Privacy Policy - PromptEden

This Privacy Policy explains how Yulan Ventures, LLC, doing business as PromptEden ("PromptEden," "we," "us"), collects, uses, shares, and protects personal information when you use our website, applications, AI agent for AEO, research, content generation, publishing, AI search visibility monitoring, and related services (collectively, the "Services"). Our mailing address is 1211 W 6th St, Ste #600-188, Austin, TX 78703.

1. Scope

This Privacy Policy applies to information processed by PromptEden when you:

Create or use a PromptEden account.
Visit prompteden.com or app.prompteden.com.
Use Eden or other Services to research, generate, approve, publish, or monitor content.
Connect publishing destinations, APIs, or integrations.
Interact with our support, sales, or product teams.
Receive communications from us, including email and product updates.

2. Information We Collect

2.1 Information You Provide

Account information, such as name, email address, company name, and account credentials.
Workspace and campaign information, such as monitored domains, brand terms, competitor names, custom prompts, report preferences, notification settings, keywords, target pages, and content goals.
Communications, including support tickets, demo requests, feedback, and messages sent to us.

2.2 Billing and Transaction Information

We use Stripe to process subscription payments. We receive billing metadata from Stripe, such as plan, billing status, transaction timestamps, invoices, and partial payment identifiers, but we do not store full payment card numbers.

The payments bridge is initially limited to visits recorded by our own collector, eden.js, on prompteden.com and subscription-entry payments to PromptEden through our own Stripe account. We act as controller for this processing. Payment bridging for other websites or customer Stripe accounts is not available.

The bridge stores an opaque event reference, a link to the recorded visit, the Stripe charge identifier, the amount in minor units, currency, paid and refund status, and timestamps. The reference is not derived from visitor identity and is restricted to the website property. It is carried only in server-side Stripe metadata, never in URLs or Stripe’s client_reference_id field. The bridge stores no card data.

2.3 Usage and Device Information

Log and analytics data, such as IP address, browser type, pages viewed, feature usage, error logs, and timestamps.
Server access logs record the request time, method, path without query string, status, duration, size, the visitor IP address and the user agent; other headers and cookies are removed before writing. They are kept for up to 48 hours for security, abuse prevention, troubleshooting, and PromptEden's own site analytics. From these logs, the analytics database keeps only crawler request records (time, hostname, normalized path and path hash, method, status, size, user agent, event and workspace identifiers, collection source, synthetic-request flags, processing state, and bot classification and verification metadata) and daily aggregates. It does not store raw IP addresses from these logs.
Device and connection data, such as operating system, approximate location derived from IP, and referral source.
Session and authentication data needed to keep you signed in and secure your account.
Marketing attribution data, such as UTM parameters, landing page path, referrer, and first-touch and last-touch attribution timestamps, collected via a first-party cookie.
Product engagement and growth data, such as activation stage, lifecycle state, feature adoption events, and approval workflow events used to improve the product experience.

2.4 Content and Publishing Data

We process content and publishing data you provide or approve for use with the Services, including brand-voice materials, writing rules, source content, research inputs, drafts, generated articles, approved Outputs, published articles, publishing destinations, agent conversations, approval cards, approval and rejection history, cost estimates, and actual credit usage.

2.5 Integration Credentials

If you connect publishing destinations or other integrations, we process encrypted tokens, API keys, credentials, webhook signing configuration, repository metadata, CMS metadata, and similar integration data needed to perform actions you approve.

2.6 AI Visibility Monitoring Results and Related Data

Our Services analyze and store AI search visibility outputs, including full responses from third-party AI systems, provider name, model name, timestamp, prompt content, locale hints, citation sources, ranking and visibility metrics, brand mentions, and related metadata. These outputs may contain public information about brands and websites that you choose to monitor.

3. How We Use Information

We use personal information to:

Provide, operate, maintain, secure, and improve the Services.
Authenticate users, secure accounts, and prevent fraud or abuse.
Process subscriptions, billing, invoices, plan changes, credits, and usage-based charges.
Perform agent-driven research, content generation, enrichment, publishing workflows, and AI search visibility monitoring.
Generate drafts, reports, analytics, recommendations, approval cards, cost estimates, and monitoring insights.
Publish or transmit approved Outputs and related data to the destinations you connect and approve.
Develop new features, products, and services.
Create aggregated, anonymized, or de-identified datasets for benchmarking, research, and product improvement purposes. Once data is aggregated or anonymized such that it no longer identifies you, it is no longer personal information and may be used for any lawful business purpose without restriction.
Respond to support requests and communicate service updates.
Comply with legal obligations and enforce our Terms of Service.

