Legal

Privacy Policy

This Policy explains what personal data FramePrompts processes, why it is processed, and the choices and rights available to you.

Effective date: 13 September 2026 · Last updated: 14 October 2026

FramePrompts is a public library with free and paid prompts. Visitors do not need an account to browse. Limited daily-count analytics require prior consent in the EEA, the United Kingdom and specified EU territories; elsewhere they run unless you decline. An unknown location is treated as requiring consent. The session-level interaction funnel and separate 30-day browser measurement require a fresh “Allow” choice in every location. Declining does not restrict access.

1. Who is responsible for your data?

The controller of personal data processed through FramePrompts is Denys Holovatiuk, operating FramePrompts, based at Smoluchowskiego 5, 02-679 Warsaw, Poland (referred to as “FramePrompts”, “we”, “us” or “our”).

Privacy enquiries and requests may be sent to privacy@frameprompts.com. If a data protection officer is appointed in the future, their contact details will be added here.

2. Scope of this Policy

This Policy applies to frameprompts.com, its prompt pages, and the private administration area. It does not govern third-party AI tools or websites that you may visit or use after leaving FramePrompts. Those services have their own privacy practices.

3. Personal data we process

When you browse the site

Our systems and infrastructure provider may automatically process technical data needed to deliver and protect the site, including:

IP address and approximate network or geographic information derived from it;
request date and time, requested URL, referring URL, response status and similar request metadata;
browser type, operating system, device type, language settings and protocol information;
security signals, error information and records of suspected malicious or abusive activity; and
network and performance information needed to route, cache and serve content.

When you press “Copy prompt”, we also record the prompt identifier, request time, a pseudonymous first-party copy-security session identifier and country code supplied by our delivery infrastructure. We do not store the visitor’s raw IP address in this prompt-copy event table. Authorised administrator requests are excluded.

We count prompt-page opens, successful prompt copies and clicks on the Higgsfield affiliate link in daily totals. Permanent platform-specific links, such as /inst, redirect to the homepage. Separate /r/ links contain a code assigned to a social post or website placement and remain available for individual publications. In the daily counters, homepage links record only a permitted link click; their code is not passed onward in the destination URL. For a separately consented V3 session already in progress, the first measured link source and link ID can also be retained within that session as described below. The assigned platform shows which link was used, not an independently verified referring website. In the European Economic Area (including Åland Islands, code AX), the United Kingdom (GB), and French EU territories coded GF, GP, MF, MQ, RE and YT, measurement starts only after you choose “Allow”. The same rule applies when Cloudflare cannot determine a country. In the United States and other locations, these aggregate counts run without a prior “Allow” choice unless you have explicitly declined. A prior “Decline” is respected regardless of your current country. Without permission under this rule, a short link simply redirects: no link click is counted and no post code is passed to a prompt URL. A visit made before permission is not counted later if you allow analytics on the page. Counts are grouped by date and link, and by prompt where applicable; the analytics table does not contain IP addresses, browser identifiers, individual sessions or a person-level journey. Cloudflare derives an approximate country from the request and a temporary IP-based limiter may process an address to protect the event endpoint, but neither is written to this analytics table. Counts do not establish unique visitors, sales or commissions. Authorised administrator actions and recognised bots are excluded where possible.

For paid prompts, we also count a permitted click on the Buy prompt button as a separate daily total, grouped by prompt and by a validated social-post link when one is present. The /go/checkout route verifies the saved checkout destination, records the permitted count, then redirects to Lemon Squeezy. It redirects without recording when you have declined, consent is required but unavailable, or measurement fails. In regions requiring prior consent, this new action is counted only after an Allow for the updated notice. The count is not a number of unique people, completed checkouts or purchases. Payment and file delivery take place on Lemon Squeezy; we do not receive a purchase confirmation through this click count. No new analytics cookie or visitor identifier is added for Buy clicks.

