Privacy notice

Who is responsible

dionics media UG (haftungsbeschränkt), Birkhuhnweg 8, 31303 Burgdorf, Germany, is the controller for the processing described here. Reach us at websites@dionics.ai or +49 175 9648764. We have not appointed a data protection officer, because the thresholds in section 38 of the Federal Data Protection Act do not apply to us.

Visiting the site

Our host records each request in a server log. The log holds the requesting IP address, the time, the address requested, the referring page, the status code, the amount of data transferred, and the browser and operating system your browser reports. We need this to deliver the page and to find faults and abuse. The legal basis is Article 6(1)(f) GDPR, our legitimate interest in a service that works and is not being attacked. We do not combine the logs with other data and we do not use them to identify you. They are deleted after 30 days at the latest.

Two kinds of request carry more than a page name in their address. While a board is open, your browser asks for updates about once a second, and that address contains your cursor position, a random id for your browser window, your cursor colour and, if you came through a share link, the link's token. If you start a board from a prompt on our website, the prompt text is part of the address too. These details land in the same logs and are deleted with them.

Hosting is provided by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA, as a processor under a data processing agreement. Vercel also runs the server code that handles your account and your boards, so that data passes through Vercel's systems. Processing can take place in the USA. Vercel Inc. is certified under the EU-US Data Privacy Framework, with the EU Commission's standard contractual clauses as a fallback.

Fonts

The fonts are stored on our own server and loaded from there. Opening a page does not connect to Google Fonts or any other font provider.

Your account

To create boards, edit shared boards, comment or use the AI features you need an account. When you sign up we store your name, your email address, whether you have confirmed that address, and your password. We never store the password itself. Our sign-in software, BetterAuth, stores a salted hash of it, from which the password cannot be read back.

Each time you sign in we create a session record. It holds a random token, its expiry date, the IP address you signed in from and the user agent your browser sent. A session runs for 30 days and is extended while you keep using it. Signing out ends it. Expired sessions are no longer accepted.

Your name is shown to other people on boards you work on, next to your comments and your cursor. Your email address is not shown to them.

The legal basis is Article 6(1)(b) GDPR, because we need this data to provide the account you asked for. For the IP address and user agent in the session record it is Article 6(1)(f) GDPR, our interest in spotting sessions that were taken over. We keep your account data for as long as the account exists.

Emails we send you

After sign-up we send one email with a link to confirm your address. If you ask to reset your password, we send a link for that. Both links expire after one hour. We send no newsletters and no marketing email.

These emails go out over an authenticated, TLS-encrypted SMTP connection through Zoho, which acts for us as a processor under a data processing agreement. Processing takes place outside the EU under the EU Commission's standard contractual clauses. The legal basis is Article 6(1)(b) GDPR.

Your boards and what you put on them

We store what you create so the board is there when you come back and so others on the board can see it. That covers:

• Boards, with title, owner, the template a board started from, and dates
• Elements on a board, meaning sticky notes, shapes, text, connectors, pen drawings and frames, with their content, position, size and colour
• Comments, with the text, the place on the board, whether the thread is resolved, the time, and who wrote it
• Stars you set on boards
• Board memberships, meaning which boards you joined and whether you can view or edit

Board data, continued

When you delete an element, the board keeps a marker for it so that other open windows learn about the deletion. That marker still holds the element's last content. It is removed when the board is deleted.

When the owner deletes a board, everything on it is deleted with it, including content and comments other people added.

The legal basis is Article 6(1)(b) GDPR. Storing and showing your boards is the service you signed up for. We keep board data until the board or your account is deleted.

Anything you write on a board is your choice. If you put personal data about other people on a board, you are responsible for being allowed to do so.

Sharing a board

Every board has a share link, and it is off until the owner turns it on. The owner chooses whether the link lets people view or edit.

Anyone who has a view link can open the board and read everything on it, including comments and the names of their authors. They need no account, and we do not know who they are beyond what the server log records. With an edit link, signed-in users can also change the board. A visitor on an edit link who is not signed in can only view.

The owner can turn the link off or replace it with a new one. The old link then stops working at once. Who you send a link to is your decision, and we cannot pull back a copy someone already made.

Seeing who else is on a board

While a board is open, your browser sends an update to our server about once a second. It contains your cursor position on the board, a random id for that browser window, and the colour of your cursor. The server adds the name on your account, or "Guest" if you are not signed in. Everyone else who has the board open sees your cursor and name, so they know who is working where.