4. Legal Bases for Processing (GDPR)

If you are in the EEA, UK, or Switzerland, we process personal data under one or more of these legal bases:

Performance of a contract, for example to deliver paid features, generate requested Outputs, run monitoring, and publish approved content.
Legitimate interests, for example product improvement, security, fraud prevention, analytics, and service reliability.
Compliance with legal obligations.
Consent, where required, for example optional marketing communications or non-essential cookies in certain jurisdictions.

5. How We Share Information

We do not sell personal information for money. We share data only as described below. If you accept optional cookies on prompteden.com, advertising identifiers and conversion events may be shared with Google Ads and Meta for cross-context advertising measurement, as described in the Cookie Policy and in the Google Ads / Meta Pixel bullets in section 6.

Service providers that support our operations, billing, infrastructure, analytics, email, security, and error monitoring. See ourSubprocessors page for a current list.
AI model providers and AI routing services to perform agent-driven research, reasoning, content generation, monitoring analysis, and retrieval of AI search responses requested or approved by you. These providers may process customer workspace content, brand-voice materials, prompts, drafts, and model parameters.
Search, SEO, and data enrichment providers to retrieve SERP, backlink, search-volume, citation, and video metadata used by the Services.
Publishing destinations and integrations you connect, such as your website, WordPress instance, GitHub repository, API, or webhook endpoint. Publishing and credit-spending actions occur only upon your explicit approval. Transfers to destinations you connect are made at your instruction to your own providers; those destinations are not our subprocessors.
Legal authorities when required by law, subpoena, or other lawful process.
Corporate transactions, such as merger, financing, acquisition, or asset transfer, subject to standard confidentiality safeguards.

6. Key Third-Party Services

TheSubprocessors page is the authoritative, updatable list of subprocessors. Key services include:

Stripe: subscription billing and payment processing.
Hetzner: the server that runs the PromptEden application, its database, and its background jobs, in a data centre in Falkenstein, Germany.
Cloudflare: DNS, network delivery and protection, TLS, bot protection, and object storage for content images and backups.
Sentry: application monitoring, diagnostics, and error tracking.
PostHog (US): product analytics, including pageviews, feature usage, and session-level engagement data. PostHog (US) receives Eden chat outputs and prompts and outputs from content generation, linked to user and team identifiers, to monitor answer quality; they are kept under PostHog's standard retention.
Plausible Analytics: cookieless website analytics on prompteden.com.
Google Ads (Google LLC): after optional-cookie consent on the marketing site, conversion measurement and click identifiers. Google may combine those events with other data it holds and use them to measure ads across sites. Tags stay inert until a Google Ads ID is configured and you accept cookies.
Meta Pixel (Meta Platforms, Inc.): after optional-cookie consent on the marketing site, conversion measurement and click identifiers. Meta may combine those events with other data it holds and use them to measure ads across sites. Tags stay inert until a Meta Pixel ID is configured and you accept cookies.
Resend: transactional and lifecycle email.
DataForSEO: SERP, backlink, and search-volume enrichment.
Anthropic: AI agent reasoning, research, content generation, and monitoring analysis.
OpenRouter: AI model routing for agent research, content generation, monitoring queries, and analysis. OpenRouter may route requests to downstream model providers as sub-subprocessors.
TypeSafe: optional shadow evaluation via OpenRouter, off by default, that receives anonymized, typed account metrics (counts and labels only; no names, content, prompts, websites or contact data) for comparison with the application's email-insight decisions.
OpenAI, Google, Perplexity, and Microsoft/Azure: AI visibility monitoring queries and related outputs.
Fal.ai: article image generation using image prompts derived from customer content.

7. Cookies and Similar Technologies

We use cookies and similar technologies for essential site operations, attribution, performance measurement, product analytics, and, if you accept optional cookies, advertising conversion measurement with Google Ads and Meta, which can be cross-context sharing. Please see our Cookie Policy at/legal/cookies for cookie categories, purposes, vendor sharing, and how to decline or withdraw.

8. Data Retention

We retain personal information for as long as necessary to provide the Services and fulfill legal, accounting, billing, security, and operational obligations.