Under that same country-and-choice rule, a newer, separate daily rollup counts measured entries through a short link or a public HTML landing page. A counted short-link redirect is marked for one hop so its destination is not counted as a second entry; the marker contains no visitor or post ID and is removed from the displayed URL after loading. Entries are grouped only by day, broad acquisition source (for example Instagram, Direct, Organic or Unknown), broad device category (mobile, desktop, tablet or unknown), and page-versus-short-link type. Referrer and User-Agent may be read while handling the request, but their full values are not saved in this rollup. A platform assigned to a short link identifies the link used, not the app that necessarily sent the person. These counts begin when this method is enabled; they are requests, not unique visitors, and earlier traffic is not backfilled.

Separately, we count saved Allow, initial Decline and later Withdraw actions in daily totals to evaluate the privacy interface. These totals contain only a day, an action type and a count: no IP address, visitor identifier, prompt or social-post code is stored. They count actions rather than unique people; closing the notice without choosing is not counted. Technical request data may still be processed to deliver and protect the choice endpoint.

Optional session funnel and browser measurement

The updated analytics notice is shown again to every browser, including those that previously allowed or declined the older daily counts. A fresh “Allow” permits daily-count analytics, the V3 session funnel and the separate 30-day browser count; “Decline” turns these measurements off. The earlier Allow does not authorise either new method. Closing the notice without choosing grants no new consent; an earlier daily-count preference remains in effect until you choose again. We do not reconstruct older sessions or browser counts from past data. The V3 funnel records a prompt-page opening, the Copy section or affiliate button entering the visible part of the screen, a confirmed prompt copy, and a click on the Higgsfield button. Visibility does not prove that someone read the content. The affiliate click is recorded on our /go/higgsfield route before it redirects when consent and measurement are available; the link still works if you decline or a measurement attempt fails.

For each permitted V3 event, we store a random browser-session ID, prompt ID, cta_version=v3, affiliate provider, a validated social-post ID where available, filtered UTM source, medium, campaign and content values, the referring site’s origin rather than its full page URL, a broad mobile/desktop/tablet/unknown category and event time. A recorded affiliate click also has a separate random click ID and the exact destination URL. Within that consented session, we keep the first measured acquisition-source category and, if applicable, the first short-link ID so later prompt actions can be grouped under the same source. The separate browser-count ID described below is not joined to these events, prompts, copies, posts or UTM values. This is a pseudonymous sequence of actions within a browser session, not just an anonymous daily total. We do not add the raw IP address or full User-Agent to the V3 event table, although Cloudflare and our security controls may process them when handling requests. Attribution information in a URL may also appear in browser history or infrastructure request logs. Do not place personal details in UTM values. The V3 dashboard counts events and distinct browser sessions within its reporting window, not unique people or browsers across sessions. A click is not a registration or sale; commissions must be checked with the partner separately. In regions requiring prior consent, a first /r/ visit before “Allow” is not counted or attributed afterward, so post-level funnels there are incomplete.

For the separate browser count, after a fresh Allow the site asks our server to record a visit from that browser. The server issues a random first-party fp_analytics_browser cookie for a fixed 30 days without extending its expiry on later visits. In the working database, we store that random browser ID with the UTC day and first observation time, at most once per browser per day. This is a pseudonymous ID, not an anonymous statistic or an IP-derived hash; the cookie is not marked HttpOnly and can technically be read by scripts on our site. It is not linked to the session funnel or prompt-level actions. The private dashboard counts distinct measured browser IDs over the selected 1-, 7- or 30-day period, not a sum of daily uniques. It does not count physical people, every browser, or all site visitors: separate devices, cleared cookies, private browsing, blocked requests and unrecognised bots can affect the number. The first visit before Allow is not backfilled, although a browser may be counted after Allow on that same page. Declining or withdrawing clears this cookie and stops new browser-count requests; rows already recorded remain in the working database until scheduled deletion or a justified rights request is handled.

