PrometAI

GDPR overview

The site never writes the word GDPR and never claims compliance. What the privacy policy — last updated on 2 February 2024 — does set out is a list of rights mirroring the regulation: access, rectification, erasure, restriction, portability, objection, withdrawal of consent and complaint to a supervisory authority, exercised through its Contact Information section. International transfers are said to rely on standard contractual clauses approved by the European Commission, or on a provider's Privacy Shield certification, a framework invalidated in 2020 that dates the document. The terms add that mandatory provisions of an EU customer's national law still apply despite the choice of Delaware law. No Article 27 representative is named, no data protection officer is appointed, no DPA is offered and no subprocessor list is published. Minimum age: 16.

Who owns the data?

You keep every right to what you create on the platform — business plans, text, images — and PrometAI, Inc. states plainly that it claims no ownership of that content. By using the service you grant the company a limited, non-exclusive, royalty-free licence to access, use, reproduce, modify and display it, solely to deliver and improve the service. Access is restricted to authorised staff bound by confidentiality, and the company undertakes not to publish or disclose your plans without your consent, save where the law compels it. The platform itself — site, software, logos — remains the exclusive property of PrometAI, Inc. Feedback you send is freely usable by the company.

Reuse rights

Yes: the plan, the financial statements and the images you generate are yours to reuse without asking permission. Nothing in the terms limits what you do with the output — submit it to a bank, a visa office or an investor, adapt it, reuse it commercially. Sharing is built in: every plan carries a share button that produces a view-only link, and paid tiers add PDF and PowerPoint export, the free tier watermarking its PDF. The restrictions run the other way, on the platform's own assets: PrometAI's site, software and logos may not be copied, and AI regeneration credits may not be used to turn an existing plan into a plan for an entirely different business, which the company treats as requiring another plan credit.

Data retention & training

Hosting summary

PrometAI says little about where data lives. The privacy policy states that its primary hosting and processing facilities are situated in 'East US 2' — a United States data-centre region label — and never names the provider behind it. Network checks carried out for this review resolve the domain to Microsoft infrastructure (AS8075), consistent with an Azure region but not confirmed by the vendor. The company describes itself as operating globally and warns that personal information may be processed and stored outside the country where it was collected, citing standard contractual clauses approved by the European Commission, or a provider's Privacy Shield certification, as safeguards. No choice of region is offered and no data-residency option is documented; hosting suppliers are described only as reputable services known for their security standards. There is no DPA, no published subprocessor list and no security certification to corroborate any of it. Anyone with a residency requirement should ask the vendor directly before uploading a plan.