Privacy policy

1. Scope and contact

PromptOn is operated by Polimo in the Republic of Korea. This policy covers personal data handled through our website, hosted application, APIs and support. For account administration and service operations, the operator determines the purposes of processing. For personal data submitted in an organization's prompts or logs, that organization may be the controller and we process the data to provide its requested service. The applicable roles and contractual safeguards must reflect the actual use.

Business name

Polimo

Representative

YONGSEON LEE

Business registration number

131-38-61546

Business address

L857, 191 Dongbaekjungang-ro, Giheung-gu, Yongin-si, Gyeonggi-do, 17006, Republic of Korea

Privacy officer

YONGSEON LEE (Representative)

Privacy contact

contact@prompton.ai

Members using an organization's workspace should also consult that organization's privacy information. This service is designed for professional use and is not directed to children under 14. Contact us if a child has submitted personal data so that we can assess and address it under applicable law.

2. Data we process

Do not submit unnecessary personal data, special-category data, identification documents or secrets in prompts and logs. An organization is responsible for informing its own users and having appropriate authority to submit their information.

3. Purposes and legal grounds

We process information to create and secure accounts, authenticate access, manage collaboration, store and serve prompt settings, display monitoring records, carry out requested AI tasks and evaluations, answer support requests, prevent abuse and comply with applicable law.

Where applicable, the basis is performing or preparing the service contract, complying with a legal obligation, or consent for processing that requires it. Other grounds, including legitimate interests, will be used only where legally available and after the required assessment. Required account data is needed to provide access; optional content and features depend on what you submit or enable. Publishing this policy does not itself obtain consent for unrelated use or an international transfer that requires separate consent.

4. How AI content moves

Calls from your application: your application can fetch PromptOn configuration and send model requests directly to its provider using its own credentials. Those requests reach PromptOn only to the extent your integration sends monitoring records or uses a hosted processing feature.

Calls from PromptOn: Arena, drafting and evaluation send the material needed for the requested task through OpenRouter to the model provider selected by your configuration and routing. This can include prompts, input/output samples, criteria and related context. Calls using your own provider key are billed separately through your provider account. A service-provided key may be used where that option is available.

Provider retention and model-training practices vary by provider and account settings. Review OpenRouter's privacy policy and its provider data practices before choosing models or submitting confidential or personal data. A provider's zero-retention setting does not delete copies you separately save in PromptOn.

5. Recipients and service providers

Authorized organization members can access information according to their roles; members can see other members' email addresses. Authorized operators may access records as needed for service support, security or legal obligations. We may disclose information where legally required or necessary to establish or protect legal rights, with safeguards required by law.

A linked provider policy supplements this notice and does not replace our own required disclosures.

6. International transfers and overseas services

Overseas entrustment/storage necessary to enter into or perform the requested service contract may use Article 28-8(1)(3) of Korea's Personal Information Protection Act when its disclosure or individual-notice requirements are met. Email authentication and requested support are handled for these contract purposes. Hosted AI additionally requires the applicable recipient, processing country and retention to be established for its route; the US gateway details below do not cover every downstream transfer. This ground does not authorize unrelated advertising, independent model training or processing requiring separate consent. Information collected directly by independent services is distinguished below; direct collection alone does not establish a transfer exemption.

Paddle checkout: Paddle collects payment information directly as the seller and independent controller. For Korean and other buyers outside the US/Canada the seller is Paddle.com Market Limited (UK); US buyers use Paddle.com Inc. (US), and Canadian buyers use Paddle.com (Canada) Ltd. (Canada). Paddle's privacy notice also identifies Paddle Payments Limited (Ireland). At checkout, identity, billing and transaction information is sent over HTTPS for payment, tax, fraud prevention and purchase support. Paddle retains relevant records through the relationship, applicable legal limitation periods and unresolved claims, then deletes or anonymizes them. Contact privacy@paddle.com; see its buyer entities and processing/transfer policy. Payment-provider processing is not limited to the seller's country. This independent collection is not treated as PromptOn's overseas hosting/storage entrustment.

