Privacy Policy

1. Who We Are and What This Covers

PromptSwing is operated by Bergen Ridge LLC. You can reach us at [email protected].

This policy covers:

• our website, www.promptswing.com, and its support assistant;
• the PromptSwing dashboard at app.promptswing.com, including Captain;
• the Captain by PromptSwing app for Android;
• PromptSwing hosting and Captain, including the stores we host on promptswing.io addresses and on merchants' own domains;
• our Shopify app, PromptSwing Profit Analytics; and
• the PromptSwing connector, which lets an AI assistant a merchant chooses work with their store.

2. Our Role

For merchant account and billing information, we decide how it is used.

For information about a merchant's own customers — collected by a store we host or received through our Shopify app — we process it on that merchant's behalf, to provide the services they turned on. The merchant is responsible for telling their customers how their information is used. If you shop with a store that uses PromptSwing, please contact that store first; we will help them answer you.

3. Information We Collect

Merchant accounts. Name, email address, password (stored only as a one-way hash), and, if you turn on two-factor sign-in, its secret and your recovery codes (the recovery codes are stored as hashes). We keep a record of sign-ins for security.

Billing. Subscriptions, FOUND BY AI purchases and prepaid time bought through an AI assistant are all paid through Stripe, which receives your payment details and billing address. We receive the purchase record and the billing address, never your card number.

FOUND BY AI. When you score or audit a website, we keep the report — the address, the checks and the score, never the site's pages — for 90 days. If you buy the weekly check, we keep the site address, the email the report goes to and the country you state. If you buy a pack of audits, we keep the email your key is sent to, the country you state, which audits used the pack, and the key itself only as a one-way hash, so we cannot read it back. Buying is your consent to receive that email. Payment is handled by Stripe.

Stores you build or host with us. Store content, products and prices, images you upload, your conversations with Captain, domain settings, a copy of each version of your store you publish, and each product's unit cost, if you enter it, which is never shown on your store.

Captain's notes about you. If you use Captain, it keeps a short profile of what you have told it (how you like to be spoken to, your goals, and what you have said yes or no to) so it remembers you between conversations. Each note points to the message it came from. You can read, change or delete any note, or switch the profile off, in Captain, and the profile is deleted with your account.

Your customers, on stores we host. Depending on what your store offers: carts, checkouts and orders (items, totals, the email address a shopper gives at checkout and whether they agreed to marketing emails, shipping destination details where the store collects them, and the page the shopper arrived from); how many times each product page was opened, counted by product and by day with no record of who opened it, kept 90 days ; reviews; messages sent through a contact form (name, email, message); bookings (name, email, phone, requested time); event replies (name, email, attendance, party size and message); and membership access. Store payments are processed by the merchant's own connected Stripe account; we do not receive card numbers. For each payment we record which products it was for (product, quantity and price), the shipping charged and Stripe's payment reference; we record refunds Stripe reports; and we read the Stripe fee on each payment from the merchant's own Stripe account when the merchant opens their Profit reading. These payment records hold no shopper's name, email address or card details.

Our Shopify app. The shop's domain and the access token Shopify issues; order and checkout notifications Shopify sends us, which can include customer details Shopify includes in them; each product's unit cost and the Shopify Payments fees on each order, read from the store when the merchant opens the Profit page; and checkout steps recorded by a Shopify web pixel. The pixel runs only when Shopify reports that the shopper allows analytics — in some regions that is the default unless the shopper opts out in the store's cookie choices. It records the step reached, the time, a scrambled (hashed) checkout identifier, and the text of any error message shown with the form field it relates to. It does not record names, email addresses, street addresses, phone numbers, card details, or what a shopper typed.

Tracked links. When someone clicks a short link a merchant shares through PromptSwing, we log the time, the referring page, the browser type and a scrambled (hashed) form of the IP address — never the address itself — so the merchant can see which links bring visitors and sales.

Businesses we may contact. To find new businesses that may want a store, we collect information about companies from public company registers and, at most, the company's own website: company name, registration details and location, website, whether it already sells online, and a contact email address only if the company publishes one on its site. These records are deleted after about 90 days. If we write to a business, it receives at most one message and one follow-up, the message says where we found it, and any reply or unsubscribe stops all further messages permanently; we keep a minimal record of that choice so we never write again.

AI assistant connector. Which AI app a merchant approved, the permissions they granted, and a log of each action that app takes on their store, so the merchant can see what it did.

Our website and support assistant. Messages you send to the assistant, and standard server logs such as IP address and browser type, which we use for security and to keep the service running.

4. How We Use It

We use information only to provide the services a merchant uses: building and hosting stores, showing store readings and insights, recording orders, and sending the emails described below. We also use it to secure accounts, prevent abuse, and meet legal obligations.