Other people stop seeing you about 20 seconds after your last update. The database keeps the latest entry for each browser window, overwritten with every update, until the board is deleted. We do not keep a history of cursor movements.

The legal basis is Article 6(1)(b) GDPR. Live cursors are part of the collaborative board you chose to open.

Where this data is stored

Accounts, sessions, boards, comments and the AI counter are stored in a Postgres database operated for us by Neon, Inc., USA, as a processor under a data processing agreement. The database runs in the Amazon Web Services region us-east-1 in the USA. The transfer to the USA takes place under the EU Commission's standard contractual clauses.

Data you or we delete can remain in Neon's restore history for a limited period, at most 30 days, after which it is gone from there too.

Images you add to a board are stored with Vercel Blob, a storage service of Vercel Inc., the same processor that hosts this site, under the same agreement and transfer safeguards described above. Each image gets a long, random public address. Anyone who has that address can open the image, without an account and without access to the board, so do not upload images you would not share that way. We delete a board's images when the board or your account is deleted. An image you remove from a board stays stored while the board exists, so that undo can bring it back. To enforce a limit of 200 uploads per day we keep one counter per account and day, holding your account id, the date and the number of uploads, on the basis of Article 6(1)(f) GDPR. It is deleted with your account.

AI features

The AI features run only when you press an AI button. Nothing on your board is sent to an AI provider at any other time. Only signed-in users who can edit a board can use them.

When you press one, our server sends a request to Anthropic. What it contains depends on the button:

• Drafting a board, a diagram or a mind map sends the prompt you typed, up to 2,000 characters
• Grouping sticky notes sends the text of the notes you selected, up to 80 notes and 200 characters each, with each note's random internal id
• Summarising sends the text of the items you selected, up to 80 items and 300 characters each

AI features, continued

Each request also contains our own fixed instructions to the model. It does not contain your name, your email address, your account id, comments, or any other content of the board. The request comes from our server, so Anthropic does not see your IP address.

Anthropic sends back a draft, which the app places on your board as ordinary content that you can edit or undo. If you started from a prompt on our website, the first 60 characters of the prompt also become the board's title.

The provider is Anthropic PBC, 548 Market St, PMB 90375, San Francisco, CA 94104, USA, through the Claude API. Anthropic acts for us as a processor under its commercial terms and data processing addendum. We have not agreed to any use of this data for training AI models. Under those terms Anthropic may keep inputs and outputs for a limited period, for example to detect misuse. The transfer to the USA takes place under the EU Commission's standard contractual clauses.

The legal basis is Article 6(1)(b) GDPR. You asked for the result by pressing the button.

Please do not put personal data, about you or anyone else, into prompts or into notes you send to the AI. A board plan rarely needs it.

The daily AI limit

Each account can make 20 AI requests per day. The day runs on UTC and the counter resets at midnight UTC. To enforce this we store one counter per account and day, holding only your account id, the date and the number of requests. All accounts on one network also share a limit of 60 requests per day. For that we store one counter per network and day, keyed by a hash of your IP address and the date made with a secret key. It does not hold the address itself and cannot be linked across days. The legal basis is Article 6(1)(f) GDPR, our interest in keeping a free service affordable and fair. Account counters are deleted with your account. Network counters are deleted after about a week.

The contact form

When you send the contact form we process the name, email address, topic and message you enter, so we can answer you. All four fields are required, and without them we cannot reply. There is no statutory or contractual obligation to provide them. The legal basis is Article 6(1)(b) GDPR where your message concerns your account or a contract, and otherwise Article 6(1)(f) GDPR, our interest in answering messages sent to us.

The message is delivered as email through Zoho and stored in our mailbox, which Zoho also operates for us, on the terms described under "Emails we send you".

We delete enquiries no later than twelve months after the last message. Correspondence we must keep under section 257 of the Commercial Code or section 147 of the Fiscal Code is kept for the period those provisions set.

The same applies if you write to websites@dionics.ai or call the number in the imprint.

Spam protection on the form

The contact form uses Google reCAPTCHA version 3 to tell real enquiries from automated spam. Your browser fetches the script from www.google.com when the contact page opens. No other page on this site loads it, and the app does not use it.

