Privacy Policy

This Privacy Policy explains how Bizmarq ("we", "us", "our") collects, uses, and protects your personal data when you use PromptDiff at promptdiff.bizmarq.com. By using the service, you agree to the practices described in this policy.

1. Data We Collect

We collect the following categories of data:

Account information

• Email address (used for authentication and communication)
• Password (stored as a bcrypt hash; we never store plaintext passwords)
• API keys (generated by us for your account access)

Usage data

• Prompts you submit for evaluation
• Model outputs returned by LLM providers
• Evaluation metadata: models selected, latency, token counts, cost
• Usage statistics: number of evaluations, API call history

Payment information

• Payment details are collected and processed by Stripe. We do not store your credit card number. We receive from Stripe: billing email, last four digits of your card, and transaction history.

2. How We Use Data

• Provide the service: Route prompts to LLM providers, return results, display evaluation history in your dashboard.
• Billing: Track usage to calculate charges and process payments through Stripe.
• Support: Respond to your questions and troubleshoot issues.
• Service improvement: Analyze aggregated, anonymized usage patterns (not your prompts or outputs) to improve reliability and performance.
• Security: Detect and prevent abuse, fraud, and unauthorized access.

3. Data Retention

• Evaluation results (prompts, outputs, metadata) are stored for 90 days and then automatically deleted.
• Account data (email, hashed password, API keys) is retained until you delete your account.
• Billing records may be retained longer as required by applicable tax and accounting laws.
• When you delete your account, we delete your personal data within 30 days, except where retention is required by law.

4. Third-Party Sharing

We share data with third parties only as necessary to provide the service:

• LLM providers (Anthropic, OpenAI, Google, Grok): Your prompts are sent to the providers of the models you select. Each provider has their own privacy policy and data handling practices. We send only the prompt content and model parameters; we do not send your account information.
• Stripe: Payment information is processed by Stripe in accordance with their Privacy Policy.
• Law enforcement: We may disclose data if required by law, court order, or government request.

We do not sell your personal data to anyone.

5. Data Security

• All data in transit is encrypted via HTTPS/TLS.
• Passwords are hashed using bcrypt before storage.
• API keys are stored securely and can be regenerated at any time from your dashboard.
• Our servers are hosted on Vultr in Tokyo, Japan.
• While we implement reasonable security measures, no system is 100% secure. We encourage you to use strong, unique passwords and keep your API keys confidential.

6. Your Rights

You have the right to:

• Access your data: View your prompts, outputs, and account information in the dashboard.
• Export your data: Download your evaluation history via the API.
• Delete your data: Delete individual evaluations or your entire account from the dashboard settings.
• Correct your data: Update your email or password at any time.

To exercise any of these rights, use the dashboard or contact us at mai.takano@east-cloud.jp.

7. Cookies & Local Storage

PromptDiff uses minimal browser storage:

• Authentication token: Stored in localStorage to keep you signed in. No tracking cookies are used.
• No third-party cookies: We do not use analytics cookies, advertising cookies, or any third-party tracking scripts.

8. GDPR (EU Users)

If you are located in the European Economic Area (EEA), you have additional rights under the General Data Protection Regulation (GDPR):

• Legal basis: We process your data based on (a) your consent when you create an account, (b) the necessity to perform our contract with you, and (c) our legitimate interests in operating and improving the service.
• Data portability: You can export your data in a structured, machine-readable format via the API.
• Right to erasure: You can request deletion of all your personal data by deleting your account or contacting us.
• Right to object: You can object to processing of your data for certain purposes by contacting us.
• Data transfers: Your prompts may be sent to LLM providers whose servers are located outside the EEA (primarily in the United States). By using the service, you consent to these transfers as necessary to provide the service.

9. Changes to This Policy

We may update this Privacy Policy from time to time. When we make significant changes, we will notify you by email or by posting a notice in the dashboard. The "Last updated" date at the top of this page reflects the most recent revision. Continued use of the service after changes take effect constitutes acceptance of the updated policy.

10. Contact

If you have questions about this Privacy Policy or want to exercise your data rights, contact us: