Privacy Policy
Promptly
Last updated: 7 August 2026
Summary
Before you read the detail, here is the short version:
- When you take our quiz, we collect the answers you give plus your email address, so that we can recommend the right course and send you your results.
- We collect standard technical data automatically — IP address, device and browser type, and how you move through our site.
- We use advertising and analytics tools from Meta and Google. These set cookies and share data with those companies. In the EU, EEA and UK we only do this if you consent through our cookie banner.
- We never see or store your full card details. Payments are handled by Lemon Squeezy.
- We operate from outside the EU, EEA and UK. If you are in one of those regions, your data is transferred outside it under European Commission Standard Contractual Clauses.
- You can ask us to show you, correct, or delete your data at any time: support.promptly@gmail.com
1. Who is responsible for your data
Promptly is the controller of your personal data. You can reach us using the details below and in Section 13.
Contact for all privacy matters: support.promptly@gmail.com
In this policy, "personal data" means any information relating to an identified or identifiable natural person, as defined in Article 4(1) GDPR.
2. What data we collect
2.1 Data you give us
Quiz and onboarding responses. When you complete our questionnaire, we collect the answers you provide. Depending on the questions asked, this may include your professional role, industry, level of experience with AI tools, learning goals and similar preferences.
We do not ask for, and ask you not to provide, any special category data as defined in Article 9 GDPR — such as data about health, racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic or biometric data, or sexual orientation.
Contact details. Your email address, and your name where you provide it.
Account data. Your login credentials (passwords are stored only in hashed form) and your course progress.
Communications. The content of any message you send us, including support requests.
2.2 Data we collect automatically
Technical and device data. IP address, approximate location derived from IP address (country and city level), browser type and version, operating system, device type, screen resolution, language and time zone settings.
Usage data. Pages viewed, time spent, links and buttons clicked, quiz questions answered, lessons started and completed, and the paths you take through the Service.
Marketing attribution data. The referring URL and any campaign parameters (such as UTM tags) that tell us which advertisement or link brought you to us.
Cookies and similar technologies. See Section 5.
2.3 Payment data
Payments are processed by Lemon Squeezy LLC as merchant of record. We never receive or store your full payment card number, CVC or equivalent credentials.
We do receive from Lemon Squeezy: the date, amount and currency of your transaction, the payment method type, the last four digits of your card, your billing country, and your order and customer identifiers. We need this to give you access to what you bought and to handle refunds and support.
3. Why we use your data, and our legal basis
The following legal bases apply to users in the EU, EEA and UK.
| Purpose | Data used | Legal basis |
|---|---|---|
| Delivering the course you purchased and managing your account | Account data, contact details, transaction data | Performance of a contract (Art. 6(1)(b)) |
| Showing your quiz results and recommending a suitable course | Quiz responses | Steps taken at your request prior to entering a contract (Art. 6(1)(b)) |
| Providing customer support and handling refunds | Contact details, transaction data, communications | Performance of a contract (Art. 6(1)(b)) |
| Sending service messages (receipts, access details, essential updates) | Contact details | Performance of a contract (Art. 6(1)(b)) |
| Sending marketing emails about our courses | Contact details, quiz responses | Consent (Art. 6(1)(a)), which you may withdraw at any time |
| Analytics to understand and improve the Service | Usage data, technical data | Consent where cookie-based (Art. 6(1)(a)); otherwise our legitimate interest in improving our product (Art. 6(1)(f)) |
| Advertising, retargeting and measuring campaign performance | Technical data, usage data, marketing attribution data | Consent (Art. 6(1)(a)) |
| Preventing fraud, abuse and credential sharing; enforcing our Terms | Technical data, usage data, account data | Our legitimate interest in protecting our business and paying customers (Art. 6(1)(f)) |
| Complying with legal, tax and accounting obligations | Transaction data | Legal obligation (Art. 6(1)(c)) |
Where we rely on legitimate interests, we have assessed that our interests are not overridden by your rights and freedoms. You may object to this processing — see Section 8.
4. Who we share your data with
We do not sell your personal data.
We share data with the following categories of recipient, only as necessary:
Payment and commerce
- Lemon Squeezy LLC (a Stripe company) — merchant of record, payment processing, tax remittance, refunds
Infrastructure
- Vercel Inc. — website hosting
Communications
- Google LLC (Gmail) — transactional and support email
Analytics
- Google (Google Analytics)
Advertising
- Meta Platforms (Facebook and Instagram advertising, Meta Pixel, Custom Audiences)
- Google (Google Ads)
Professional advisers and authorities
- Our accountants, auditors and legal advisers, under duties of confidentiality
- Courts, regulators, tax authorities and law enforcement, where we are legally required to disclose, or where disclosure is necessary to establish, exercise or defend legal claims
Business transfers
- If we sell or reorganise our business, personal data may be transferred to the acquiring party. We will notify you and the acquirer will remain bound by this policy or a materially equivalent one.
Each service provider is engaged under a written data processing agreement and may process your data only on our instructions.
5. Cookies and tracking technologies
We use cookies and similar technologies to operate the site, remember your preferences, measure how the site is used, and deliver and measure advertising.
Strictly necessary cookies are required for the site to function — for example, keeping you logged in. These are used on the basis of our legitimate interest and cannot be switched off.
Analytics and advertising cookies — including the Meta Pixel, Google Ads and Google Analytics tags — are only set after you consent through the cookie banner shown on your first visit, if you are in the EU, EEA or UK.
You can change or withdraw your cookie consent at any time using the "Cookie settings" link in our website footer. You can also block or delete cookies through your browser settings, though this may affect how the site works.
Advertising identifiers can additionally be controlled in your device settings and through your Meta and Google account ad preferences.
We do not currently respond to browser "Do Not Track" signals, as no common standard has been agreed. We do honour Global Privacy Control signals where required by applicable law.
6. International transfers
We are established outside the EU, EEA and UK, in a country that is not the subject of an adequacy decision by the European Commission or the UK Government.
Where we transfer personal data from the EU, EEA or UK to our own country of establishment or to any other country without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum, where applicable), together with supplementary technical and organisational measures where our transfer risk assessment identifies them as necessary.
Some of our service providers are located in the United States. Where a provider is certified under the EU–US Data Privacy Framework, we rely on that framework; otherwise we rely on Standard Contractual Clauses.
You may request details of our country of establishment and a copy of the safeguards we have put in place by writing to support.promptly@gmail.com.
7. How long we keep your data
| Data | Retention period |
|---|---|
| Account and course access data | For as long as your account is active, then 12 months |
| Quiz responses where no purchase follows | 12 months from collection |
| Transaction and invoicing records | As required by applicable tax and accounting law, currently up to 5 years |
| Marketing contact data | Until you withdraw consent or unsubscribe, then removed from active lists and retained only on a suppression list so we do not contact you again |
| Support correspondence | 24 months from resolution |
| Analytics and advertising data | In line with the retention settings of each platform, typically up to 14 months |
We delete or anonymise data once these periods expire, unless we must retain it to establish, exercise or defend legal claims.
8. Your rights
If you are in the EU, EEA or UK, you have the right to:
- Access the personal data we hold about you and receive a copy
- Rectify inaccurate or incomplete data
- Erase your data ("right to be forgotten") in certain circumstances
- Restrict our processing in certain circumstances
- Object to processing based on legitimate interests, and to object at any time to processing for direct marketing — we will stop immediately in the latter case
- Data portability — receive your data in a structured, commonly used, machine-readable format
- Withdraw consent at any time, without affecting the lawfulness of processing before withdrawal
- Not be subject to decisions based solely on automated processing that produce legal or similarly significant effects. We do not carry out such decision-making.
To exercise any of these rights, email support.promptly@gmail.com. We will respond within one month. We may ask you to verify your identity before acting.
Right to complain. You may lodge a complaint with the data protection authority in your country of residence or place of work. We would appreciate the chance to address your concern first.
9. Rights of United States residents
If you are a resident of California, Colorado, Connecticut, Virginia or another state with comprehensive privacy legislation, you have the right to know what personal information we collect and how it is used, to request deletion, to request correction, to obtain a portable copy, and to opt out of the "sale" or "sharing" of personal information and of targeted advertising.
We do not sell personal information for money. However, our use of advertising cookies may constitute "sharing" for cross-context behavioural advertising under California law. You can opt out using the "Cookie settings" link in our footer or by transmitting a Global Privacy Control signal.
We will not discriminate against you for exercising any of these rights. To make a request, email support.promptly@gmail.com.
10. Children
The Service is intended for adults aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, contact support.promptly@gmail.com and we will delete it.
11. Security
We apply appropriate technical and organisational measures to protect your data, including encryption in transit, hashed password storage, access controls limiting staff access to those who need it, and regular review of our providers.
No method of transmission or storage is entirely secure, and we cannot guarantee absolute security. If a personal data breach occurs that is likely to result in a high risk to your rights and freedoms, we will notify you and the relevant supervisory authority as required by law.
12. Changes to this policy
We may update this policy. Where changes are material, we will notify you by email or through a prominent notice on the Service before they take effect. The "Last updated" date above always reflects the current version.
13. Contact
Promptly
Privacy enquiries, rights requests and general support: support.promptly@gmail.com