GDPR & Processing
Privacy & GDPR
Last updated: September 2026
Data Controller
ma-kom agentur UG (haftungsbeschränkt)
Merkelbach 12, 74541 Vellberg, Germany
Email: mail@promptopoly.com
Managing Director: Pascal Sanwald
Purpose of Processing
Promptopoly processes personal data to provide user accounts, repository and workspace functions, license and payment processing, support, security, monitoring, and optional integrations.
Processed Data
- Contact data such as name and email address
- Account data, roles, and permissions
- Workspace, repository, and team metadata
- Billing and payment references
- Security and monitoring data for stability and abuse prevention
Legal Basis
Processing is carried out pursuant to Art. 6(1)(b) GDPR for contract performance, Art. 6(1)(c) GDPR for legal obligations, and Art. 6(1)(f) GDPR based on legitimate interests in security, availability, abuse protection, and product operation.
Cookies and Tracking
We use cookies and similar technologies. You can consent or decline via our cookie banner.
| Technology | Purpose | Duration | Provider |
|---|---|---|---|
| promptopoly_session | Authentication and session | Session | own |
| cookieConsent_v2 | Stores your cookie consent | 1 year | own |
| _gclid | Google Click Identifier (only after consent) | 90 days | |
| _ga, _gid | Google Analytics (only after consent) | up to 2 years |
Google Ads and Google Analytics are only activated after your explicit consent (Consent Mode v2). If you decline, no marketing or analytics cookies will be set.
Processors
- Webspace-Verkauf.de ISP e.K., Grub am Forst — server hosting in Germany
- Stripe Payments Europe, Ltd. — Payment processing (Ireland)
- Google Ireland Limited — Marketing measurement (only after consent)
- Anthropic, PBC, San Francisco (USA) — AI models (Claude) behind the AI gateway and for AI features
- OpenAI Ireland Ltd., Dublin (processing by OpenAI OpCo, LLC, USA) — AI models (GPT) behind the AI gateway
- Google LLC, Mountain View (USA) — AI models (Gemini API, paid tier) behind the AI gateway
AI gateway and the providers behind it
Our AI gateway (promptopoly.com/api/v1/proxy) forwards requests to AI providers. We process the transmitted texts (prompts and responses) only for forwarding, billing and abuse prevention; per call we log time, key, model, provider, token count and cost. If a provider fails, the gateway may pass the request to the next provider in the chain configured for your key. The providers a key may use can be restricted per key.
| Provider | Seat / processing | Contract | Transfer basis |
|---|---|---|---|
| Anthropic, PBC (Claude) | USA | Data processing addendum (part of the Commercial Terms) | EU standard contractual clauses (art. 46(2)(c) GDPR); Anthropic is not certified under the EU-US Data Privacy Framework |
| OpenAI Ireland Ltd. (GPT) | Ireland; processing in the USA by OpenAI OpCo, LLC | Data Processing Addendum of 17 Sep 2026 | EU standard contractual clauses, module 2/3 (art. 46(2)(c) GDPR); OpenAI is not certified under the EU-US Data Privacy Framework |
| Google LLC (Gemini API, paid tier) | USA | Google Cloud Data Processing Addendum | EU-US Data Privacy Framework (art. 45 GDPR, Google LLC is certified), supplemented by EU standard contractual clauses |
Under their terms, the API providers do not use transmitted content to train their models. If you store your own provider key in the gateway, your own contract with that provider applies to those calls. Other providers listed in the catalogue (such as Moonshot or Mistral) are only used once a contract is in place; we will add them here then.
AI-Powered Features (AI Act)
Promptopoly offers AI-powered features (prompt optimizer, auto-tags, workspace analysis). These features:
- are opt-in and require your explicit consent
- use external AI models (Anthropic Claude, OpenAI GPT, Google Gemini) via API interfaces, see "AI gateway and the providers behind it"
- send data to AI providers only upon explicit user action
- are not used for AI model training
- are subject to the privacy policies of the respective AI providers
AI-generated content on this website is labeled as such. The AI inventory is available in our documentation.
Storage and Security
Access tokens are processed securely; sensitive secrets are not stored in plaintext unnecessarily. Access to data and workspaces is role- and permission-based. Monitoring and operational data are processed as data-efficiently as possible.
Cost Check and Lead File
Calculator. On /kostencheck you work out what AI calls cost. Your inputs (number of clients, calls, model, text lengths) are sent to our server for this, calculated there and not stored. You do not need to provide any personal data for the result.
Report by email. Only if you would like to receive the report do you enter your email address. We then store the email address, language, your calculator inputs, the origin of the visit (e.g. flyer, ad, campaign identifier from the link), and the time and version of your consent. The purpose is to send you the report and to answer your questions about it. We do not send a newsletter.
Legal basis is your consent (Art. 6(1)(a) GDPR). The entry only takes effect once you click the link in the confirmation email (double opt-in); the confirmation email contains nothing but this link. To prevent abuse (e.g. mass sign-ups of other people's addresses), we store IP address and browser identifier only as a hash value, not in plain text (Art. 6(1)(f) GDPR).
Retention. The confirmation link is valid for 7 days; unconfirmed entries are deleted after that. If you unsubscribe, your entry is anonymised immediately: the email address is replaced by a hash marker, links and identifiers are deleted, and only a counter for origin statistics remains. Confirmed entries with no contact for 12 months are anonymised in the same way.
Recipients. The data is stored on our hosting in Germany (see processors); we send the email via the mailbox mail@promptopoly.com on the same server. The data is not passed on to third parties.
Withdrawal. You can withdraw your consent at any time with effect for the future, via the unsubscribe link in the report or informally to mail@promptopoly.com. Your rights under Art. 15–21 GDPR and your right to lodge a complaint with the supervisory authority (State Commissioner for Data Protection and Freedom of Information Baden-Württemberg) remain unaffected.
Data Transfers to Third Countries
Google Ireland Limited (marketing measurement) and the AI providers Anthropic, OpenAI and Google (Gemini) may transfer data to the USA. For Google the basis is the EU-US Data Privacy Framework, under which Google LLC is certified, supplemented by EU standard contractual clauses. Anthropic and OpenAI are not certified under the Data Privacy Framework; transfers to them rely solely on EU standard contractual clauses, and we have assessed the transfer risks. US authorities may access data under US law, and legal remedies equivalent to European standards are not guaranteed in every case. You can prevent these transfers by declining marketing cookies and not using the AI features or the AI gateway.
Your Rights
You have the right to access, rectification, erasure, restriction of processing, data portability, and objection to certain processing. Contact us at mail@promptopoly.com.
Changes
We reserve the right to update this privacy policy as needed. The current version is always available on this page. For significant changes, we will inform active users by email.