Privacy Policy

1. Introduction

PlayPrompt ("we", "us", or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, and protect your personal data when you use our platform at playprompt.org.

PlayPrompt is based in Luxembourg and operates in compliance with the General Data Protection Regulation (EU) 2016/679 ("GDPR") and applicable Luxembourg data protection laws, including the Luxembourg Law of 1 August 2018 on the organisation of the National Commission for Data Protection.

2. Data Controller

The data controller responsible for your personal data is:

3. Data We Collect

We collect the following categories of personal data:

• Account Information: Your name and email address, collected when you register for an account.
• Waitlist Information: Your email address, collected when you sign up for early access via our waitlist form.
• Game Data: Games you create using our platform, including game code and associated metadata.
• Conversation History: Your interactions and conversations with our AI system during game creation and editing.
• Usage Data: Information about how you use the platform, including features accessed, session duration, and interaction patterns.
• Authentication Data: Credentials managed through AWS Cognito for secure login.

4. Legal Basis for Processing

We process your personal data on the following legal bases under GDPR Article 6:

• Contract Performance (Art. 6(1)(b)): Processing necessary to provide our services when you create an account and use PlayPrompt.
• Legitimate Interest (Art. 6(1)(f)): Processing for platform improvement, security, and fraud prevention.
• Consent (Art. 6(1)(a)): Processing your email for waitlist communications. You may withdraw consent at any time.

5. How We Use Your Data

We use your personal data to:

• Provide and maintain the PlayPrompt platform and services.
• Authenticate your identity and manage your account.
• Process your game creation requests and deliver AI-generated content.
• Send you early access invitations and platform updates (waitlist subscribers).
• Improve our AI models and platform quality.
• Ensure platform security and prevent abuse.
• Comply with legal obligations.

6. Data Storage and Security

Your data is stored on Amazon Web Services (AWS) infrastructure located in the EU region (eu-west-1, Ireland). We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction, in accordance with GDPR Article 32.

Authentication is managed through AWS Cognito, which provides industry-standard encryption and security controls for user credentials.

7. Third Parties and Data Sharing

We do not sell your personal data to any third party.

We share data only with the following categories of service providers, who act as data processors under GDPR Article 28:

• Amazon Web Services (AWS): Cloud infrastructure, data storage, and authentication services (EU region).
• AI Model Providers: Your game descriptions and conversation history are processed by third-party AI services to generate game content. This data is transmitted securely and used solely for the purpose of fulfilling your request.

We ensure that all data processors provide sufficient guarantees to implement appropriate technical and organisational measures in compliance with GDPR requirements.

8. Cookies and Local Storage

PlayPrompt uses essential cookies and browser local storage for authentication and session management. These are strictly necessary for the platform to function and do not require separate consent under the ePrivacy Directive (2002/58/EC) as implemented in Luxembourg law.

We do not use tracking cookies, advertising cookies, or analytics cookies that track individual users across websites.

9. Your Rights Under GDPR

Under the GDPR, you have the following rights regarding your personal data:

• Right of Access (Art. 15): You may request a copy of the personal data we hold about you.
• Right to Rectification (Art. 16): You may request correction of inaccurate personal data.
• Right to Erasure (Art. 17): You may request deletion of your personal data. See Section 11 for details.
• Right to Restriction (Art. 18): You may request restriction of processing in certain circumstances.
• Right to Data Portability (Art. 20): You may request your data in a structured, commonly used, machine-readable format.
• Right to Object (Art. 21): You may object to processing based on legitimate interests.
• Right to Withdraw Consent (Art. 7(3)): Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us at hello@playprompt.org. We will respond within 30 days as required by GDPR Article 12.

You also have the right to lodge a complaint with the Luxembourg supervisory authority: the Commission Nationale pour la Protection des Données (CNPD), or with the supervisory authority in your EU Member State of residence.

10. Data Retention

We retain your personal data for as long as your account is active or as needed to provide our services. Specifically:

• Account data: Retained for the duration of your account and deleted upon request.
• Game data and conversation history: Retained for the duration of your account.
• Usage data: Retained for up to 90 days for operational purposes.
• Waitlist emails: Retained until you unsubscribe or request removal.

11. Data Deletion

You may request complete deletion of your account and all associated personal data by contacting us at hello@playprompt.org. Upon receiving a valid deletion request, we will:

• Delete your account and authentication credentials.
• Delete all your games, conversation history, and associated data.
• Remove your email from any waitlist or mailing list.
• Complete the deletion within 30 days.

12. Children's Privacy

PlayPrompt is designed for use by children and families. We take the privacy of children very seriously and comply with GDPR Article 8, which governs conditions applicable to children's consent in relation to information society services.

Under GDPR Article 8, the default age of digital consent across the European Union is 16. Some member states have lowered it to 13–15 within their jurisdiction; PlayPrompt applies the 16-year default uniformly for all users as a safety-by-default measure. Children under the age of 16 cannot create an account directly — a parent or guardian must set up the account and add the child as a profile on it. When we become aware that a user is under 16, we require verifiable parental consent before processing their personal data.

We commit to the following protections for children's data:

• We collect only the minimum data necessary to provide our services.
• We do not use children's data for profiling or targeted advertising.
• We do not sell or share children's data with third parties for marketing purposes.
• Parents or guardians may review, request deletion of, or refuse further collection of their child's data at any time by contacting hello@playprompt.org.

13. International Data Transfers

Your data is primarily stored within the European Union (AWS eu-west-1 region, Ireland). Where data is processed by AI model providers located outside the EU, we ensure appropriate safeguards are in place as required by GDPR Chapter V, including Standard Contractual Clauses (SCCs) approved by the European Commission.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on our website and updating the "Last updated" date. We encourage you to review this policy periodically.

15. Contact Us

If you have questions about this Privacy Policy, wish to exercise your data protection rights, or have concerns about how we handle your data, please contact us:

You may also contact the Luxembourg supervisory authority:
Commission Nationale pour la Protection des Données (CNPD)
https://cnpd.public.lu