Privacy policy

Last updated: 8 May 2026

This policy explains how Prompt Away ("we", "us") collects, uses, and protects your personal data when you visit promptaway.net or sign up for our waitlist or workshops. We comply with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the EU General Data Protection Regulation (GDPR), the Spanish Organic Law 3/2018 on Data Protection (LOPDGDD), and the Spanish Information Society Services Act (LSSI-CE).

Plain-language summary: we collect your name, email, and basic technical info when you sign up. We use it to email you about our workshops. We don't sell or share it for advertising. You can ask us to delete it any time at hello@promptaway.net.

1. Who we are

The data controller is Prompt Away. You can reach the data controller at hello@promptaway.net.

2. What we collect

We only collect what's necessary to run the waitlist and the workshops:

Information you give us: your name, email address, the workshop format you're interested in, whether you've consented to receive marketing emails, and any messages you send us.
Information collected automatically when you submit the form: your IP address, the page you submitted from (referer), your browser's user-agent string, and the date and time of submission. We collect this for security and abuse prevention.
Local storage in your browser: we store your language preference (EN/ES) so the site remembers it on your next visit. This is not a cookie, sits only in your browser, and never reaches our servers.

We do not collect special category data (e.g. health, religion, political views), and we do not knowingly collect data from anyone under 16.

3. Why we use it (and our legal basis)

To manage the waitlist and inform you about cohort dates — legal basis: your consent (the checkboxes you tick on the form). You can withdraw consent at any time.
To deliver workshops you have booked, take payment, and provide support — legal basis: performance of a contract with you.
To prevent abuse, debug technical problems, and protect the site — legal basis: our legitimate interest in keeping the service running.
To comply with legal and accounting obligations — legal basis: legal obligation.

4. Who we share data with

We use a small number of trusted processors to run the site. They process data only on our instructions:

Vercel Inc. — hosting and serverless functions.
Supabase Inc. — database where we store waitlist signups.
Resend (Resend Inc.) — transactional email delivery, when used.

We don't sell your data, and we don't share it with advertisers.

5. International transfers

Some of the providers above are based in the United States or operate globally, which can mean your data is transferred outside the UK and the European Economic Area (EEA). Where this happens, transfers are protected by Standard Contractual Clauses (SCCs) approved by the European Commission and the UK Information Commissioner's Office, or other appropriate safeguards.

6. How long we keep it

Waitlist data: until you ask us to delete it, or for up to 24 months after your last interaction with us, whichever comes first.
Marketing consent records: for as long as you remain subscribed, plus 3 years for evidentiary purposes (in case of complaints).
Workshop bookings and accounting records: 6 years (UK) / 6 years (Spain), as required by tax and commercial law.
Server logs (IP, user-agent): up to 12 months.

7. Your rights

Under UK and EU data protection law you have the right to:

Access the data we hold about you.
Rectify inaccurate or incomplete data.
Erasure ("right to be forgotten") of your data.
Restrict our processing of your data.
Object to processing based on legitimate interest.
Portability — receive your data in a machine-readable format.
Withdraw consent at any time, without affecting prior lawful processing.
Not be subject to automated decision-making (we don't do any).

To exercise any of these, email hello@promptaway.net. We respond within 30 days.

8. Marketing emails

We only send marketing emails to people who have explicitly opted in (the marketing checkbox in our waitlist form is unchecked by default). You can unsubscribe at any time using the link in any email we send, or by emailing hello@promptaway.net.

9. Cookies and similar technologies

We do not use tracking cookies. The only client-side storage we use is the browser's localStorage, which we use solely to remember your chosen language. This data never leaves your browser.

If we add analytics in future, we'll update this policy and ask for your consent before any non-essential trackers are loaded.

10. Security

The waitlist database is access-controlled and restricted to our backend service. Communication between your browser and our servers uses TLS (HTTPS). No system is perfectly secure; if you spot a vulnerability, please email hello@promptaway.net.

11. Complaints

If you believe we've mishandled your data, please first email us at hello@promptaway.net. You also have the right to lodge a complaint directly with a supervisory authority:

UK: Information Commissioner's Office — ico.org.uk.
Spain: Agencia Española de Protección de Datos (AEPD) — aepd.es.

12. Changes to this policy

We may update this policy from time to time. We'll always show the "Last updated" date at the top. For material changes, we'll notify you by email if you've signed up to the waitlist.