Privacy policy

Last updated: 27 September 2026

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

giant Computer Systems, owner Marc Breuer
Am Altengraben 23
90768 Fürth
Germany
Phone: +49 (0) 911 976912-0
E-mail: [email protected]

2. General

We process personal data only on the basis of the statutory provisions (GDPR, BDSG, TDDDG) and only as much as PrompterPal needs in order to work. This page sets out what we process, for what purpose, on what legal basis and for how long.

3. Your rights

You have the following rights:

• Access (Art. 15 GDPR)
• Rectification (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing (Art. 21 GDPR)
• Withdrawal of consent given (Art. 7(3) GDPR)

To exercise them, write to us at [email protected]. You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). The authority responsible for us is the Bayerisches Landesamt für Datenschutzaufsicht, Promenade 18, 91522 Ansbach.

4. Hosting and delivery

Servers. PrompterPal runs on servers of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, in a data centre in Germany. The database, your texts and all other data mentioned here are stored there. We have a data processing agreement with Hetzner pursuant to Art. 28 GDPR. The legal basis is our legitimate interest in secure and efficient operation (Art. 6(1)(f) GDPR).

Cloudflare. All pages of PrompterPal are delivered via the content delivery network and the security services of Cloudflare Germany GmbH, Rosental 7, 80331 München. Every request therefore first passes through a Cloudflare server. In doing so, Cloudflare processes your IP address, technical details about your browser and device, and the address requested, in order to establish the connection, fend off attacks and deliver content faster. We have a data processing agreement with Cloudflare pursuant to Art. 28 GDPR, including the EU standard contractual clauses, because processing by Cloudflare, Inc. in the USA cannot be ruled out. The legal basis is our legitimate interest in secure and fast operation (Art. 6(1)(f) GDPR).

Encryption. Every connection to PrompterPal is encrypted with TLS, including the one between Cloudflare and our server.

5. Server logs

Our web server records every request in a log: time, IP address, address requested, browser and status code. This serves secure operation and the defence against attacks (Art. 6(1)(f) GDPR). This data is not combined with other data.

The logs are deleted automatically once they are older than 90 days. Only entries needed to investigate a specific security incident are kept longer, and only until that investigation is closed.

6. Cookies and browser storage

We use only technically necessary cookies and no advertising or tracking cookies. That is why there is no cookie banner. The legal basis is § 25(2) TDDDG and, for the subsequent processing, Art. 6(1)(b) and (f) GDPR.

• Session and protection against forged requests (session cookie, XSRF-TOKEN): keep you logged in and protect forms. They end with the session.
• Stay logged in: only if you tick the box when logging in.
• Language (locale): remembers the language you have chosen.
• Review (pp_reviewer, pp_reviewer_name): only if you write a comment via a share link. For 90 days they remember a random identifier and the name you entered, so that you can still take back your own comment shortly afterwards and do not have to type your name in again every time.

PrompterPal also stores settings in your browser's storage (localStorage), such as font size, colour scheme, key bindings, the selected speaker and location, and whether you have already allowed the microphone. So that the prompter can start without a network connection, the browser also keeps the program files and the most recently loaded texts in a cache (service worker). This data does not leave your device. You can delete it at any time in your browser settings.

7. Statistics

Cloudflare Web Analytics runs on the public website (www.prompterpal.de). It works without cookies, stores nothing on your device and does not collect any data that could be used to recognise a person; it counts page views, referring pages, country and loading times. The provider is Cloudflare (clause 4). The legal basis is our legitimate interest in understanding which pages are read (Art. 6(1)(f) GDPR). There are no statistics in the application itself.

8. Registration and account

Account. When you register, we process your name, e-mail address and password (only as a hash, never in plain text), as well as language and time zone. Your account also holds the account name, billing address and, if applicable, the VAT identification number. The legal basis is the performance of the contract (Art. 6(1)(b) GDPR).

Origin of the registration. If you come to us via a tagged link (for example from a social media post, recognisable by details such as utm_source in the address), we remember this tag for the duration of your visit and store it with your user account when you register. It is only evaluated in aggregate: how many registrations came in on a given day via which link. The legal basis is our legitimate interest in knowing which advertising works (Art. 6(1)(f) GDPR). We do not set an additional cookie for this.

Members. If you invite someone to your account, we process their e-mail address in order to send the invitation. An invitation expires after seven days. Anyone who administers an account can see the names and e-mail addresses of its members.

Unconfirmed accounts. We automatically delete an account whose e-mail address was never confirmed after seven days.

9. Your texts

Texts and versions. Projects, scripts and their versions are stored in our database. Every save creates a version, so that you can get back what you had; how many versions per text are kept depends on the plan, and we clear out older ones overnight. The texts belong to you. We only look at them if you ask us to because of a problem; every such look is logged. The legal basis is Art. 6(1)(b) GDPR.

Import. If you upload a file (Word, LibreOffice, PDF, plain text), it stays on our server only until its text has been extracted and is then deleted immediately. The extracted text waits for you to accept it and is deleted after two days at the latest if you do not accept it.

Other people's texts. If your texts contain personal data of third parties, such as the names of speakers, you are responsible for ensuring that you are allowed to process it.

10. Share links, remote control and review

Share links. Via a share link, people without their own account access a project. We do not collect any login data from them in the process.

