PromptFolder

GDPR overview

PromptFolder makes no GDPR claim of any kind. The privacy policy, last updated on 10 August 2023, never mentions the regulation, never states a legal basis for processing and names no data protection officer. It does include a Your Data Protection Rights section granting access, update and deletion, exercised by writing to the support address. There is no Article 27 EU representative, no data processing agreement offered or referenced, no subprocessor list and no published postal address. International transfers are covered only in generic terms: data may be transferred to and held on computers outside the user's state or country, where protection laws may differ, with no named safeguard such as standard contractual clauses. The terms are governed by California law, and on the Chrome Web Store the publisher declares itself a non-trader, with Google warning that EU consumer rights do not apply. No minimum age is stated.

Who owns the data?

The terms of service never state in so many words who owns a saved prompt. What they do say is that the user is responsible for all content they upload, post or otherwise make available through the service, and that PromptFolder may, without being obliged to, monitor and review that content and remove anything it judges to breach the terms or to be harmful. Ownership is asserted over the service itself: its content, features and functionality belong to PromptFolder, its licensors or other providers, protected by copyright and trademark law. Each prompt carries a private or public switch, public ones appearing on the /u/{username} page, and personal data can be accessed, corrected or deleted on request.

Reuse rights

The privacy policy describes three collections: personal data at sign-up (name, email address and other relevant details), usage data (IP address, browser type, pages visited) and cookies. The stated purposes are to provide, maintain and improve the service, notify users of changes, monitor usage and detect or fix technical problems. Disclosure is possible where the law requires it or where the publisher considers it necessary. Third-party services may access personal data solely to perform tasks on PromptFolder's behalf and are bound not to disclose or reuse it, but not one of these providers is named. Tracking cookies are used, and a Twitter/X conversion tag is present in the page code. The YouTube summarizer sends the video transcript to an OpenAI API along with the summary prompt. On the Chrome Web Store the publisher declares that the extension collects no user data, sells nothing to third parties and uses nothing outside its core function. Training models on customer data is never addressed anywhere on the site. No document restricts what a user may do with the prompts they write and store, and no permission process is described for reusing them.

Data retention & training

Hosting summary

PromptFolder declares no hosting country and no hosting region, neither in the privacy policy, nor in the terms, nor anywhere else on the site. The only statement on the subject is a generic transfer clause: information, including personal data, may be transferred to and kept on computers located outside the user's state or country, where data protection laws may differ. No transfer safeguard is named and no jurisdiction is committed to. One technical indication, collected independently and not a declaration by the publisher, is that the domain resolves to 159.89.242.1, an address geolocated in the United States on AS14061, DigitalOcean, LLC; that tells us where the web front end answers, not where saved prompts are stored. There is no trust or security page and no certification such as SOC 2 or ISO 27001. On security the publisher limits itself to acknowledging that the security of user data matters while no method of transmission or electronic storage is 100% secure.