SaaS Prompts

GDPR overview

GDPR is addressed head-on, though without formal apparatus. Two dedicated sections exist: “Legal Basis for Processing Personal Data under the GDPR” for EEA residents, listing performance of a contract, consent, legitimate interests not overridden by the individual's rights, payment processing and legal obligation; and “Your Data Protection Rights under the GDPR”, covering access, update or deletion, rectification, objection, restriction, withdrawal of consent and the right to complain to a supervisory authority. Access, update and deletion are possible from account settings “whenever made possible”, and identity may be verified first. What is missing matters: no Article 27 EU representative, no named DPO, hello@saasprompts.com as sole contact, no DPA, no standard contractual clauses, no certification, and a policy carrying neither effective date nor version.

Who owns the data?

SaaS Prompts declares itself the Data Controller of your personal data. What it collects is listed openly: username, email address, first and last name, cookies and usage data such as IP address, browser type and version, pages visited, date and time of visit, time spent, unique device identifiers and diagnostic data. Card details are excluded — “We will not store or collect your payment card details” — and go straight to PCI-DSS compliant payment providers. Personal data, including the mailing list, may be transferred if the business is merged, acquired or sold, with prior notice. All site content belongs to the publisher under copyright, and unauthorised use, resale or distribution is forbidden. The terms say nothing about who owns the outputs you generate from a prompt.

Reuse rights

The privacy policy lists what the publisher does with the data: run and maintain the service, notify you of changes, let you take part in interactive features, provide customer support, produce analysis that improves the service, monitor usage, and detect, prevent and address technical problems. Marketing is stated outright — news, special offers and general information about similar goods and services unless you object, plus newsletters and promotional material with an unsubscribe link in every email. Google Analytics handles measurement. Behavioural remarketing runs through Google Ads (AdWords) and Facebook: “SaaS Prompts may use remarketing services to advertise on third party websites to you after you visited our Service.” Session, preference and security cookies are used alongside beacons, tags and scripts, and Do Not Track is not honoured — the CalOPPA section states in as many words that the site does not support Do Not Track (“DNT”). In the other direction, what you may reuse is limited: the site's content is copyright-protected and cannot be reused, resold or redistributed without permission, and the prompts themselves are meant to be copied into an assistant and adapted to your own product. Nothing in the documents addresses whether data feeds AI model training, because the subject is never raised.

Data retention & training

Hosting summary

Canada is the only jurisdiction named. The privacy policy states: “If you are located outside Canada and choose to provide information to us, please note that we transfer the data, including Personal Data, to Canada and process it there.” Using the service is treated as consent to that transfer, and the terms place governing law and jurisdiction in Ontario, Canada. Beyond the country, nothing is specified: no data centre, no cloud provider, no region. The site is delivered through Cloudflare, and the resolved IP address 104.21.77.161 belongs to AS13335 as an anycast CDN node, so it says nothing about where the data actually lives. The third parties named in the privacy policy (Google Analytics, Google Ads, Facebook, Stripe, PayPal/Braintree) necessarily involve processing outside Canada, without the site detailing it. No standard contractual clauses and no transfer mechanism of any kind are documented.