Privacy policy

Effective: 2026-08-19

BestPrompter is the service name used by the operator of the prompt-optimization service at bestprompter.com (“BestPrompter”, “we”, “us”). This policy explains what information we process, why we process it, who receives it, how long we keep it, and the choices available to you.

Summary

• Your prompts and results are private unless you deliberately create a public link or publish a result to Explore.
• We do not sell personal information, use it for third-party advertising, or train BestPrompter models on your content.
• Providing the service requires sending prompt content to the model routing and model providers described below.
• Waffo Pancake is the Merchant of Record for paid subscriptions. BestPrompter does not receive or store your full payment-card number.
• You can revoke public pages, delete eligible sessions, or delete your account from the product. Revoked public URLs return 410 Gone.

Information we process

Account information. Email address, password hash when you use password authentication, display name, avatar, account tier, verification state, and session records. If you use Google or GitHub sign-in, we receive the basic account information those services release to us.

Content. Prompts, task descriptions, target-model choices, optimized results, evaluation evidence, reviews, corrections, bookmarks, and public-page content you choose to publish. Private in-flight Agent checkpoints also retain model-generated reasoning summaries and the signed or encrypted continuity blocks needed to resume a model/tool conversation correctly; these blocks are not shown as product results. Do not submit confidential or personal information that you are not authorized to disclose to BestPrompter and its processors.

Usage and reliability information. Run state, model and Provider identifiers, token counts, internal reference-price estimates, plan-unit usage, timing, error classes, security events, IP address, user agent, and request timestamps. Reference token prices support internal operational analysis; they are not charges passed to ordinary users.

Billing information. We send Waffo Pancake a stable BestPrompter user identifier, email address, selected plan, and merchant order identifier. We retain Waffo order and subscription identifiers, plan and subscription state, billing period, environment, and minimal delivery and retry metadata. Payment-card details, billing addresses, hosted checkout tokens, raw webhook payloads, and webhook signatures are not stored in BestPrompter product tables.

Replay records. For authenticated canonical mutations carrying an Idempotency-Key, we retain a bounded safe response envelope so an equal retry receives the same outcome. The default completed-record retention is 168 hours. We do not retain raw request bodies, Provider payloads, or secrets in these replay records.

Cookies. We use a first-party secure, HttpOnly session cookie for authentication. OAuth providers may set their own cookies while handling sign-in. We do not use advertising cookies.

Why we process information

We process information to:

• provide optimization, evaluation, history, bookmarks, reviews, sharing, email, and subscription access;
• enforce plan limits, prevent duplicate charges or work, reconcile Provider usage, and operate billing;
• secure the service, investigate abuse, apply rate and spend controls, and respond to takedowns;
• diagnose failures, measure reliability, plan capacity, and improve methods using aggregate operational signals; and
• comply with tax, accounting, legal, fraud-prevention, and dispute obligations.

Where applicable law requires a legal basis, we rely on performance of our contract to provide the service, legitimate interests in operating and securing it, compliance with legal obligations, and consent where we specifically ask for it. You may withdraw consent for future processing at any time, but withdrawal does not make earlier lawful processing unlawful.

BestPrompter does not use your raw prompts, outputs, or results to train or fine-tune BestPrompter models. The current product has no content-training opt-in. Aggregate service metrics and methodology outcomes may be used without reusing raw content. We do not sell personal information or share it for cross-context behavioral advertising.

Service providers and disclosures

We disclose only the information reasonably needed for these services:

• Model processing: Orbit, a third-party model API aggregation platform, and the upstream model providers selected through it process prompt context and return model output. Provider routing can change as operators update an active policy. We do not promise zero retention, no training, or a particular processing region on behalf of Orbit or an upstream Provider unless that promise is shown for the selected route in the product. Their processing is governed by their applicable terms and privacy practices.
• Payments: Waffo Pancake hosts checkout and acts as Merchant of Record. Waffo handles payment details, taxes, refunds, and charge processing under the terms displayed at checkout.
• Infrastructure and delivery: Cloudflare provides DNS, edge security, caching, and Pages hosting. Resend delivers transactional email. Our PostgreSQL database, API, worker, telemetry, and job infrastructure are self-hosted.
• Authentication: Google and GitHub process OAuth sign-in when you choose those methods.
• Legal and safety: We may disclose information when reasonably necessary to comply with law, protect users or the service, investigate fraud or abuse, or establish and defend legal claims.