Emails. Account and billing emails, and notices about a store's plan — reminders before prepaid time ends, and a notice if a store is taken offline. On stores we host, where the merchant turns them on: one reminder about an unfinished checkout, sent only if the shopper agreed to marketing emails, and one review request per order.

Within one merchant account, our tools read each other's data — for example, insights look at orders, carts and reviews together. Between merchants, private data is never shared. The one exception is public product information already shown on a store we host (product name, description, image, price and whether it is in stock), which may appear in a combined product search across those stores; a merchant can ask us to remove their store from it.

We do not sell personal information, and we do not use or share it for advertising.

Legal bases (European Economic Area and UK). We process information to perform our contract with merchants, for our legitimate interests in running, securing and promoting a business service (including contacting businesses as described above), with consent where it is required (such as marketing emails to shoppers and the checkout pixel where analytics consent applies), and to meet legal obligations.

5. Service Providers

These companies process information for us, only to provide our services:

• Hetzner — servers and encrypted backups, in Europe.
• Cloudflare — delivering traffic to our sites and stores, security, and domain name services.
• Anthropic — AI processing, in the United States. When a store or page is generated, when Captain or an automated agent replies, or when a written insight is produced, the relevant text is sent to Anthropic. This can include messages a shopper sends to a merchant's agent. Under Anthropic's commercial terms this data is not used to train its models. Profit readings, on our Shopify app and on stores we host, and the Shopify app's checkout readings are calculated without AI.
• Together AI — AI processing, in the United States. Together AI runs the open-weights AI model we use for parts of a store's conversation, and the relevant text is sent to them. This can include messages a merchant or a shopper types. Email addresses, phone numbers and postal addresses are removed before the text is sent, and restored in our reply. Our account is set to zero data retention, so Together does not store this text or use it to train their models.
• OpenRouter — AI processing, used only when Together AI does not answer. OpenRouter passes the same text to one company from a short list running the same open-weights model. Every request requires zero data retention and no data collection, so neither OpenRouter nor that company stores the text or uses it to train models. The same email addresses, phone numbers and postal addresses are removed before the text is sent.
• Brave — web search. When Captain answers a question that needs current facts, a short search phrase is sent to Brave's Search API and the results come back with their sources. The phrase is written to hold no customer's details. Captain quotes each result with its source and never presents it as PromptSwing's own.
• Google Firebase Cloud Messaging — notifications in the Captain app for Android, in the United States. Only if an owner says yes in Captain, the phone's notification address (a device token) is kept with us and given to Google with each notification. A notification holds one short fixed line, such as “New order on your store”, and the message it points to — never a customer's words, a name, an amount or a product. Signing out, turning notifications off or deleting the account ends it.
• OpenAI — AI processing, in the United States. We use OpenAI's models in our own content tools, which we use to write PromptSwing's own material. These tools are not part of Captain or anything that reads a merchant's shop, so a merchant's store data and the messages shoppers send are not sent to OpenAI.
• Stripe — processes every payment to us and holds your payment details; Bergen Ridge LLC is the merchant of record. Billing questions: [email protected].
• Stripe — processes prepaid plan purchases, and payments on stores we host through each merchant's own connected account.
• USPS — when a store we host has shipping set up, the origin and destination postal details of a parcel are sent to USPS to get a shipping rate.
• Shopify — for merchants using our Shopify app, Shopify sends us store data as described above.
• Services a merchant chooses to connect, such as a GitHub repository or an advertising account — we exchange data with them only as needed for the feature the merchant turned on, for example reporting a store release back to the repository.
• Bluesky — when an owner connects their Bluesky account, they sign in on Bluesky's own page; we never see the password. We keep the sign-in Bluesky gives us, encrypted, and use it only to publish a post the owner approved word for word, or to delete a post we published for them. The post's text is sent to Bluesky and becomes public there under Bluesky's Privacy Policy. Disconnecting, or deleting the account, removes the sign-in.
• X — when an owner connects their X account, they sign in on X's own page; we never see the password. We keep the sign-in X gives us, encrypted, and use it only to publish a post or a reply the owner approved word for word, to delete one we published for them, and to read the replies left under posts we published for them (each reply's id, its author's handle and its text). What is published becomes public there under X's Privacy Policy. Disconnecting, or deleting the account, removes the sign-in.
• LinkedIn — when an owner connects their own LinkedIn profile, they sign in on LinkedIn's own page; we never see the password. We keep the sign-in LinkedIn gives us, encrypted, and the profile's name, and use the sign-in only to publish a post the owner approved word for word, or to delete a post we published for them. We read nothing else from LinkedIn. The post becomes public there under LinkedIn's Privacy Policy. LinkedIn's sign-in lasts sixty days; disconnecting, or deleting the account, removes it sooner.
• YouTube (Google) — when a store's owner has added a YouTube channel, PromptSwing uses the YouTube API Services to check whether that channel is live; only the channel is sent, nothing about a visitor. If a visitor taps Watch, YouTube's player opens and YouTube may set cookies and collect data under Google's Privacy Policy. Nothing from YouTube loads before that tap.
• Google Fonts — stores we host load their typefaces from Google, so a visitor's browser connects to Google's servers when a store page opens.

