Effective date: July 27, 2026
This Privacy Policy describes how PromptGraph (“PromptGraph,” “Service,” “we,” “us,” or “our”) collects, uses, discloses, and safeguards information in connection with the Service. It applies to account holders (“you”) and, where relevant, to the businesses tracked through accounts on the Service. By using the Service, you agree to the collection and use of information as described here, in conjunction with our Terms of Service.
1.1. Account information. When you register, we collect your name, email address, and a securely hashed password. If you subscribe to a paid plan, we additionally collect billing-related details submitted at checkout (such as phone number, business name, and number of locations) and receive subscription status information from Stripe.
1.2. Business data. If you add a business (“Client”) to be tracked, we collect the information you provide about it, which may include its name, domain, contact details, address, hours, category and services, social links, and an API key used to authenticate requests on its behalf.
1.3. Connected account data. If you connect a Google Business Profile or Google Analytics (GA4) property, we collect and store the OAuth access and refresh tokens necessary to retrieve data on your behalf, along with the data those integrations return (for example, GA4 property/analytics data, or Google Business Profile ratings and reviews). You can disconnect these integrations at any time; doing so stops future data retrieval but does not automatically delete data already retrieved.
1.4. AI Position Data. When the Service runs a tracked prompt against a third-party AI platform (currently ChatGPT, Google Gemini, or Grok), we store the prompt, the AI platform’s response text, whether the tracked business was mentioned, its position relative to competitors, and related metadata such as competitor names and citation URLs referenced in that response.
1.5. Crawler and visitor data. The Service’s machine-readable business-data endpoints are accessed by AI crawlers and other automated visitors. We log technical data about these requests, such as user agent, referrer, requested URL, and an inferred classification of the visitor, to support the analytics features of the Service. This data generally identifies a crawler or visitor pattern, not a specific person.
1.6. Payment information. Payment card details are collected and processed directly by Stripe, our payment processor. We do not receive or store your full card number.
We use the information described above to:
We do not sell your personal information, and we do not use business data submitted to the Service to train third-party AI models beyond the ordinary act of submitting your configured prompts to those platforms in the course of running the Service.
We share information with the following categories of third-party providers as necessary to operate the Service. Each provider processes information under its own privacy policy and terms:
We do not control, and are not responsible for, how these third parties independently process information once it is submitted to them in the course of providing their service to us.
We retain account information for as long as your account remains active, and AI Position Data and analytics data for as long as reasonably necessary to provide historical reporting and trend comparisons within the Service. If you delete your account, we deactivate access and remove or anonymize personal information within a reasonable period, except where retention is required to comply with legal, accounting, or billing obligations (for example, Stripe transaction records).
We use reasonable administrative, technical, and physical safeguards designed to protect information processed through the Service, including hashed password storage and encrypted transmission. No method of transmission or storage is completely secure, and we cannot guarantee absolute security of information you submit to the Service.
6.1. You may access, correct, or delete your account information at any time through your account settings, or by contacting us as described in Section 9.
6.2. You may disconnect any connected Google integration (GA4 or Google Business Profile) at any time, which revokes our ability to retrieve further data through that connection.
6.3. Depending on your location, you may have additional rights under applicable data protection law, such as the right to request a copy of your data or to request deletion. Contact us to make such a request, and we will respond as required by applicable law.
The Service is not directed to, and is not intended for use by, individuals under 18 years of age. We do not knowingly collect personal information from children.
We may update this Privacy Policy from time to time. If we make material changes, we will update the effective date above and, where appropriate, notify account holders. Continued use of the Service after changes take effect constitutes acceptance of the revised policy.
Questions about this Privacy Policy, or requests regarding your information, may be directed to support@promptgraph.ai.