PROMPTWRK - PRIVACY POLICY

PromptBank Pty Ltd (ACN 691 473 079) trading as PromptWrk ("PromptWrk," "we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains what personal information we collect, how we use it, who we share it with, and your rights regarding your information when you use our website at www.promptwrk.com (the "Site") and our services (the "Service").

By using the Service, you consent to the practices described in this Privacy Policy.

1. ABOUT US

We are an Australian company based in Sydney, New South Wales.

• Legal entity: PromptBank Pty Ltd (ACN 691 473 079)
• Trading name: PromptWrk
• Privacy enquiries: contact@promptwrk.com

For users in the European Union, United Kingdom, California, or other jurisdictions with specific privacy laws, additional rights are described in Section 9.

2. WHAT INFORMATION WE COLLECT

2.1 Information You Provide

We collect personal information you provide directly to us, including:

• Account information: name, email address, username, password (stored securely in encrypted form)
• Payment information: processed by Stripe, our payment processor. We do not store full payment card details. We may receive limited information from Stripe such as transaction confirmations and the country associated with your payment method.
• Demographic information: the country you reside in, collected for service personalisation and regional compliance purposes
• Creator information (if you are a Creator on the Service): identity verification documents, bank account details (collected by our payout processor Wise, not stored directly by us), tax residency information, contact details
• Communications: any messages, support requests, or feedback you send us
• Content: prompts, files, images, or other Content you upload to the Service

2.2 Information We Collect Automatically

When you use the Service, we automatically collect:

• Device and browser information: IP address, browser type and version, device type, operating system, referring URLs
• Usage data: pages visited, prompts viewed and unlocked, search queries, time spent on the Service, click patterns, login times
• Cookies and similar technologies: see Section 3

2.3 Information We Receive From Third Parties

We may receive information from:

• Stripe (payment processor): transaction confirmations, fraud flags, billing country
• Wise (Creator payouts): payout confirmations, currency conversion details
• Google Analytics: aggregated usage and demographic data
• ManyChat (where you opt into our Instagram and DM automation flows): engagement and interaction data

3. COOKIES AND TRACKING TECHNOLOGIES

3.1 What Are Cookies

Cookies are small text files stored on your device when you visit a website. We use cookies and similar technologies to operate the Service and improve your experience.

3.2 Types of Cookies We Use

• Essential cookies: required for the Service to function, including authentication (keeping you logged in), security, and basic functionality. These cannot be disabled without affecting Service functionality.
• Analytics cookies: Google Analytics cookies that help us understand how visitors use the Service so we can improve it.

We do not currently use marketing or advertising cookies. We do not use remarketing tracking pixels.

3.3 Managing Cookies

You can manage cookie preferences through:

• Our cookie consent banner (where shown), which allows you to accept or decline non-essential cookies
• Your browser settings, which allow you to block or delete cookies

Disabling essential cookies may affect Service functionality. For more information about cookies, visit www.allaboutcookies.org.

4. HOW WE USE YOUR INFORMATION

We use the information we collect to:

• Provide and operate the Service: create and manage your Account, process Token transactions, deliver Content you've unlocked, enable Creator payouts
• Process payments and payouts: through Stripe (subscriptions) and Wise (Creator payouts)
• Communicate with you: send transactional emails (account confirmations, password resets, billing receipts), respond to support requests
• Send marketing communications (where you have consented or where permitted by law): product updates, new Creator features, promotional offers. You can unsubscribe at any time using the link in any marketing email or by emailing contact@promptwrk.com
• Improve the Service: analyse usage patterns, test new features, fix bugs, develop new functionality
• Personalise your experience: recommend prompts and creators based on your activity and country
• Maintain security: detect and prevent fraud, abuse, unauthorised access, and breaches of our Terms of Use
• Comply with legal obligations: respond to lawful requests from authorities, enforce our Terms, protect our rights and those of our users

4.1 Legal Bases for Processing (EU and UK Users)

If you are in the European Union or United Kingdom, the GDPR and UK GDPR require us to identify a legal basis for each processing activity. Our legal bases are:

• Performance of a contract (Article 6(1)(b) GDPR): processing necessary to provide the Service you've signed up for, including Account management, Token transactions, and Creator payouts
• Legitimate interests (Article 6(1)(f) GDPR): improving the Service, preventing fraud, sending Service-related communications, maintaining platform security
• Consent (Article 6(1)(a) GDPR): for marketing communications and non-essential cookies. You can withdraw consent at any time without affecting prior processing.
• Legal obligation (Article 6(1)(c) GDPR): for tax, accounting, and regulatory compliance

5. WHO WE SHARE INFORMATION WITH

We share personal information only as described below. We do not sell your personal information.