For a fresh updated Allow, we keep a server-side consent receipt containing the choice, UTC time, notice version and exact notice text. The random receipt ID is held in the first-party fp_funnel_consent cookie for up to 180 days and checked before each V3 event and browser-count request; it can therefore be recognised across browser sessions for consent verification. A new choice or withdrawal revokes the earlier receipt when available. We also record Decline and Withdraw actions to document privacy choices. Receipt records do not include a raw IP address, full User-Agent, prompt ID or social-post code. This evidence is kept separately from the daily aggregate choice counters.

We do not use this information on the public site to create advertising profiles or make decisions that produce legal or similarly significant effects.

Cookies and browser storage

The older daily-count rollups do not use an analytics identifier cookie. A first-party fp_analytics_consent cookie stores your “yes” or “no” choice for 180 days. fp_analytics_notice_seen records for 180 days which version of the notice was shown; the updated browser-count notice has a new version so an earlier notice does not suppress it. This marker is not consent. After a fresh affirmative choice, fp_funnel_consent stores the consent-receipt ID for up to 180 days, fp_funnel_session holds a random identifier for the browser session, and the separate fp_analytics_browser cookie identifies a measured browser for a fixed 30 days. A refusal is also stored as a preference. Declining or withdrawing stops new optional events and clears both measurement cookies, but does not automatically erase rows recorded before withdrawal. Browsers may restore a session after restart. In the site footer, “Privacy choices” lets you decline or change your choice; “Withdraw analytics” revokes a prior Allow in one step. When daily-count measurement is permitted under the country-and-choice rule above, a coded /r/ post link carries its code in the prompt URL; permanent platform links and coded homepage links do not carry a code onward. No post code is stored in a separate analytics cookie. Separately, after a visitor requests a prompt, FramePrompts sets fp_copy_session for a 30-day copy-request security audit. It is not used to join analytics events or to enforce the IP-based copy rate limit. The necessity and 30-day duration of this separate security identifier remain subject to review. Authorised administrators may receive fp_internal for 30 days so their activity is excluded from production analytics. Cloudflare may also use mechanisms for security, traffic routing or reliable delivery. The private admin area uses HTTP Basic Authentication rather than an application session cookie.

In supported browsers, the admin tool uses IndexedDB to remember an administrator’s chosen local backup-folder handle. This information stays in that browser unless the administrator removes it. More detail is available in our Cookie Policy.

Administrators and invited contributors

For administrators and any invited contributors, we may process identifiers and professional contact details, authentication or access-control information, audit and security logs, contribution records, uploaded prompts and images, metadata, correspondence, and moderation or rights-management records. The current admin area is private and is not a registration service for the public.

Information you send voluntarily

If you contact us by email or through a form introduced later, we process the information you provide—such as your name, email address, message, attachments and the history of our correspondence—to respond to you and manage the matter. Please do not send confidential information, special-category personal data, or personal data about others unless it is necessary and you are entitled to do so.

Affiliate links

Some clearly identified links may contain an affiliate referral code. If you choose to follow one, the destination provider receives that code together with the technical data ordinarily sent when you visit its website and may store referral cookies or similar technologies on its own domain under its own privacy and cookie notices. FramePrompts does not currently place a third-party affiliate-tracking cookie on frameprompts.com merely by displaying or linking to an affiliate offer.

