👹
Prompt.Monster

Privacy Policy

Last updated: September 27, 2026

This policy explains how your personal data is processed when you use Prompt.Monster, in line with Turkish Personal Data Protection Law No. 6698 ("KVKK", Article 10) and the EU General Data Protection Regulation ("GDPR"). We do not sell your personal data.

1. Data controller

Data controller: Mehmet Kuru. Contact: hello@prompter.monster.

2. The personal data we process

CategoryExamplesSource
Identity and contactEmail address, your name (if you give it)Sign-up form, payment provider
Account securityPassword (hashed only, held by our authentication provider), session dataSign-up and sign-in
ContentProject ideas, descriptions, selections, generated prompts, versions, share pagesWhat you enter in the Studio
Usage and transactionsAI usage records (feature, time, model, token counts), plan and subscription status, the campaign source you arrived fromAutomatic
PaymentOrder and subscription IDs, plan, country, billing email (card details never reach us)Lemon Squeezy
TechnicalIP address, browser and device information, error logsAutomatic
CorrespondenceEmails and support requests you send usYou
Cookie data (only with your consent)Analytics and ad measurement dataCookies — see the Cookie Policy

3. Purposes and legal bases

PurposeLegal basis (KVKK Art. 5 / GDPR Art. 6)
Creating your account, signing in, providing the Service, storing your projectsPerformance of a contract (KVKK 5/2-c; GDPR 6(1)(b))
Running the AI features (sending your text to the model)Performance of a contract (KVKK 5/2-c; GDPR 6(1)(b))
Subscriptions, payments, invoicing and refundsContract and legal obligation (KVKK 5/2-c, 5/2-ç; GDPR 6(1)(b), 6(1)(c))
Transactional emails (verification, password reset, billing notices)Performance of a contract (KVKK 5/2-c; GDPR 6(1)(b))
Security, preventing abuse and fraud, usage limitsLegitimate interests (KVKK 5/2-f; GDPR 6(1)(f))
Improving the Service, aggregate statistics, campaign source measurement (no individual profiling)Legitimate interests (KVKK 5/2-f; GDPR 6(1)(f))
Analytics and advertising cookies, ad conversion measurementConsent (KVKK 5/1; GDPR 6(1)(a)) — you can withdraw it at any time
Responding to legal claims and disputesEstablishing, exercising or defending legal claims; legal obligation (KVKK 5/2-e, 5/2-ç)

We do not send marketing emails. If we ever do, it will only be with your separate opt-in and every message will include an unsubscribe link.

4. How we collect data

We collect personal data through the website and Studio forms, API and integration requests, cookies and similar technologies, and notifications from our payment provider, partly or fully by automated means.

5. Who we share data with

We share personal data only with the service providers below, and only as far as needed to run the Service:

ProviderPurposeLocation
Cloudflare, Inc.Hosting, content delivery, security, rate limitingUSA / global network
Supabase, Inc.Database and authenticationUS company; server region per project settings
Anthropic, PBCAI processing (Claude)USA
Resend, Inc.Transactional email deliveryUSA
Lemon Squeezy (Link, LLC)Payments, subscriptions, invoicing and tax (merchant of record — processes payment data as an independent controller under its own policy)USA
Google LLC / Google Ireland Ltd.Analytics and ad measurement (only with your consent)USA / EU
Meta Platforms Ireland Ltd.Ad measurement (only with your consent)EU / USA

Otherwise we only disclose personal data to competent public authorities when legally required.

6. International transfers

Because the providers above run servers outside Türkiye (mainly in the USA and the EU), your personal data is transferred abroad. These transfers are made in line with the transfer rules of KVKK Article 9 and the GDPR, relying on safeguards such as the providers' data processing agreements and standard contractual clauses.

7. How long we keep data

  • Account and content data: while your account is open. When you delete your account on the My account page it is removed from the live database immediately; after a closure request by email it is deleted or anonymised within 30 days. Removal from backups can take up to 30 more days.
  • Share pages: until you remove them or your account is deleted.
  • AI usage records: linked to your account while it is open; after closure they are kept only as anonymous statistics.
  • IP address: up to 48 hours for rate limiting and security; in usage statistics only as an irreversible hash, for up to 12 months.
  • Payment and invoice records: for the period required by tax and commercial law (generally 10 years in Türkiye). Lemon Squeezy is the primary holder of invoice records.
  • Support correspondence: up to 2 years after the request is resolved.
  • Cookies: as listed in the Cookie Policy.

8. Security

Data is encrypted in transit with TLS. The database enforces row-level security so each user can only reach their own data. Passwords are stored only as hashes and administrative access follows the principle of least privilege. No system is 100% secure; if a data breach occurs we will notify the Turkish Personal Data Protection Board and affected people as the law requires.

9. Your rights

Under KVKK Article 11 you have the right to:

  • learn whether your personal data is processed and, if so, request information about it
  • learn the purpose of processing and whether data is used accordingly
  • know the third parties in Türkiye or abroad to whom data is transferred
  • ask for incomplete or inaccurate data to be corrected, for data to be erased or destroyed under KVKK Article 7, and for these actions to be notified to the recipients
  • object to an outcome against you that results exclusively from automated analysis
  • claim compensation if you suffer damage from unlawful processing

You can download a copy of your data as JSON with "Download my data" on the My account page, and delete your account permanently from the same page.

If you are in the EU/EEA, the GDPR also gives you the rights to data portability, restriction of processing, objection, and to lodge a complaint with the supervisory authority in your country. Where processing is based on consent you can withdraw it at any time; you can change your cookie choices on the Cookie Policy page.

10. How to make a request

Write to hello@prompter.monster from the email address registered in our system. We may ask for extra information to verify your identity. We will answer free of charge within 30 days at the latest; if the request involves a separate cost, the fee set by the Board may be charged. If you are not satisfied with our answer you can complain to the Turkish Personal Data Protection Board (or, in the EU/EEA, your local supervisory authority).

11. Automated decisions

We do not make decisions with legal effects about you based solely on automated processing. Technical controls such as usage limits are applied automatically.

12. Children

The Service is not directed at children under 16 and we do not knowingly collect personal data from them.

13. Changes

We may update this policy and will announce material changes on the site. The current version is always on this page.

This English version is provided for convenience. If it differs from the Turkish version, the Turkish version prevails.