5.1 Service Providers

We share information with third-party service providers who help us operate the Service:

• Stripe Inc. (payment processing) - based in the United States, with global operations
• Wise Payments Limited (Creator payouts and currency conversion) - based in the United Kingdom, with global operations
• MailJet (operated by Sinch SAS) (email delivery for transactional and marketing emails) - based in France
• Amazon Web Services (AWS) (cloud hosting and infrastructure) - operated by Amazon Web Services Inc.; data may be stored in the AWS Sydney region or other regions as required
• Google LLC (Google Analytics) - operated by Google LLC in the United States
• ManyChat Inc. (Instagram and DM automation) - operated by ManyChat Inc. in the United States

These providers are contractually obligated to handle your information securely and only for the purposes for which it is shared.

5.2 Other Users

Limited information may be visible to other users of the Service:

• Your username is publicly visible on prompts you've unlocked, comments, ratings, and Creator profiles
• Creator information (where you are a Creator): your username and submitted prompts are publicly visible; your real name and contact details are not shared with subscribers unless you choose to disclose them

5.3 Legal and Regulatory Disclosures

We may disclose personal information where required by law, including:

• To respond to subpoenas, court orders, or legal process
• To comply with regulatory requests
• To enforce our Terms of Use or protect our legal rights
• To prevent or investigate fraud, security breaches, or unlawful activity
• To protect the safety of our users or the public

5.4 Business Transfers

If PromptWrk is involved in a merger, acquisition, sale of assets, or restructuring, personal information may be transferred to the relevant party as part of that transaction. We will notify users of any such transfer.

6. INTERNATIONAL DATA TRANSFERS

PromptWrk is based in Australia. By using the Service, your information may be transferred to and processed in Australia and other countries where our service providers operate (including the United States, United Kingdom, France, and other countries).

These countries may have data protection laws different from your home jurisdiction. Where required by law, we put appropriate safeguards in place for international transfers, including:

• Standard Contractual Clauses for transfers from the European Union and United Kingdom to third countries
• Reliance on service providers certified under recognised international frameworks (such as the EU-US Data Privacy Framework, where applicable)
• Adequacy decisions where they apply (for example, the United Kingdom's adequacy decision for Australia)

If you would like more information about the safeguards in place for international transfers of your personal information, contact us at contact@promptwrk.com.

7. DATA RETENTION

We retain personal information for as long as necessary to provide the Service and comply with legal obligations.

• Active accounts: information is retained while your account is active
• Deleted accounts: personal information is removed from active systems promptly upon account deletion, subject to retention requirements below
• Transactional and financial records: payment, Token consumption, and Creator payout records are retained for seven (7) years as required by Australian tax law (Income Tax Assessment Act 1997 and Corporations Act 2001)
• Inactive accounts: accounts inactive for twenty-four (24) consecutive months may be archived or deleted at PromptWrk's discretion, with reasonable prior notice to the email address on file
• Legal hold: information subject to a legal hold, regulatory investigation, or active dispute is retained until the matter is resolved, regardless of other retention periods

You can request deletion of your information at any time by emailing contact@promptwrk.com (see Section 9). We will action deletion requests within thirty (30) days, except where retention is legally required.

8. DATA SECURITY

We take reasonable steps to protect your personal information, including:

• Encryption of data in transit (HTTPS/TLS)
• Encryption of passwords and sensitive information at rest
• Limited access to personal information by authorised personnel only
• Regular security reviews of our systems and third-party providers
• Use of reputable, certified service providers (AWS for infrastructure, Stripe for payments, Wise for payouts)

No method of transmission over the internet is completely secure. While we work to protect your information, we cannot guarantee absolute security.

In the event of a data breach affecting your personal information, we will notify you in accordance with the notification requirements applicable to your jurisdiction (including the Notifiable Data Breaches scheme under the Australian Privacy Act 1988, the GDPR's 72-hour notification requirement, and any other applicable regimes).