Account and billing records are retained while your account is active and for a reasonable period afterward, typically up to 12 months after account closure, or longer where required for tax, accounting, legal, or dispute purposes.
Content, publishing data, drafts, approval history, monitoring data, full AI responses, reports, and related metadata are retained according to your plan settings, workspace configuration, operational needs, and legal obligations.
Integration credentials are retained while the integration is connected and for a limited period afterward as needed for security, audit, backup, or legal purposes.
Marketing attribution data other than payments bridge records is retained for 90 days via first-party cookie and in our analytics systems for as long as your account is active.
The payments bridge links website visits to subscription-entry payments using an opaque event reference, keeps unbound handoffs for up to 24 hours, permits checkout linkage within 30 days of the event, reconciles missing payment or event evidence for up to 90 days after checkout, and retains joined evidence for 400 days after payment for year-over-year comparison of the loop; the bridge remains off until this notice and the corresponding DPA text are live. These periods apply to payments bridge records; separate account and billing records follow the retention periods stated above.
Server access logs are kept for up to 48 hours. Crawler request records derived from these logs have a separate retention cleanup job; records awaiting aggregation or repair are retained. Daily crawler aggregates have no automatic expiry. Other security logs are retained for limited periods, typically up to 90 days, consistent with operational and compliance needs.
Daily host database dumps are copied to Cloudflare R2. The scheduled host backup job prunes local dump directories older than 30 days. R2 offsite copies are subject to the bucket's retention settings. Migration/source dumps, cutover recovery copies, and workflow archives are kept until manually removed; they have no automatic deletion deadline. Backup retention therefore has no single deletion deadline covering every class.

We may anonymize or aggregate data so it no longer identifies an individual. You may request deletion of your personal data at any time by contacting[email protected], subject to legal and operational exceptions.

9. Security

We use technical and organizational safeguards designed to protect personal information, including encryption in transit, access controls, and monitoring practices. No system is completely secure, and we cannot guarantee absolute security.

10. Your Rights and Choices

Depending on your location, you may have rights to access, correct, delete, export, restrict, or object to processing of personal data.

Access and correction: request a copy of your data or correct inaccurate data.
Deletion: request deletion of your personal data, subject to legal exceptions.
Portability/export: request export of your account data in a structured format.
Marketing opt-out: unsubscribe from promotional emails at any time.

To exercise rights, contact[email protected].

11. California Privacy Rights (CCPA/CPRA)

California residents may have rights to know, access, delete, and correct personal information and to opt out of the sale or sharing of personal information, including sharing for cross-context behavioral advertising. PromptEden does not sell personal information for money. If you accept optional cookies, we may share identifiers and conversion events with Google Ads and Meta for advertising measurement across sites. That sharing happens only after cookie consent and only when those tags are configured. To opt out, decline cookies, open Cookie settings in the site footer and choose Decline, or enable Global Privacy Control. We treat an enabled GPC signal as a decline for those browser tags. We will honor that opt-out for the Google Ads and Meta measurement described here.

We will not discriminate against you for exercising privacy rights.

12. International Transfers

Our application and its database run on a server in Falkenstein, Germany. Yulan Ventures is based in the United States, and several of our service providers (for example payment, email, monitoring, analytics, and AI model providers) process information in the United States or other countries. We may therefore process information in countries other than where you reside. When required, we use appropriate safeguards for international transfers, such as the European Commission's Standard Contractual Clauses and equivalent UK terms. AI routing services may route requests to downstream model providers in varying locations, as described on ourSubprocessors page.

13. Children's Privacy

The Services are not directed to children under 16, and we do not knowingly collect personal data from children under 16. If you believe a child has provided personal data, contact us and we will take appropriate steps.

14. Disclaimer of Liability for Data Accuracy

PromptEden provides AI-generated Outputs, AI monitoring data, search visibility data, recommendations, citations, rankings, and related results for informational and workflow purposes. We do not guarantee the accuracy, completeness, originality, legality, or reliability of any data collected, processed, generated, or presented through the Services. You acknowledge that AI-generated outputs originate from third-party systems beyond our control and may be inaccurate or change without notice. PromptEden expressly disclaims all liability for any decisions, approvals, publications, actions, or omissions taken in reliance on data or Outputs provided through the Services.

15. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will update the "Last updated" date and provide additional notice where required.

16. Contact Us

For privacy questions, rights requests, or data protection inquiries, contact:

Email: [email protected]
General support: [email protected]