Privacy notice

Who is responsible

dionics media UG (haftungsbeschränkt), Birkhuhnweg 8, 31303 Burgdorf, Germany, is the controller for the processing of visitors and developer accounts described here. Reach us at websites@dionics.ai or +49 175 9648764. We have not appointed a data protection officer, because the thresholds in section 38 of the Federal Data Protection Act do not apply to us.

For the end users that developers connect through the service (see "Accounts your users connect"), the developer is the controller and we process that data on the developer's behalf.

Visiting the site

Our host records each request in a server log: the requesting IP address, the time, the address requested, the referring page, the status code, the amount of data transferred, and the browser and operating system your browser reports. We need this to deliver the page and to find faults and abuse. The legal basis is Article 6(1)(f) GDPR. The logs are deleted after 30 days at the latest.

MCP addresses can carry a user id and, for clients that cannot send headers, an access key in the query string. Those values therefore appear in the same logs and are deleted with them.

Hosting is provided by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA, as a processor under a data processing agreement. Processing can take place in the USA. Vercel Inc. is certified under the EU-US Data Privacy Framework, with the EU Commission's standard contractual clauses as a fallback.

The fonts are served from our own server. No analytics, advertising or tracking script runs on this site.

Your developer account

To use the dashboard and the API you need an account. We store your name, your email address, whether you have confirmed it, and a salted hash of your password (never the password itself). Each sign-in creates a session record with a random token, its expiry, the IP address and the user agent. Sessions run for 30 days and are extended while you use them.

In your projects we store their names, members and roles, the hash and first characters of each API key (never the key itself), auth configs, MCP server settings, trigger settings and your webhook address.

The legal basis is Article 6(1)(b) GDPR, because we need this data to provide the account. For the IP address and user agent in session records it is Article 6(1)(f) GDPR, our interest in spotting sessions that were taken over. We keep account data while the account exists.

Emails we send you

We send an email to confirm your address after sign-up and, if you ask, a password reset link. Both links expire after one hour. We send no newsletters.

These emails go out through Zoho Corporation, USA, as a processor under a data processing agreement. Our Zoho account is hosted in the USA; the transfer takes place under the EU Commission's standard contractual clauses. The legal basis is Article 6(1)(b) GDPR.

Accounts your users connect

Developers connect accounts of their own users to apps such as GitHub or Slack. For each connection we store the user id the developer chose, the app, the status, an optional alias, facts the app returns about the account (such as the login name), and the credentials: OAuth access and refresh tokens, API keys or passwords. Credentials are encrypted with AES-256-GCM before they are stored and are decrypted only on our server, for the request that needs them.

When the developer's agent runs a tool, we send the request to that app with the stored credentials and pass the answer back. We store a log of each call with the tool, user id, duration, outcome and a shortened copy of the arguments and the answer, with fields that look like secrets masked. Logs are kept for 30 days. Trigger events that apps send us are stored for 30 days and forwarded to the developer's webhook; the delivery records are kept as long. Unfinished connect links and connections are deleted after a day.

We do this on the instructions of the developer, who is responsible for having a legal basis towards their users. We use this data for nothing else.

The connect page

If a developer sends you a link to connect an app, the page on prompt-tm.com shows the developer's project name and the app. If you sign in to the app there, the app sends us a code that we exchange for a token. If you type a key, we check it with the app once and store it encrypted. The developer can then let their agent act in that app as you, within the permissions you granted. You can remove the access in the app's own settings at any time, or ask the developer to delete the connection.

Where this data is stored

All of the above is stored in a Postgres database operated for us by Neon, Inc., as a processor under a data processing agreement, in the Amazon Web Services region eu-central-1 in Frankfurt, Germany. Neon keeps restore history for up to 30 days.

The contact form

When you send the contact form we process the name, email address, topic and message you enter, so we can answer you. The legal basis is Article 6(1)(b) GDPR where your message concerns your account or a contract, and otherwise Article 6(1)(f) GDPR. The message is delivered by email through Zoho as described above. We delete enquiries no later than twelve months after the last message.

What is stored on your device

When you sign in, BetterAuth sets cookies that keep you signed in: better-auth.session_token (30 days, renewed while you use the service), better-auth.session_data (a signed copy of your session for five minutes) and, if you sign in without staying signed in, better-auth.dont_remember (until you close the browser). On the live site they carry the __Secure- prefix and page scripts cannot read them. The dashboard also sets ptm_project to remember which project you last opened.

Local storage records the light or dark design, if you picked one. This entry and the cookies above are strictly necessary for what you asked for, so they need no consent under section 25(2) no. 2 TDDDG. There is no cookie banner because nothing else is stored, and nothing is sent to a third party.

Deleting your account

You can delete your account with "Delete my account" under Settings in the dashboard, or by writing to websites@dionics.ai. Deletion removes your profile, sessions and the projects you own, with their keys, auth configs, connected accounts and stored credentials, MCP servers, triggers, events and logs. Server logs are deleted after 30 days at the latest, and backups follow the restore window above.

Your right to object under Article 21 GDPR

Where we process your data on the basis of Article 6(1)(f) GDPR, you have the right to object at any time on grounds relating to your particular situation. We will then stop unless we can show compelling legitimate grounds, or the processing serves legal claims. We do not do direct marketing. Send an objection to websites@dionics.ai.

Your other rights

Write to websites@dionics.ai to use any of these. If a developer connected your account, you can also ask them directly. You can complain to a supervisory authority, either the one responsible for us, Die Landesbeauftragte für den Datenschutz Niedersachsen, Prinzenstraße 5, 30159 Hannover, or the one where you live or work.

• Access to the data we hold about you, under Article 15 GDPR
• Correction of data that is wrong, under Article 16
• Deletion, under Article 17
• Restriction of processing, under Article 18
• A copy in a portable format, under Article 20
• Withdrawal of any consent you have given, at any time, under Article 7(3)

No automated decisions

We do not profile you, and no decision with legal or similarly significant effect on you is made automatically in the sense of Article 22 GDPR.

Changes

When what the service does with data changes, this notice changes with it, and the date at the top moves.