9. YOUR RIGHTS

You have rights regarding your personal information. These rights vary by jurisdiction.

9.1 All Users

You can:

• Access the personal information we hold about you
• Correct inaccurate or incomplete information through your Account settings or by contacting us
• Delete your account and associated personal information (subject to retention requirements in Section 7)
• Object to certain uses of your information, including marketing communications
• Withdraw consent for processing where consent is the legal basis (this does not affect prior processing)
• Lodge a complaint with the relevant data protection authority

To exercise any of these rights, email contact@promptwrk.com. We will respond within thirty (30) days.

9.2 Australian Users

Under the Privacy Act 1988 (Cth) and the Australian Privacy Principles, you have rights including:

• Access to and correction of your personal information
• The right to make a complaint about our handling of your information
• The right to know how your information is being used and disclosed

Complaints about our handling of your information can be made first to us at contact@promptwrk.com, and if unresolved, to the Office of the Australian Information Commissioner (www.oaic.gov.au).

9.3 European Union Users

Under the General Data Protection Regulation (GDPR), you have the following rights:

• Right of access (Article 15): obtain confirmation of whether we process your personal data, and access that data
• Right to rectification (Article 16): correct inaccurate or incomplete data
• Right to erasure ("right to be forgotten") (Article 17): request deletion of your data in certain circumstances
• Right to restriction of processing (Article 18): limit how we process your data in certain circumstances
• Right to data portability (Article 20): receive your data in a structured, commonly used, machine-readable format
• Right to object (Article 21): object to processing based on legitimate interests, including direct marketing
• Rights related to automated decision-making (Article 22): we do not currently use automated decision-making that produces legal or similarly significant effects on you

You have the right to lodge a complaint with your national data protection authority. A list of EU supervisory authorities is available at edpb.europa.eu.

9.4 United Kingdom Users

Under the UK GDPR and the Data Protection Act 2018, you have the same rights as EU users described in Section 9.3 above.

You have the right to lodge a complaint with the Information Commissioner's Office (www.ico.org.uk).

9.5 California Users

Under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), California residents have specific rights including:

• Right to know what personal information we collect, use, disclose, and sell
• Right to delete personal information we have collected (subject to exceptions)
• Right to correct inaccurate personal information
• Right to opt-out of the sale of personal information (we do not sell personal information)
• Right to limit use of sensitive personal information
• Right to non-discrimination for exercising these rights

To exercise any of these rights, email contact@promptwrk.com. Where required, we will verify your identity before processing your request.

9.6 Other Jurisdictions

If you are in another jurisdiction with specific privacy laws (including Canada, New Zealand, Brazil, or others), additional rights may apply. Contact us at contact@promptwrk.com for assistance with rights specific to your jurisdiction.

10. CHILDREN'S PRIVACY

The Service is not intended for users under the age of 16. We do not knowingly collect personal information from children under 16. If we become aware that we have collected personal information from a child under 16 without parental consent, we will delete that information promptly.

If you are a parent or guardian and believe your child has provided personal information to us, please contact us at contact@promptwrk.com.

11. MARKETING COMMUNICATIONS

We may send you marketing communications about PromptWrk products, features, promotions, and Creator opportunities.

Consent: at signup, you will be asked to consent to receiving marketing communications. You can change your preference at any time.

Unsubscribe: every marketing email includes an unsubscribe link. You can also email contact@promptwrk.com to opt out at any time.

Transactional emails (account confirmations, billing receipts, security alerts, Creator payout notifications) are not marketing communications and are sent to all users with active Accounts regardless of marketing preferences.

12. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time. The "Last Updated" date at the top of this policy reflects the most recent revision.

If we make material changes, we will notify you by email (to the email address associated with your Account) or by prominent notice on the Service at least fourteen (14) days before the changes take effect, except where immediate changes are required by law.

Your continued use of the Service after the effective date of any changes constitutes acceptance of the updated Privacy Policy.

13. CONTACT US

For any privacy-related enquiries, requests, or complaints:

Email: contact@promptwrk.com

Postal Address: PromptBank Pty Ltd Sydney NSW, Australia

We aim to respond to all privacy enquiries within thirty (30) days.