We do not currently embed third-party advertising pixels or a separate product-analytics SDK. Cloudflare still processes ordinary edge and security telemetry needed to deliver and protect requests.

Public pages and Explore

Every result starts private, regardless of plan. Public disclosure requires an explicit action in the Share dialog:

• Unlisted public link: anyone with the link can view, copy, and fork the published prompt, but it is not listed in Explore.
• Explore publication: the same public content is also searchable in the public Explore gallery.

The Share dialog identifies what will be public before publication. Public pages contain the optimized prompt, public summary, scenario, tags, and displayed evaluation information. They do not contain account identity, private history, reviews, internal reasoning or continuity blocks, raw traces, raw Provider payloads, or internal provenance-console data.

You can revoke either kind of page at any time. Revocation immediately makes the BestPrompter URL return 410 Gone and removes it from Explore. Copies already made by another person, search-engine caches, and third-party archives are outside our direct control and may take additional time to disappear.

Retention and deletion

• Account content is kept while your account is active so product features continue to work.
• Eligible deleted sessions and account content are soft-deleted for up to 30 days. A daily bounded job then physically removes prompts, Runs, Results, Agent checkpoints (including reasoning continuity blocks), Bookmarks, prompt versions, Reviews, and their product events after the recovery window. Rows with active or unresolved work wait for a later successful cycle rather than being deleted unsafely.
• Public pages are revoked immediately when you revoke them, delete their eligible Session, delete your account, or when an operator completes a takedown.
• After the same 30-day window, revoked public-page content and private Result lineage are cleared. The slug and minimal status fields remain as a content-free tombstone so the old URL continues to return 410 Gone rather than being reassigned.
• Completed idempotency replay records are retained for 168 hours by default and then removed by the replay-retention job.
• Operational metrics are retained for up to 15 days and alert state for up to 5 days. Request and service logs are minimized and rotated under the deployment’s operations policy; they are not used as a substitute store for prompts or model output. A restricted security or legal hold may preserve the specific records needed for an incident or claim.
• Database copies created for deployment or disaster recovery may retain information after it is removed from active product tables. They are access-restricted, are not used to restore an individual deleted account, and are removed when the applicable bounded recovery rotation or deployment-safety need ends.
• Billing reconciliation, fraud-prevention, tax, accounting, and legal records may be retained for up to seven years where reasonably necessary or legally required.
• On account deletion, active public pages are revoked and product content enters the deletion schedule. After eligible Sessions are purged, profile and authentication data is de-identified; aggregate usage is de-linked from both the account and Run. A pseudonymous subject can remain on Waffo subscription/order projections and protected operational records during an applicable billing, fraud, dispute, security, or legal period.

We may preserve a narrowly scoped record beyond these periods when required by law, needed to resolve a dispute or security incident, or necessary to prevent a deleted user from evading an active abuse restriction.

International processing

BestPrompter does not currently offer region selection or a data-residency commitment. Our self-hosted systems, Cloudflare, Waffo, Resend, Orbit, upstream model providers, and OAuth providers may process information in different countries. Where required, transfers are made under the service provider’s applicable transfer mechanism or another legally recognized basis.

Your choices and rights

Product controls let you view history, edit profile information, revoke public pages, delete eligible sessions, and delete your account. You may also request access, correction, export, deletion, restriction, or objection where applicable law grants that right. You may lodge a complaint with your local data-protection authority.

Send privacy requests to [email protected]. We may need to verify that the requester controls the relevant account. We do not discriminate against users for exercising applicable privacy rights. BestPrompter has not appointed a data protection officer; the privacy contact below handles these requests.

Children

BestPrompter is not directed to children under 16, and we do not knowingly collect their personal information. Contact us if you believe a child under 16 has created an account.

Security

We use access controls, encryption in transit, encrypted Provider credentials, bounded telemetry, and operational safeguards designed to protect information. No Internet service is perfectly secure. Notify [email protected] if you believe your account or BestPrompter data has been compromised.

Changes

We may update this policy as the service changes. Material changes will be announced in the product or by email before they take effect when required. The effective date identifies the current version.

Contact

• Privacy: [email protected]
• Security: [email protected]
• Legal notices: [email protected]