Remote control and second prompter. So that prompter and remote control can find each other, the devices involved continuously report their status to our server: which text is running, at which position, at what speed, and the speaker name selected on the device. This information is held only in the server's memory and expires after twelve hours at the latest. Anyone with a valid share link for the project can see it.

Comments during review. If a share link allows comments, we store for each comment the name you enter, the text of the comment, the passage it refers to, and the time. We do not store your IP address, only an irreversible check value derived from it, in order to detect abuse. The members of the account can see the comments and, if they wish, receive a summary e-mail. The comments remain until the account deletes them or is itself deleted. The legal basis is the account's legitimate interest in having its texts reviewed (Art. 6(1)(f) GDPR).

11. Voice follow (speech recognition)

With voice follow, the prompter follows your voice. For this it uses the speech recognition built into your browser and first asks for your permission to use the microphone. We receive neither audio nor recognised text; matching against your script takes place entirely on your device.

Depending on the browser, however, the audio may be processed by the browser's manufacturer for recognition: Google Chrome sends it to Google's servers, Safari, depending on the device, sends it to Apple or recognises it directly on the device. This is outside our control; the privacy policy of the respective manufacturer applies. If you do not want this, leave voice follow switched off; all other functions of the prompter work without a microphone.

12. Login, devices and security

For every login we record the time, IP address and a rough indication of browser and operating system. From this we build the list of devices on which you are logged in, and we use it to detect a login from an unknown device, about which we inform you by e-mail. We remove an entry when you log out the device. For two-factor authentication and passkeys we store only the keys required for them, never your biometric data; that stays on your device. The legal basis is our legitimate interest in the security of accounts (Art. 6(1)(f) GDPR).

13. Payments

Order. When you order the paid plan, we store with your account whether you are ordering as a consumer or as a business, when you accepted the terms and conditions and, as a consumer, when you requested that we start before the withdrawal period ends. We need this as evidence of the contract and for any withdrawal. The legal basis is Art. 6(1)(b) and (c) GDPR.

Stripe. For card payments and SEPA direct debit, we redirect you to Stripe's payment page (checkout.stripe.com). Stripe collects your payment data directly there; we ourselves do not process or store complete card or bank account details, only what was last used to pay (type and last four digits), your customer identifier at Stripe and the invoices. We transmit to Stripe the amount, the plan, your account identifier and your e-mail address; you enter the billing address at Stripe yourself. In addition, Stripe processes technical data such as IP address and device information to prevent fraud. The provider is Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland; any transfer to Stripe, Inc. in the USA takes place on the basis of the EU standard contractual clauses. Stripe's privacy policy (stripe.com/privacy) applies in addition. The legal basis is Art. 6(1)(b) GDPR and our legitimate interest in preventing payment defaults and abuse (Art. 6(1)(f) GDPR).

Bank transfer. If you pay by bank transfer, we process the details needed to match the payment. The legal basis is Art. 6(1)(b) GDPR.

Invoices and accounting. We pass invoices and the associated customer data (account name, billing address, e-mail address, VAT identification number, amounts) to our accounting, which is kept in Microsoft Dynamics 365 Business Central, and retain them for as long as commercial and tax law requires (currently up to ten years). The legal basis is Art. 6(1)(c) GDPR in conjunction with § 147 AO and § 257 HGB.

14. E-mails

We send you e-mails that are part of the service: confirmation of your address, invitations, notices about the security of your account, invoices, payment reminders and the confirmation of a termination. You can switch off the summary e-mail about new comments in your profile. We do not send advertising by e-mail. The e-mails leave our server via our own mail server. The legal basis is Art. 6(1)(b) and (f) GDPR.

15. Third-party AI

PrompterPal does not provide any AI itself. If you store your own key, the texts you have it revise, together with your instruction, are sent to the provider you have chosen. That provider's terms apply. We merely pass the requests through and store nothing of these requests and responses: no request, no response, no log. The only thing that may remain is what you explicitly accept into your text; that is then stored with us as a version of your text, together with the instruction you gave.

Your key. It is stored with us in encrypted form and belongs to you personally, not to your account: other members of your account cannot see it, not even the owner. We never display it again after it has been saved, and you can delete it at any time. Once deleted, it is gone.

The route of the request. It runs via our server and not out of your browser. Your provider therefore sees our server's address and not yours. In doing so, we act merely as a conduit and do not process the content on our own behalf. The legal basis is Art. 6(1)(b) GDPR. If your provider is located outside the European Union, the data goes there because you chose it that way.

16. Fonts and external sources

We deliver all fonts from our own server; no font service such as Google Fonts is called. Apart from Cloudflare's statistics script (clause 7), PrompterPal loads nothing from external servers. The only exception is the technical description of our interface for accounting systems at app.prompterpal.de/api-docs, which loads its display from cdn.redocly.com; in the process, the provider Redocly learns your IP address.

17. Storage period and deletion

We store personal data only for as long as is necessary for the respective purpose and delete it afterwards, unless a statutory retention obligation prevents this.

You can delete your account yourself. We note the request and carry it out after fourteen days; until then you can take it back. After that, account, projects, texts, versions, share links and comments are deleted. We continue to retain invoices in accordance with clause 13.

18. Changes

We adapt this privacy policy when PrompterPal or the legal situation changes. The version published here at the time applies.