeled as such. The AI inventory is available in our documentation.
Storage and Security
Access tokens are processed securely; sensitive secrets are not stored in plaintext unnecessarily. Access to data and workspaces is role- and permission-based. Monitoring and operational data are processed as data-efficiently as possible.
Data Transfers to Third Countries
Google Ireland Limited and AI providers (OpenAI/Anthropic) may transfer data to the USA. This is based on EU Standard Contractual Clauses (SCC) and the Data Privacy Framework (DPF). You can prevent this transfer by declining marketing cookies and not using AI features.
Your Rights
You have the right to access, rectification, erasure, restriction of processing, data portability, and objection to certain processing. Contact us at mail@promptopoly.com.
Changes
We reserve the right to update this privacy policy as needed. The current version is always available on this page. For significant changes, we will inform active users by email.