Google Fonts: Google LLC receives IP address, requested resource and browser/request headers directly over HTTPS when fonts load on the homepage, pricing, checkout-return, app or sign-in pages. Google operates a global delivery network, including the US; its privacy policy and contact and retention criteria govern its request records. We do not promise a fixed font-log retention period or a single destination country. These legal pages use system fonts.

Refusal and requests: do not invoke optional hosted AI or checkout features if you do not want those transfers. Blocking Google font domains in your browser prevents those font requests and uses fallback fonts. You can avoid sending support email, or write to the business address in section 1 for a privacy request. Email-code delivery is necessary for this sign-in method, so refusing it prevents sign-in. Contact our privacy officer to request transfer suspension or deletion; we will explain any impact on the requested feature and any legal retention exception. Publication of this policy is not consent to processing that requires separate consent.

7. Retention and deletion

We keep personal data only while needed for the stated purpose or a legal retention duty. The periods below distinguish scheduled cleanup from requests handled by our privacy officer.

Where Article 6 of the Korean Electronic Commerce Consumer Protection Act Enforcement Decree applies to records we hold, we retain advertising records for 6 months; contract/withdrawal and payment/supply records for 5 years; and consumer complaint/dispute records for 3 years. We keep only the relevant transaction or complaint information separately, restrict it to the required purpose, and delete it when the applicable period ends. These duties do not extend the retention of every prompt, log or ordinary inquiry.

Deletion procedure: the privacy officer identifies records whose purpose or retention period has ended, checks any statutory exception, separates records requiring legal retention, and deletes the remainder without undue delay. Electronic files are deleted or irreversibly anonymized so they cannot be restored or linked back to a person; any paper records are shredded or destroyed. Processor-held copies are included in deletion instructions and follow the processor deletion cycles disclosed in section 6. A minimal record of a request and its outcome is kept only where necessary to handle a complaint or meet a legal duty.

8. Cookies and browser storage

The app uses an essential session cookie for login and stores the sidebar preference in browser local storage. You can clear or block these through browser settings; blocking the session cookie may prevent login. Paddle controls cookies or similar storage used in its checkout under its own policy.

We currently do not add behavioral advertising or third-party analytics trackers to the site or app. External resources such as Google Fonts and Paddle still receive requests when loaded. Separate notice and any legally required choice will be provided before introducing nonessential tracking.

9. Security measures

Measures implemented in the service include HTTPS, authenticated sessions, organization/project access controls, hashing for sign-in codes, invitation tokens and SDK keys, signed session tokens and field encryption for stored provider secrets and selected monitoring/evaluation content. These protections do not mean that every metadata field is encrypted separately or that the service is end-to-end encrypted. Authorized processing requires decryption of relevant data.

Keep credentials secure, submit only necessary information and configure payload collection and retention for your needs. We will handle reportable incidents and notices under applicable law.

10. Your rights and requests

Subject to applicable law, you can request access, correction, deletion, restriction or suspension, withdrawal of consent, and a copy or portability of personal data where applicable. An authorized representative may act for you. We may verify identity and authority using information proportionate to the request. If a legal exception prevents fulfilling a request, we will explain the reason and available remedies.

Email contact@prompton.ai to exercise your privacy rights. Identify whether your request concerns your account, an organization, monitoring records or saved evaluation samples; do not send passwords or API keys. For data submitted by an organization, contacting that organization may be necessary. Requests about Paddle's independent payment records can also be sent through its privacy contact.

The current account screen supports profile changes and session revocation, but does not provide a complete self-service account deletion or full-account data export. You may raise concerns with your competent data protection authority. In Korea, official guidance and complaint channels are available through the Privacy Portal.

11. Updates

We will publish revisions with an effective date, explain material changes and provide additional notice or obtain consent where required. A future change will not retroactively authorize processing that lacked a lawful basis. The English and Korean versions are intended to express the same policy.