Privacy Policy

1. Controller

The controller is Jürgen Bucek, Wollanger 3, 84130 Dingolfing, Germany.

Contact for privacy requests: info@promptforge.store.

2. Principles of processing

Personal data is processed only to the extent necessary for operation, security, registration, purchase processing, provision of digital content, communication, legal obligations, or legitimate interests.

Processing is carried out according to the principles of lawfulness, transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity, and confidentiality.

3. Data processed when visiting the website

When the website is accessed, technically required data may be processed, such as IP address, date and time of access, browser type, operating system, pages accessed, referrer URL, and server log data.

This data serves technical provision, security, error analysis, and prevention of abuse.

4. Registration and user account

When registering and using an account, in particular email address, password hash, user role, language settings, profile information, seller status, account activity, and technical account data may be processed.

Processing serves provision of the user account, login, rights management, and platform functions.

5. Purchases, digital content, and processing

When buying or selling digital content, order, payment, product, access, activation, download, invoice, and processing data may be processed.

This data is needed to provide digital content, allocate payments, maintain evidence, provide support, and fulfill legal obligations.

6. Payment service provider Stripe

Payments and seller subscriptions are processed through Stripe. Payment, transaction, invoice, fraud-check, subscription and technical payment data may be transmitted to or processed by Stripe.

PromptForge.store generally does not store complete credit card data itself. The privacy information of the payment service provider also applies to payment processing.

7. Seller and payout data

For sellers, additional data may be processed that is required for seller status, Stripe connection, payouts, tax/billing information, commission calculation, and fraud prevention.

For sellers, processing may include the Stripe Connect account, activation and payout status, product-related revenue shares, platform fees, and payment and idempotency identifiers.

8. Communication, contact, and support

When users contact us, request support, or send messages, contact details, message content, times, processing status, and technical metadata may be processed.

This data serves processing of the request and documentation of communication.

9. Cookies and local storage

PromptForge.store uses technically necessary cookies for functions such as login, session security, and protection of the platform. Cart, purchase status, and purchase rights are stored server-side in the user account. Your Google Ads measurement choice is stored locally in your browser and can be changed in the footer.

Non-essential cookies, tracking, or marketing technologies are used only if effective consent exists or another legal basis applies.

10. Analytics, reach measurement, and AI search discoverability

Technically necessary and first-party event data may be processed for security, error analysis, and functional checks. Only with your explicit consent do we load the Google Ads tag from Google and measure page views and completed registrations to assess our advertising. Google and its services may process usage and device information and set cookies; we do not send names or email addresses to Google. Without consent, the tag is not loaded. You can withdraw or change your choice at any time via ‘Change cookie choice’ in the footer. For more information about Google's processing, see Google's privacy policy.

Technical metadata, structured data, sitemap, and robots.txt serve discoverability by search engines and AI search systems, but generally contain no personal user content.

Google Privacy Policy

11. AI functions and external AI providers

Chatbot, analysis, optimization, practical testing, cover creation and translation may process inputs, outputs, product data, language settings, usage data and technical metadata.

AI requests are transmitted to the OpenAI API through self-managed PromptForge and n8n workflows. Inputs and technical metadata may be processed by OpenAI Ireland Limited as a processor. Secrets, special categories of personal data, and complete payment data must not be entered.

12. Legal bases

Depending on the purpose, processing may be based on contract performance, pre-contractual measures, legal obligations, legitimate interests, or consent.

Legitimate interests may include secure platform operation, abuse prevention, error analysis, enforcement of rights, marketplace quality, and platform improvement.

13. Recipients and service providers

Recipients may include, where required for the relevant purpose, technical hosting and email providers, OpenAI Ireland Limited for AI functions, Stripe entities for payments and seller identification, and tax/legal advisers or authorities where legally required.

Service providers are contractually obliged, where required, to process data confidentially and in compliance with data protection law.

14. Transfer to third countries

Where recipients process data outside the EU or EEA, transfers take place only on a permitted basis, particularly an adequacy decision, the EU-U.S. Data Privacy Framework, or Standard Contractual Clauses.

The data transmitted depends on the function used. Merely viewing public pages does not send product or chat content to AI providers.

15. Storage duration

Personal data is stored only as long as necessary for the respective purposes or as long as statutory retention periods exist.

Account, purchase, payment, and invoice data may be stored longer due to commercial, tax, or evidentiary obligations.

16. Data subject rights

Data subjects have statutory rights to access, rectification, erasure, restriction of processing, data portability, and objection.

Where processing is based on consent, consent may be withdrawn at any time with effect for the future.

Data subjects also have the right to lodge a complaint with a data protection supervisory authority.

17. Security

PromptForge.store takes appropriate technical and organizational measures to protect personal data against loss, misuse, unauthorized access, alteration, or disclosure.

The measures are adapted according to the risk, the state of the art, and the development of the platform.

18. Changes to this privacy policy

This privacy policy may be adjusted if platform functions, technical providers, legal situation, or data processing changes.

Privacy notice last updated: 23.09.2026.

Anonymous reach measurement

For purely statistical reach measurement, PromptForge.store increments a daily counter when a page is viewed by a signed-out visitor. Only the date, any country code supplied by the server and the counter value are stored. Clicks leading to registration are also recorded as a daily counter. This statistic stores no IP address, guest or device identifier, session, visited path or personal profile. A country that cannot be determined is counted as unknown. The values represent visits, not uniquely identified people.

Local country statistics

To determine an approximate country of origin, the PromptForge server temporarily compares the IP address technically required for the connection with a locally stored DB-IP country database. The IP address is not sent to DB-IP or another geolocation service and is not stored in the country statistics. Immediately after the lookup, only the two-letter country code is processed further.

Country information is processed for data-minimised measurement of interest in the platform, improvement of the multilingual service and assessment of registration reach on the basis of legitimate interests under Article 6(1)(f) GDPR. No individual movement profiles are created. Data subjects may object to this processing on grounds relating to their particular situation under Article 21 GDPR.

For guest visits, only a counter aggregated by date and country remains stored. Upon registration, the determined country code is also stored with the user account so registrations can be evaluated by country. A country that cannot be determined or may be inaccurate can be recorded as unknown or corrected on request.