Privacy Policy

StickyPrompts is operated by LogiNet Enterprise Software Technologies Kft., a company registered in Hungary with its seat at 1118 Budapest, Budaörsi út 48-50. 1. em. 2. ajtó. We are a European company: the entity, the team and the default data path are all inside the European Union.

This policy explains what we do with personal data, whether you are a customer, a user inside a customer's workspace, a visitor to this website, or someone who wrote to us. It covers the service at stickyprompts.com and everything reachable from it.

For anything about this policy or about your data, write to privacy@stickyprompts.com. We answer.

The same product puts us in two different roles, and your rights work differently in each.

We are the processor for the content inside a workspace: prompts, chats, uploaded files, knowledge bases, transcripts, agent runs and everything a connector brings in. That content belongs to the organisation that owns the workspace. They decide what goes in, who may see it, how long it is kept, and which models and regions may be used. We act on their instructions, under our data processing agreement. If you are an employee using your company's workspace and you want your data corrected or deleted, ask them first; we will support them in doing it.

We are the controller for running the business around that: account and billing records, support conversations, security and audit logging, this website, and our own marketing. Those are our decisions, so they are our responsibility.

• Account data. Name, work email, the workspace you belong to, your role and permissions, and single sign-on identifiers where your company uses an identity provider.
• Workspace content. Whatever your team puts in or generates. We hold it to run the service, and we do not go looking through it. Access by our staff is restricted, logged, and happens only where support or a security investigation genuinely requires it.
• Usage and operational records. Which capability was used, when, by which account, which model was called and what it cost. This is what makes the audit log and your invoice possible.
• Technical data. IP address, device and browser information, and error logs, kept for security, abuse prevention and debugging.
• Billing data. Company details, billing address, tax identifiers and invoice history. Card details go to our payment provider and are never stored by us.
• Support and sales conversations. What you write to us, and what we wrote back.
• Website and download data. If you ask us for a playbook, a demo or another download, the details you type into that form. How you use this website is covered in The website itself.

We do not ask for special categories of personal data, and the service is not designed to have them typed into it. If your use case involves health, biometric or similar data, raise it with us before you start so the right agreement and controls are in place.

• To provide the service you asked for - accounts, workspaces, model calls, connectors, support. Legal basis: performance of a contract, or our legitimate interest in serving the organisation that holds the contract.
• To bill correctly - metering usage, issuing invoices, keeping accounting records. Legal basis: contract, and legal obligation under Hungarian accounting and tax law.
• To keep the service safe - authentication, abuse and fraud prevention, audit logging, incident investigation. Legal basis: legitimate interest in the security of the service, and legal obligation where one applies.
• To run and improve the platform - aggregated, de-identified figures on volume, errors, latency and feature use. That data contains no workspace content and cannot be traced back to a person. Legal basis: legitimate interest.
• To talk to you - service notices, security notices, and product email you can switch off. Legal basis: contract for the first two, consent or legitimate interest for the rest, and you can object at any time.

Where we rely on legitimate interest we have weighed it against your rights, and you can ask us for that reasoning.

We do not use your content to train, fine-tune or evaluate models, ours or anyone else's. Not the prompts, not the files, not the outputs, not in aggregate.

External model calls are routed to endpoints that do not retain the request, and providers that cannot offer that are excluded from the platform rather than used quietly. Your content is never pooled with another customer's.

If we ever wanted to change that, it would take an explicit, opt-in agreement with the customer who owns the content. It is not something a policy update can turn on.

Our default is the European Union. The company is Hungarian, the service is hosted in the EU, and a workspace can be pinned so that processing and storage stay inside the region.

Where a workspace is pinned to the EU, a model that cannot be served from inside the region is blocked rather than silently called somewhere else. Open-weight models can be run on EU endpoints, or inside the customer's own infrastructure so that prompts never leave their network at all.

Data leaves the EU only where a customer's own administrators enable something that requires it - a model, a connector or a support arrangement outside the region. When that happens it is on their instruction, it is visible to them in the product, and the transfer is covered by an adequacy decision or by standard contractual clauses with the supplementary measures those require. Administrators who never want that possibility can turn it off entirely.

Our own corporate functions - billing, support, security review - are staffed from the EU as well. There is no offshore tier you get handed to after signature.

We do not sell personal data, and we do not share it for anyone else's advertising.

