PROMPTLINE STUDIO
Data Policy
Effective August 23, 2026 | Version 1.0
| Plain-language commitment. Promptline Studio collects only information reasonably needed to answer inquiries and deliver agreed services. We do not sell personal information or use client data to train public AI models. Clients retain ownership and control of their data. |
1. Purpose and scope
This Data Policy explains what Promptline Studio (“Promptline,” “we,” “us,” or “our”) collects, why we use it, where it may be stored, how long it is retained, and how a person or client may request access, correction, return, or deletion of that data. It applies to our website, consultations, projects, training, support, and related business administration.
When Promptline processes information solely for a business client, that client determines the purpose and permitted use of the data. The signed Service Level Agreement, Scope of Work, and Data Processing Addendum provides stricter or more specific terms to the Master Service Level Agreement.
2. Consent and choices
By submitting information or engaging Promptline, you acknowledge this policy and authorize the processing reasonably required to respond to you or provide the requested service. Where consent is the legal basis for a particular use, you may withdraw it prospectively at any time. Withdrawal does not invalidate processing already completed and may prevent us from continuing a service that requires the information.
3. Information we collect
- Contact and identity information, such as name, business name, role, email address, telephone number, and preferred contact method.
- Inquiry and project information, including goals, workflow descriptions, consultation notes, files, prompts, source documents, and instructions voluntarily supplied by the client.
- Client data approved for a project, which may include business records, correspondence, spreadsheets, datasets, or database content identified in the Scope of Work.
- Administrative and transaction records, such as proposals, contracts, invoices, payment status, consent records, and support communications. Payment card details should be handled by the payment processor, not stored by Promptline.
- Limited website and security data, such as IP address, browser/device information, timestamps, referral pages, cookie choices, and logs reasonably needed for operation, security, and basic analytics.
Please do not send Social Security numbers, full payment-card data, health records, biometric data, passwords, private encryption keys, or other highly sensitive information unless Promptline has expressly approved a secure transfer method and the signed Scope of Work requires it.
4. How we use information
- Respond to inquiries; schedule consultations; prepare proposals, scopes, estimates, and agreements.
- Organize client materials; design prompts, workflows, local LLMs, AI agents, training, documentation, and support agreed in writing.
- Operate, secure, troubleshoot, and improve our services; maintain business and tax records; enforce agreements; and comply with law.
- Send marketing only when permitted, with an unsubscribe option.
Promptline will not sell or rent personal information. We will not place client-confidential data into a public or consumer AI service, use it to train a public model, or materially change the approved purpose without the client’s written authorization.
5. Storage, transfers, and service providers
Project data is stored in the location selected or approved by the client and documented in the Scope of Work. This may be a client-controlled local device or server, a client-controlled cloud repository, or a restricted Promptline workspace used temporarily to perform the services. Local storage is preferred when it fits the project; cloud processing is used only when approved and appropriate.
Promptline may use vetted hosting, communications, payment, security, backup, and AI/software providers that need limited access to perform a contracted function. Their access must be limited to the approved purpose and subject to confidentiality and security obligations. Material AI or cloud providers used for client data should be identified in the Scope of Work or an incorporated provider list.
Information may be processed in the United States or where an approved provider operates. When applicable law requires additional safeguards for a transfer, Promptline and the client will document them before the transfer occurs.
6. Retention schedule
Promptline keeps identifiable information only for the periods below, unless a signed agreement requires a shorter period or law, litigation hold, fraud prevention, or an unresolved dispute requires a longer one.
| Record or data category | Default retention period |
| Unconverted inquiries | 6 months after the last substantive contact. |
| Active project data and working copies | For the project term, then returned or securely deleted within 30 days after completion or termination, unless the Scope of Work states otherwise. |
| System backups containing deleted data | Isolated from ordinary use and overwritten or expired through the normal backup cycle, generally within 90 days. |
| Contracts, invoices, payment status, and tax records | 7 years after the relevant transaction or end of the client relationship. |
| Consent, authorization, and material project decision records | 7 years after the client relationship ends. |
| Website and security logs | Up to 12 months, unless needed to investigate an incident. |
| Marketing contact information | Until consent is withdrawn or the recipient opts out; a minimal suppression record may be retained to honor the opt-out. |
| Deidentified or aggregated information | May be retained longer if it cannot reasonably be used to identify a person or client and is not reidentified. |
7. Access, correction, return, and deletion
A person may request access to, correction of, a portable copy of, return of, or deletion of information associated with them. A person may also withdraw consent or opt out of marketing or other processing where applicable. Promptline will not discriminate against anyone for exercising a privacy right.
How to submit a request:
Email at us at: front-desk@promptline-studio.com “Data Request” in the subject or opening line. Identify the name, email address, client or project, requested action, and the information involved. Do not include sensitive documents in the initial request.
Promptline may request proportionate information to verify identity and authority. An authorized agent may act for another person when authority can be verified. We ordinarily acknowledge requests within 5 business days and complete them within 30 days, or within the period required by applicable law. We will explain any lawful extension or denial.
Deletion is subject to limited exceptions, including records needed to complete a transaction, honor an opt-out, comply with tax or legal duties, establish or defend legal claims, prevent fraud, or maintain security. Deleted data may remain in restricted backups until the backup cycle expires and will not be restored except for disaster recovery or legal necessity.
8. Security and incidents
Promptline uses safeguards appropriate to the nature and risk of the information, including access limits, strong authentication, encryption where available, secure transfer methods, backups, confidentiality obligations, and disposal procedures. No system is completely secure, and Promptline cannot guarantee that unauthorized access will never occur.
If Promptline confirms a security incident affecting client data, it will contain and investigate the incident and notify the affected client without unreasonable delay—targeting an initial notice within 48 hours after confirmation—subject to law-enforcement needs and applicable law. The notice will describe known facts, likely impact, containment, and recommended actions as information becomes available.
9. AI processing and human review
AI processing is limited to the tools, information, and purposes approved for the project. Promptline seeks to minimize personal and confidential information before processing and configures available provider controls to limit retention or model training when appropriate. AI outputs may be inaccurate, incomplete, biased, or unsuitable. They are drafts and must be reviewed by a qualified person before decisions, publication, or operational use. Promptline does not provide legal, medical, financial, employment, or other regulated professional advice unless separately licensed and agreed in writing.
10. Children, changes, and contact
Promptline’s services are not directed to children under 18, and we do not knowingly collect their personal information. If you believe a child has provided information, submit a Data Request so it can be reviewed and deleted as appropriate.
We may update this policy to reflect changes in services, providers, or law. The posted version will show the effective date. Material changes affecting active client data will be communicated when reasonably required.
Privacy and data contact: front-desk@promptline-studio.com
Implementation note (not part of the public policy): Before publication, have licensed counsel confirm state-specific requirements and replace the contact form with a monitored privacy email if available. Ensure actual systems, vendor settings, contracts, and deletion procedures match every promise in this policy.
Required acknowledgment: “I have read the Promptline Studio Data Policy and consent to the collection, use, storage, and retention of the information I submit for responding to my inquiry and providing requested services.”
Project-specific AI authorization: “I authorize Promptline Studio to process the data identified in the applicable Scope of Work using the approved AI, software, and cloud services listed there. I understand that AI-generated results may be incomplete or inaccurate and require human review.”
Optional marketing choice: “I would like to receive Promptline Studio news and service updates. I may unsubscribe at any time.”
Consent boxes should be separate, unbundled, and not preselected. Marketing consent is never required to receive consulting services.