Our email is sent from our own mail server (mail.promptswing.com), not through an email marketing company.

6. How Long We Keep It

Accounts. For as long as the account is open. When you ask us to delete your account, we remove its data from our live systems within 30 days.

Hosted stores after a plan ends. A store is taken offline three days after payment was due. Its content is kept for 90 days so it can be brought back; after that, the store's files and saved versions are deleted. The account, its order records and a record of past releases remain until the account is deleted.

Our Shopify app. While the app is installed. When a merchant uninstalls it, we discard the shop's access token at once. Shopify then sends us a deletion request for the shop, 48 hours later, and we delete the shop's stored order, checkout and profit data when it arrives. When Shopify asks us to remove a customer's data, we remove that customer's personal details from the orders we hold.

FOUND BY AI packs. The email your key is sent to and the country you state are kept until one year after the pack was last used (or bought, if it was never used), or deleted sooner when you ask.

Backups. Our databases are backed up every six hours, encrypted, and the backups are kept for about 14 days. Deleted data can remain in a backup until that backup is removed.

7. Security

Traffic to our sites, stores and services uses HTTPS. Webhooks from Shopify and payment providers are checked with their signatures. Passwords and recovery codes are stored only as hashes, two-factor sign-in is available, sign-in attempts are rate-limited, backups are encrypted, and access to our servers requires an SSH key. No system is perfectly secure; if you believe you have found a vulnerability, write to [email protected].

8. Your Choices and Rights

Merchants can ask to see, correct, export or delete their data, and can disconnect a store or uninstall our Shopify app at any time, which stops future collection. Shoppers can decline analytics in a Shopify store's cookie choices, which stops our checkout pixel for them, and can leave the marketing-email box unticked at checkout on stores we host.

Depending on where you live, you may have further rights, such as to object to or restrict certain processing. To make a request, write to [email protected]. We respond within 30 days.

9. Cookies and Local Storage

The PromptSwing dashboard uses cookies needed to keep you signed in. Stores we host use the browser's local storage to remember a shopper's cart. We do not place advertising cookies. A store's YouTube player, opened only when a visitor taps Watch, is YouTube's and may set YouTube's cookies.

10. Where Data Is Processed

Our servers and backups are in Europe. Some of our service providers, including Anthropic, OpenAI, Together AI, Google (app notifications) and Stripe, process data in the United States, and Cloudflare operates worldwide.

Customers in Japan, Switzerland, Singapore, India and South Africa. We use your information only as sections 3 and 4 say. It is stored on our servers in Europe (Germany) and handled by Bergen Ridge LLC in the United States, and the providers in section 5 process it in the United States; Stripe processes your payment under its own privacy policy. We do not sell your information or share it except with the providers in section 5. In Japan, we open your account only after you agree to this, because Japan's Act on the Protection of Personal Information asks it: the country it goes to is the United States, which has no single national law protecting personal information like Japan's — protection there comes from the Federal Trade Commission Act, laws for particular sectors, and state laws — and Germany, where our servers are, is a country Japan's Personal Information Protection Commission recognizes. In Switzerland, the Federal Council recognizes the United States as protecting personal information adequately only for companies certified under the Swiss-U.S. Data Privacy Framework; we disclose your information there because doing so is directly connected with performing our contract with you (Federal Act on Data Protection, Art. 17(1)(b)). You may also ask to receive your data in a common electronic format, and you may report a concern to the Federal Data Protection and Information Commissioner. In Singapore, your information is sent outside Singapore because it is needed to provide the service you signed up for, and it is protected there as this policy describes. You may withdraw your consent to our use of your information at any time by writing to us; we will then stop using it, and because the service cannot run without it, your account may have to be closed. You may also complain to Singapore's Personal Data Protection Commission. In South Africa, you may complain to the Information Regulator. You may ask to see, correct or delete your information at any time. Our privacy officer (in Singapore, our data protection officer) is Cengiz Sengul, Bergen Ridge LLC, [email protected]. If a breach of your data is likely to harm you, we tell you and the authority your law names: Japan's Personal Information Protection Commission, Switzerland's Federal Data Protection and Information Commissioner as soon as possible, and Singapore's Personal Data Protection Commission within 3 calendar days.

11. Children

PromptSwing is a service for businesses and is not directed at children. We do not knowingly collect personal information from children under 13.

12. Changes to This Policy

Updates will be posted at promptswing.com/privacy with a revised effective date.

13. Contact

[email protected]