4. Why we process data and our legal bases

Purpose	Typical data	GDPR legal basis
Deliver the site, route requests, show prompts and maintain availability	IP address, device and request data	Our legitimate interests in operating a functional website (Article 6(1)(f))
Prevent abuse, investigate incidents, secure the service and enforce our Terms	IP address, request and security logs, authentication and audit data	Our legitimate interests in protecting the service, users and our rights (Article 6(1)(f)); where necessary, compliance with legal obligations (Article 6(1)(c))
Deliver requested prompt copies and prevent automated extraction or repeated abuse	Prompt identifier, request time, pseudonymous copy-security session identifier and country code	Performance of the feature you request (Article 6(1)(b), where applicable) and our legitimate interests in protecting the prompt library (Article 6(1)(f))
Measure permitted site entries, link clicks and prompt activity, subject to your country and privacy choice	Day, aggregate count, broad acquisition source and device category, entry type; link or prompt identifier where applicable; technical request data processed to deliver and protect the endpoint	Consent (Article 6(1)(a)) where we request it; our legitimate interests in limited aggregate measurement (Article 6(1)(f)) elsewhere without an explicit refusal, subject to applicable law and your right to object
Measure the V3 sequence of prompt and button interactions within a browser session	Random session ID, prompt and validated post IDs, event and CTA version, provider, filtered UTM values, referring origin, broad device category and time; click ID and destination URL for affiliate clicks	Fresh consent (Article 6(1)(a)) in every location; V3 is off without it
Count distinct consenting browsers over a selected period, without linking them to prompt or affiliate events	Random browser ID in a 30-day cookie, UTC visit day and observation time	Fresh consent (Article 6(1)(a)) in every location; no browser ID is issued for this count without it
Document and honour a V3 consent, refusal or withdrawal	Random consent-receipt ID, choice, UTC time, notice version and text, and revocation time where applicable	Our compliance obligations concerning consent and our legitimate interests in demonstrating and honouring the choice (Articles 6(1)(c) and 6(1)(f), as applicable)
Record aggregate privacy-choice actions	Day, Allow/Decline/Withdraw action type and total count; technical request data processed to deliver and protect the endpoint	Our legitimate interests in managing and evaluating the privacy interface (Article 6(1)(f)); the action totals themselves contain no visitor identifier
Manage administrators, invited contributors and their submissions	Identity, contact, access and contribution data	Performance of a contract or pre-contract steps (Article 6(1)(b)); legitimate interests in editorial and access management (Article 6(1)(f))
Answer enquiries, privacy requests and content notices	Contact details, message, evidence and correspondence	Legitimate interests in communicating and handling claims (Article 6(1)(f)); legal obligations (Article 6(1)(c)); or pre-contract steps when applicable (Article 6(1)(b))
Operate disclosed affiliate links and account for commissions	Affiliate referral code and, where made available to us, referral or conversion records	Our legitimate interests in funding and evaluating the service (Article 6(1)(f)); consent where any non-essential on-site tracking is introduced
Establish, exercise or defend legal claims and keep required records	Relevant account, communication, security and submission data	Legitimate interests in protecting legal rights (Article 6(1)(f)) and legal obligations (Article 6(1)(c))
Use other optional advertising or similar technologies if introduced later	Data described in an updated notice	Consent (Article 6(1)(a)) where required; such tools will not be activated before the required information and controls are provided

Where we rely on legitimate interests, we consider the necessity of the processing and balance those interests against your rights and reasonable expectations. You may object as described below. Where processing is based on consent, you may withdraw it at any time without affecting earlier lawful processing.

5. Sources of data

We obtain data directly from you when you contact us or contribute content; automatically from your browser, device and network when you use the site; from administrators who manage the library; and from service providers that operate or protect the service. If a rights complaint concerns you or your content, we may also receive relevant information from the person making the complaint.

6. Who receives personal data?

We disclose personal data only where needed for the purposes described above, including to:

Cloudflare, which provides website delivery and security, Cloudflare D1 database services, and Cloudflare R2 object storage. Depending on the processing activity, Cloudflare acts as our processor or handles certain data under its own documented responsibilities;
Zoho Mail, which provides our email hosting and processes messages sent to or from our domain;
affiliate AI-tool providers, including Higgsfield if an affiliate link to that provider is made available, when you choose to follow a clearly marked affiliate link; those providers process data on their own websites under their own notices;
professional advisers and contractors subject to appropriate confidentiality obligations, where necessary;
public authorities, courts or other parties where required by law or necessary to protect legal rights; and
a successor in connection with a merger, acquisition or transfer of the project, subject to applicable law.

We do not sell personal data. An up-to-date list of other processors, if any, may be requested using the privacy contact above.

