Privacy Infrastructure

Information We Collect

Account infrastructure: When you initialize an account, we collect your verified email address, encrypted authentication hashes, and subscription tier preferences. Billing data is managed exclusively via Stripe's secure infrastructure.

Intellectual property: Your original prompts and optimized results are stored in our secure relational database. This includes sophistication metrics, confidence scores, and historical timestamps for your audit compliance.

Data Processing Framework

Optimization services: We process your input data solely to execute requested optimizations. Results are private to your account and are not shared across accounts. We do not use your prompts to train our own models. LLM-based optimization sends your prompt to third-party model providers through OpenRouter, under the data policy described on our Compliance page. Each provider has its own terms, and some may keep prompts temporarily for safety and abuse monitoring.

Account governance: Your account data is used for subscription fulfillment, technical support requests, and mandatory security notifications relating to your infrastructure access.

Application logs: Our hosting logs record request sizes and metadata, not prompt text. Logs written before 16 October 2026 may contain short prompt excerpts until they age out of the hosting provider log retention.

Secure analytics: We may analyze aggregate, anonymized patterns to refine our deterministic rules engine. Individual proprietary prompts are never analyzed by human staff without an explicit support ticket authorization.

Infrastructure Data Flows

Service providers: We use Northflank (hosting), Vercel (website and request forwarding), Supabase (database), OpenRouter and the model providers it routes to (LLM processing), Stripe (payments), and Loops and Mailgun (email). The Compliance page lists what each one receives.

Cloud execution node: Prompts are processed by our API, which is hosted on Northflank. Results are saved to your private template library in Supabase Postgres, which our database provider encrypts at rest.

MCP package: The standard NPM package (mcp-prompt-optimizer) connects your MCP client to the cloud service:

Security Protocols

Encryption standard: All data in transit is protected by TLS (1.2 or newer, with HSTS enabled). Data at rest is encrypted by our database provider, Supabase.

Access management: Row Level Security restricts each user to their own records, and administrative endpoints require a separate administrator key.

Request handling: Request bodies are validated against typed schemas, and payment webhooks from Stripe are signature-verified.

Data Ownership & Rights

Right to export: Your templates and optimization history are available through the dashboard and the API as JSON, and you can request a full export of your data at any time.

Right to erasure: You can delete your optimization history yourself in Settings (Your data), and delete saved templates and SOP history from their pages. You may also request permanent deletion of your account. Once it is carried out, your prompts, optimization history, and account metadata are deleted from our database.

Transparency: You have the right to request a comprehensive report of all information stored in your environment. We maintain high transparency regarding where and how your data is processed.