While the contact page is open, Google receives your IP address, details about your browser and device, and how you interact with the page, such as mouse movement and time spent. Google also sets cookies for this, such as _GRECAPTCHA. When you send the form, reCAPTCHA gives us a score for how likely it is that a script sent it. We reject messages with a low score.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is keeping automated spam out of the form and our inbox.

The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Data may also be transferred to Google LLC in the USA, which is certified under the EU-US Data Privacy Framework. Google's privacy policy is at https://policies.google.com/privacy and its terms of service are at https://policies.google.com/terms.

If you would rather not have reCAPTCHA run, write to websites@dionics.ai instead.

Analytics, only if you agree

The site uses Google Analytics 4 to count visits and see which pages get read. It loads only after you press "Accept" on the banner, and nothing is stored on your device for it before that. The legal basis is your consent under Article 6(1)(a) GDPR together with section 25(1) of the Telecommunications Digital Services Data Protection Act, TDDDG.

Once you have accepted, Google Analytics sets the cookies _ga and _ga_[measurement id] with a lifetime of two years and sends page views, approximate region, and browser and device details to Google. Google Analytics 4 does not store IP addresses. It uses the address to work out the region and then discards it. Google deletes user and event data after 14 months at the latest. Advertising features and Google Signals stay off. Analytics does not load on the dashboard, on boards, on shared boards or on the page that starts a new board, so it never receives the content of your boards.

The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, as a processor under Google's data processing terms. Data is also processed on Google LLC servers in the USA. Google LLC is certified under the EU-US Data Privacy Framework, with the standard contractual clauses as a fallback.

You can withdraw your consent at any time, with effect for the future. Clear this site's data in your browser and choose "Only necessary" when the banner returns. Analytics stops loading at once. Cookies Google has already set are removed when you clear the site data.

What is stored on your device

When you sign in, BetterAuth sets cookies that keep you signed in. On our live site their names carry the prefix __Secure-, which tells the browser to send them over encrypted connections only. Your browser does not let page scripts read them.

• better-auth.session_token holds your session token. It lasts 30 days and is renewed while you use the service.
• better-auth.session_data holds a signed copy of your session details for five minutes, so we do not have to look them up on every request.
• better-auth.dont_remember is set only if you sign in without staying signed in. It ends when you close the browser.

Storage on your device, continued

These cookies are strictly necessary to provide the account you asked for, so they need no consent under section 25(2) no. 2 TDDDG. Signing out deletes them.

Two entries in your browser's local storage record choices you made, and section 25(2) no. 2 TDDDG covers them too. cookie-consent records your answer to the banner, accepted or rejected, so the question does not come back on every page. theme records whether you picked the light or dark design, and is written only when you pick one. Neither is sent to our server. Both stay until you clear this site's data in your browser.

On the contact page, Google reCAPTCHA stores its own cookies and local storage entries in your browser to keep spam out of the form, as described under "Spam protection on the form".

Anything else appears only after you accept analytics, as described above.

Deleting your account

You can delete your account at any time in your account settings, or by writing to websites@dionics.ai. Deleting it removes your profile, password hash and sessions, the boards you own with everything on them, your comments on other people's boards, your stars, your board memberships and your AI counters. Cursor entries on other people's boards follow those boards, as described above. Backups follow the restore window described above.

Your right to object under Article 21 GDPR

Where we process your data on the basis of Article 6(1)(f) GDPR, you have the right to object at any time on grounds relating to your particular situation. Here that means the server logs, the IP address and user agent in session records, the AI counters, and enquiries that do not concern your account or a contract. We will then stop the processing unless we can show compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. We do not do direct marketing. Send an objection to websites@dionics.ai.

Your other rights

Write to websites@dionics.ai to use any of these. You can also complain to a supervisory authority, either the one responsible for us, Die Landesbeauftragte für den Datenschutz Niedersachsen, Prinzenstraße 5, 30159 Hannover, or the one where you live or work.

• Access to the data we hold about you, under Article 15 GDPR
• Correction of data that is wrong, under Article 16
• Deletion, under Article 17
• Restriction of processing, under Article 18
• A copy in a portable format, under Article 20
• Withdrawal of any consent you have given, at any time, under Article 7(3)

No automated decisions

We do not profile you, and no decision with legal or similarly significant effect on you is made automatically in the sense of Article 22 GDPR. The AI features draft content for your board when you ask. They decide nothing about you.

Changes

We update this notice when the service changes. The date at the top is the last change. The current version is always at https://www.prompt-board.com/privacy.