Privacy policy

The controller of personal data processed in connection with the prompt-inzynier.pl website is Golden Saunas sp. z o.o., the company that runs the website under the Prompt Inżynier brand.

For anything related to the processing of your personal data, including exercising your rights, write to [email protected].

When you submit the contact form, we process the data you enter: your name, email address, company name, selected topic, indicative budget, message, and the language version of the website the form was sent from.

Form data is sent over an encrypted connection (HTTPS) to the server that hosts this website (AZ.pl hosting) and sent from there as an email to the controller’s mailbox. The server does not store the form content. To protect the form against abuse, we keep a one-way hash of the IP address together with the number of submissions for up to 24 hours; after that the data is deleted. The form does not use any third-party form services or marketing tools.

The same rules apply to messages you send directly to our email address.

Purposes and legal bases:

• replying to your enquiry, preparing a proposal and taking steps at your request before entering into a contract — Art. 6(1)(b) GDPR;
• handling correspondence, including matters not related to a contract, and establishing, exercising or defending legal claims — the controller’s legitimate interest (Art. 6(1)(f) GDPR).

Providing your data is voluntary, but we cannot reply without an email address and a message.

Prompts, drafts, history and settings you create in Prompt Engineering Studio are stored only in your browser’s local storage (localStorage) on your device. They are not sent to our servers and the controller has no access to them.

You can delete them at any time by clearing the history in the Studio or the site data in your browser settings. Deletion is permanent because we keep no copy.

The Studio may offer an optional AI assist (for example, analysing or improving a prompt). It is off by default and only runs when you enable and start it.

When you use it, the prompt text and the parameters needed for the task (such as the selected mode and language) are sent over an encrypted connection to the controller’s n8n instance and from there to an external AI model provider, OpenAI, which generates the response. API keys for AI services are held only in n8n; your browser never connects to the AI provider directly.

By default we do not store prompts or responses once the request has been handled. The AI provider processes data under its terms for API services; under those terms, data sent through the API is not used to train models by default, but the provider may retain it for a limited period to detect abuse.

Purposes and legal bases:

• providing the feature you request (processing your prompt and returning the result) — Art. 6(1)(b) GDPR;
• keeping the service secure and preventing abuse — the controller’s legitimate interest (Art. 6(1)(f) GDPR).

Do not put personal data, passwords, API keys or confidential information into prompts. See the Terms of service for details.

On every visit, the hosting server and the content delivery network (CDN) automatically process technical data: IP address, date and time of the request, the requested URL, and browser and operating-system information. This is used to deliver the website, keep it secure and diagnose errors — the controller’s legitimate interest (Art. 6(1)(f) GDPR).

Data may only be shared with providers that help us run the website and process it on our behalf:

• the website hosting provider;
• Cloudflare — content delivery network (CDN) and protection against attacks;
• the infrastructure provider on which the controller’s n8n instance runs;
• the email service provider that receives messages from the form;
• OpenAI — only when you use the optional AI assist in the Studio.

These providers process data under data processing agreements or the data processing terms offered by the provider. We do not sell data or share it for marketing purposes.

Some providers (for example, Cloudflare and OpenAI) may process data outside the European Economic Area, in particular in the United States. Such transfers are based on the European Commission’s adequacy decision (EU-US Data Privacy Framework) where the provider is certified under it, or on standard contractual clauses approved by the European Commission (Art. 46 GDPR).

• Form enquiries and correspondence: for as long as needed to handle the enquiry and the conversation. If a contract is concluded, for the term of the contract and then until the limitation periods for claims expire, and for as long as tax and accounting laws require.
• Studio data in your browser: until you delete it.
• Optional AI assist: we do not store prompts or responses after the request has been handled (subject to the AI provider’s retention described above).
• Technical logs: for the period set by the hosting and CDN providers, and no longer than necessary for security and diagnostics.

Under the GDPR you have the right to:

• access your data and receive a copy;
• rectify your data;
• erasure (“right to be forgotten”);
• restriction of processing;
• data portability for data processed on the basis of a contract;
• object to processing based on legitimate interest (Art. 21 GDPR);
• withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing before withdrawal.

To exercise your rights, write to [email protected]. You also have the right to lodge a complaint with a supervisory authority — in Poland, the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa), or the authority in the EU country where you live or work.

We do not make decisions about you based solely on automated processing, including profiling, that produce legal effects or similarly significantly affect you. The AI assist in the Studio only suggests text that you evaluate yourself.

Our use of cookies and browser storage is described in the Cookie policy. We do not run any analytics or marketing tools; if we ever add them, they will only be enabled with your consent. You can change your choice at any time using the “Cookie settings” button in the footer.

We use appropriate technical and organisational measures to protect data against unauthorised access, loss or disclosure, including encrypted connections (HTTPS) and keeping access keys for external services on the server side only (n8n), never in the browser.

This privacy policy may be updated, for example when website features or the law change. We will announce material changes visibly on the website. The current version applies from the date shown at the top of the document.

This document is available in Polish, English, German and Ukrainian. Only the Polish version is legally binding; the other versions are provided for information. In case of any discrepancy, the Polish version prevails.