7. International transfers

Cloudflare operates a global network, so personal data may be processed outside Poland or the European Economic Area. Where GDPR requires a transfer safeguard, we rely on an applicable adequacy decision or contractual safeguards such as the European Commission’s Standard Contractual Clauses, together with supplementary measures where appropriate. Cloudflare’s current data-processing terms describe its transfer mechanisms. You may contact us for information about applicable safeguards and how to obtain a copy, subject to necessary redactions.

8. How long we keep data

We retain personal data only as long as reasonably necessary for the relevant purpose, taking into account the data’s nature, security needs, applicable limitation periods, legal obligations and the settings of the services we use. In particular:

request, diagnostic and security logs under our direct control are normally kept for up to 30 days unless an incident, abuse investigation or legal obligation requires longer preservation; retention in all infrastructure-provider logs and backups is still being verified;
aggregate daily analytics counts and publication-level short-link records may be kept while the library and related publications are active; these records do not contain a visitor identifier or individual event history;
V3 event and first-source rows, including session and click identifiers where applicable, are scheduled for deletion from the working analytics tables after 30 days; this does not by itself establish when provider logs or backups are removed;
browser-count rows are scheduled for deletion from the working database 30 days after that browser ID was first observed, including all of its recorded days; the browser cookie itself has a fixed 30-day expiry and is not renewed on later visits;
V3 consent receipts are scheduled for deletion from the working database after 210 days, covering the 180-day consent-cookie lifetime and a 30-day margin; provider backup retention and the suitability of this period remain under review;
daily privacy-choice action totals may be kept while the privacy-choice interface is active; they do not contain a visitor identifier or individual event history;
correspondence and content notices are normally kept for up to 3 years after the matter closes, unless a longer period is needed for legal claims or compliance;
administrator and contributor records are kept while access or the contributor relationship remains active and for up to 6 years afterward, subject to legal and rights-management needs;
published content and its provenance or licence records may be retained while it is published and afterward where needed to document rights and resolve disputes; and
local backup copies made through the admin tool remain under the administrator’s control until the administrator deletes them; managed infrastructure copies are removed or overwritten according to the applicable provider cycle and our operational settings.

Information stored locally by an administrator in IndexedDB remains until that administrator clears the site’s browser data or replaces/removes the saved permission.

9. Your GDPR rights

Subject to the conditions and exceptions in applicable law, you may ask us to:

confirm whether we process your personal data and provide access to it;
correct inaccurate or incomplete data;
erase personal data;
restrict processing;
provide data you supplied in a structured, commonly used, machine-readable format and transmit it where the portability right applies;
stop processing based on legitimate interests, including an unconditional right to object to direct marketing; and
withdraw consent at any time where consent is the basis for processing.

FramePrompts does not currently use solely automated decision-making that produces legal or similarly significant effects. To exercise a right, email privacy@frameprompts.com. We may ask for information reasonably necessary to verify your identity. We normally respond within one month, subject to extensions permitted by law.

You may also complain to the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO). Information on complaints is available at uodo.gov.pl. You may instead contact the supervisory authority in the EU or EEA country where you live, work or believe an infringement occurred. We encourage you to contact us first so we can try to resolve the concern.

10. Security

We use technical and organisational measures designed to protect personal data, including access restrictions for the private admin area, encrypted transport, infrastructure security controls and limited access based on operational need. No internet service or storage method is completely secure, so we cannot guarantee absolute security.

11. Children

FramePrompts is intended for designers and creative professionals and is not directed to children under 16. We do not knowingly request personal data from children. If you believe a child has provided personal data to us, contact us so we can assess and, where appropriate, delete it. Visitors should also comply with the age requirements of any third-party AI service they use.

12. Changes to this Policy

We may update this Policy when the service, providers or law changes. The revised version will be posted here with a new “Last updated” date. If a change materially affects how we process existing personal data, we will provide additional notice or request consent where required.

13. Contact

Controller: Denys Holovatiuk, operating FramePrompts
Postal address: Smoluchowskiego 5, 02-679 Warsaw, Poland
Privacy email: privacy@frameprompts.com