Data Handling Policy

Overview

This policy describes how TryPromptFlow processes, stores, and protects the data involved in running diagnoses. It supplements our Privacy Policy, which covers what data we collect and your rights regarding it.

1. Submission Processing

When you submit a prompt, workflow, or agent description for diagnosis, the following process occurs:

Your submission content is used only to perform the requested diagnosis. It is not used to train shared models, improve other users' results, or build shared datasets.

2. Model Provider Usage

To generate diagnoses, TryPromptFlow sends your submission content to third-party model provider APIs. These providers process your content as API inputs to generate diagnostic output.

• We select providers that offer API terms designed to limit their use of customer content, including terms that restrict training on API inputs.
• We do not control the internal practices of model providers beyond the terms of their API agreements. We cannot guarantee how providers handle your content internally once received.
• We may change model providers or add new providers over time. If we do, we will apply the same selection criteria.
• Your submission content is sent to providers for the purpose of your diagnosis only — not for any provider's product improvement unless required by the provider's API terms, which we attempt to limit.

3. No Shared Model Training

We do not use customer submission content to train shared models — models available to other users, the public, or used across multiple customers. This applies to both the diagnostic process and any internal tools we build.

If we ever change this practice, we will not do so without explicit customer authorization. We will not quietly repurpose customer content for model training.

For avoidance of doubt: the model providers we use may have their own terms regarding API inputs. We select providers whose API terms are designed to restrict training on customer content, but the practices of third-party providers are outside our direct control.

4. Diagnostic Metadata Retention

Diagnostic metadata — including timestamps, model identifiers, processing status, diagnosis type, and error logs — may be retained for a longer period than submission content. This metadata is used for:

• Security: Monitoring for abuse, detecting anomalous usage, and investigating incidents.
• Billing: Tracking diagnosis counts per billing cycle and processing overage charges.
• Reliability: Diagnosing platform issues, tracking processing failures, and improving service stability.
• Account functionality: Maintaining your diagnosis history, report access, and account state.

Diagnostic metadata does not include the full text of your submissions or the full content of your reports. It is structured, operational data about the diagnostic process itself.

5. Account Isolation

Each diagnosis runs in its own account context. Your submission content is associated with your account and is not shared with or accessible by other customers.

• Account-level access controls restrict who can view your submissions and reports.
• Within a team or organization account, access is governed by the permissions set by the account administrator.
• We do not cross-reference or combine submission content across customer accounts.
• Diagnostic processing for different customers does not share context — each diagnosis is processed independently.

6. Report Retention

Diagnostic reports are retained as follows:

• Active subscriptions: Reports are accessible for the duration of your subscription. You can view, download, and share reports within your organization while your account is active.
• Free diagnosis: The report from your free diagnosis is accessible while your account is active. If you do not purchase a plan, the report may be retained for a limited period.
• Cancelled accounts: After cancellation, reports are retained for a reasonable period to allow for account reinstatement, after which they are scheduled for deletion.

We recommend downloading reports you need to keep if you plan to cancel your account.

7. Security Measures

We take the following measures to protect your data:

• Encryption in transit: Data is transmitted over encrypted connections (TLS).
• Access controls: Internal access to customer data is restricted to authorized personnel with a legitimate need.
• Account authentication: Account access requires authentication. We encourage strong passwords and support standard account security practices.
• Processing isolation: Each diagnosis runs in its own processing context, separate from other customers' diagnoses.
• Provider selection: We select model providers that offer API terms designed to protect customer content.

No system can guarantee complete security. If we become aware of a security incident affecting customer data, we will take reasonable steps to investigate, mitigate, and notify affected users where appropriate.

8. Data Deletion Requests

You can request deletion of your submission content and diagnostic reports at any time by contacting us at [email protected] from the email address associated with your account.

• We will process deletion requests within a reasonable timeframe after verifying your identity.
• Deletion covers submission content and diagnostic reports associated with your account.
• Diagnostic metadata may be retained for security, billing, and reliability purposes as described in section 4 above. Metadata retained for these purposes does not include the full content of your submissions.
• We may need to retain certain data where required by law, legal hold, or legitimate business records obligations.
• We do not promise instant or immediate deletion. Backups and cached copies may persist for a limited period before being removed through standard system processes.

To close your account entirely, contact us at the same address. Account closure will trigger deletion of associated submission content and reports according to the process described above.

9. Changes to This Policy

We may update this policy from time to time. When we do, we will update the "Last updated" date above. For material changes, we will provide notice through the platform or by email where possible.

10. Contact

For questions about how your data is handled, contact us at [email protected]. For privacy rights questions, see our Privacy Policy.