Privacy Policy
Last updated: September 27, 2026
This policy explains how your personal data is processed when you use Prompt.Monster, in line with Turkish Personal Data Protection Law No. 6698 ("KVKK", Article 10) and the EU General Data Protection Regulation ("GDPR"). We do not sell your personal data.
1. Data controller
Data controller: Mehmet Kuru. Contact: hello@prompter.monster.
2. The personal data we process
3. Purposes and legal bases
We do not send marketing emails. If we ever do, it will only be with your separate opt-in and every message will include an unsubscribe link.
4. How we collect data
We collect personal data through the website and Studio forms, API and integration requests, cookies and similar technologies, and notifications from our payment provider, partly or fully by automated means.
5. Who we share data with
We share personal data only with the service providers below, and only as far as needed to run the Service:
Otherwise we only disclose personal data to competent public authorities when legally required.
6. International transfers
Because the providers above run servers outside Türkiye (mainly in the USA and the EU), your personal data is transferred abroad. These transfers are made in line with the transfer rules of KVKK Article 9 and the GDPR, relying on safeguards such as the providers' data processing agreements and standard contractual clauses.
7. How long we keep data
- Account and content data: while your account is open. When you delete your account on the My account page it is removed from the live database immediately; after a closure request by email it is deleted or anonymised within 30 days. Removal from backups can take up to 30 more days.
- Share pages: until you remove them or your account is deleted.
- AI usage records: linked to your account while it is open; after closure they are kept only as anonymous statistics.
- IP address: up to 48 hours for rate limiting and security; in usage statistics only as an irreversible hash, for up to 12 months.
- Payment and invoice records: for the period required by tax and commercial law (generally 10 years in Türkiye). Lemon Squeezy is the primary holder of invoice records.
- Support correspondence: up to 2 years after the request is resolved.
- Cookies: as listed in the Cookie Policy.
8. Security
Data is encrypted in transit with TLS. The database enforces row-level security so each user can only reach their own data. Passwords are stored only as hashes and administrative access follows the principle of least privilege. No system is 100% secure; if a data breach occurs we will notify the Turkish Personal Data Protection Board and affected people as the law requires.
9. Your rights
Under KVKK Article 11 you have the right to:
- learn whether your personal data is processed and, if so, request information about it
- learn the purpose of processing and whether data is used accordingly
- know the third parties in Türkiye or abroad to whom data is transferred
- ask for incomplete or inaccurate data to be corrected, for data to be erased or destroyed under KVKK Article 7, and for these actions to be notified to the recipients
- object to an outcome against you that results exclusively from automated analysis
- claim compensation if you suffer damage from unlawful processing
You can download a copy of your data as JSON with "Download my data" on the My account page, and delete your account permanently from the same page.
If you are in the EU/EEA, the GDPR also gives you the rights to data portability, restriction of processing, objection, and to lodge a complaint with the supervisory authority in your country. Where processing is based on consent you can withdraw it at any time; you can change your cookie choices on the Cookie Policy page.
10. How to make a request
Write to hello@prompter.monster from the email address registered in our system. We may ask for extra information to verify your identity. We will answer free of charge within 30 days at the latest; if the request involves a separate cost, the fee set by the Board may be charged. If you are not satisfied with our answer you can complain to the Turkish Personal Data Protection Board (or, in the EU/EEA, your local supervisory authority).
11. Automated decisions
We do not make decisions with legal effects about you based solely on automated processing. Technical controls such as usage limits are applied automatically.
12. Children
The Service is not directed at children under 16 and we do not knowingly collect personal data from them.
13. Changes
We may update this policy and will announce material changes on the site. The current version is always on this page.
This English version is provided for convenience. If it differs from the Turkish version, the Turkish version prevails.