We use a small number of sub-processors to run the service: cloud hosting, model providers, email delivery, payment processing, error monitoring and customer support tooling. Each is bound by a written contract with confidentiality and security obligations, and each is given the narrowest access that works. The current list is available on request, and workspace administrators are told before a new sub-processor starts handling customer data so they can object under the data processing agreement.

Beyond that, we disclose personal data only where the law requires it, where it is needed to establish or defend a legal claim, or as part of a merger or acquisition, in which case the buyer is bound by this policy until it is properly replaced. If a public authority demands access to customer data, we will tell the customer unless we are legally barred from doing so, and we will challenge requests that overreach.

Workspace content is kept for as long as the workspace keeps it. Administrators set retention per workspace, and can delete content on demand. When a subscription ends, administrators have 30 days to export, after which the content is deleted from production systems and ages out of backups on the normal backup cycle.

Account data is kept while the account exists, and removed with the workspace.

Billing and accounting records are kept for eight years, because Hungarian accounting law requires it.

Security and audit logs are kept for the period set for the workspace, and our own infrastructure logs for up to 12 months.

Marketing contact details are kept until you unsubscribe or ask us to delete them.

Encryption in transit and at rest, per-tenant isolation, access scoped by role and logged, credentials for connected systems held per workspace and revocable in one click, and an audit record across every capability. Our security page describes the controls in detail.

If a personal data breach affects your data, we will notify the supervisory authority within 72 hours where the law requires it, and tell affected workspace administrators without undue delay, with what we know, what we are doing, and what they need to do.

Found a vulnerability? Write to security@stickyprompts.com. We do not take legal action against good-faith research that respects customer data.

Under the GDPR you can ask us to:

• Tell you what personal data we hold about you, and give you a copy.
• Correct it if it is wrong, or complete it if it is partial.
• Delete it, where we have no overriding reason or legal duty to keep it.
• Restrict how we use it, or object to use we base on legitimate interest.
• Give it to you, or to someone else, in a portable format.
• Withdraw consent, where consent is what we relied on. That does not undo what was lawful before.

Write to privacy@stickyprompts.com. We respond within one month, and tell you if a request is genuinely complex enough to need longer. We may need to verify who you are first, and we will not charge you for any of this.

If the data sits inside a customer's workspace, we are the processor and will pass your request to that customer and help them answer it.

You also have the right to complain to a supervisory authority. In Hungary that is the Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH, naih.hu). You can also complain to the authority in the EU country where you live or work. We would rather you came to us first, but it is your call.

You decide what this website measures. The first time you visit, we ask. You can change your answer at any time with the cookie settings link, which is also in the footer of every page. The same choice applies on docs.stickyprompts.com.

Always on, with no cookies. Vercel Web Analytics and Speed Insights count page views and measure how fast pages load, without cookies and without any identifier stored on your device. PostHog records anonymous page views and clicks the same way: nothing is stored on your device, so it cannot recognise you from one page to the next. Your theme preference, a dismissed announcement, the record that you have already downloaded a playbook, and your cookie choice itself are stored in your own browser so the site remembers them.

Analytics, only if you allow it. PostHog stores an identifier so it can follow a visit across pages, and PostHog and LogRocket record sessions: clicks, scrolling and page changes, so we can see where the site confuses people. What you type into form fields is masked in those recordings. If you fill in a form, the name, email and company you gave us are attached to your visit.

Marketing, only if you allow it. Google Ads (loaded through Google Tag Manager) and the Meta Pixel set cookies to measure our advertising and to show our ads to people who have visited. Until you allow it, Google's tags run in consent mode: they load, but set and read no advertising cookies. The Meta Pixel does not load at all.

PostHog, LogRocket, Google and Meta are based in the United States, so this data may leave the EU. The legal basis for analytics and marketing is your consent. You can withdraw it at any time from cookie settings; when you do, we delete the cookies these tools set on our domain.

Web fonts on this site are currently served by Google Fonts, which means Google receives your IP address when a page loads. We are moving these files onto our own domain so that stops happening.

If you fill in a form to download a playbook or to book a demo, we use the details to send you what you asked for and to follow up about StickyPrompts. We do not sell or rent them, and every email has an unsubscribe link.

StickyPrompts is a service for organisations. It is not offered to consumers or to anyone under 18, and we do not knowingly collect data about children. If you believe a child's data has reached us, write to privacy@stickyprompts.com and we will delete it.

We update this policy as the service and the law change. Every version is dated, and the previous version is available on request.

For changes that materially affect how we handle personal data, we give workspace administrators at least 30 days' notice by email or in the product before they take effect. Other changes take effect when published.