Prompt & Dragon

Privacy Policy

Version dated 22 September 2026

This policy explains what personal data is processed when you visit or use Prompt & Dragon, why it is processed, with whom it may be shared, and how to exercise your rights. It supplements the Terms of Sale.

1. Data controller

The data controller is GHOST LOGIC, a French simplified joint-stock company (SAS) with share capital of €2,000, 18 La Croix de Vaux, 14310 Épinay-sur-Odon, France, publisher of Prompt & Dragon.

Data protection contact: [email protected].

2. Data we process

Account and authentication data

  • name or preferred name, when provided;
  • email address and verification date;
  • password stored only in hashed form;
  • hashed technical tokens for address verification, magic login, and password reset;
  • session identifiers strictly necessary for login.

Briefs, settings, and game content

  • free-form brief describing the desired adventure;
  • number of players, duration, tone, and scenario type;
  • kits, archetypes, situations, characters, and other generated content;
  • game cockpit state, progress, layouts, and preferences specific to the Kit.

Briefs are sent to artificial-intelligence providers. Do not enter sensitive data, secrets, confidential information, or information about a third party unless you have an appropriate legal basis.

Orders, payments, and Credits

  • email address associated with the Order;
  • reference, date, amount, currency, purchased product or pack, and payment status;
  • technical Stripe identifiers for the price, payment session, event, and payment intent;
  • balance, Credit movements, billed generations, and Credit refunds;
  • tax or billing data that Stripe may request depending on the sales context.

Full banking details are entered in Stripe’s secure interface and are not stored in Prompt & Dragon’s database. We receive only the information needed to reconcile and prove the transaction.

Technical and security data

  • operation dates and times, request identifiers, and error logs;
  • IP address, requested URL, and browser information that may appear in server or host logs;
  • AI model used, generation steps, token count, duration, provider cost, and OpenRouter request identifier;
  • attempts, error codes, and elements needed to prevent abuse and resolve incidents.

Communications

We process the email address and useful content of transactional messages sent to verify an account, reset a password, provide a login link, or welcome you. If you contact support, we also process the content of your request and the information needed to answer it.

3. Purposes and legal bases

Purpose Main data Legal basis
Create and secure the account Identity, email, hashed password, sessions, and tokens Performance of the contract or pre-contractual measures
Generate, store, and return Kits Brief, settings, generated output, and cockpit state Performance of the contract
Process payments, Credits, and refunds Order, transaction, Stripe identifiers, and Credit ledger Performance of the contract and legal accounting and tax obligations
Send emails essential to the Service Email, name, and time-limited secure link Performance of the contract and legitimate interest in securing the account
Maintain, diagnose, and secure the Service Technical logs, errors, IP, metrics, and security events Legitimate interest in ensuring security, preventing abuse, and improving reliability
Answer requests and defend our rights Correspondence, account, Orders, and technical evidence Legitimate interest and legal obligations

The Site currently uses no commercial newsletter, behavioral advertising, or third-party marketing-tracking tool. If these practices are added, this policy and, where necessary, the consent mechanism will be updated before activation.

4. Artificial intelligence and transmission of briefs

To produce a Kit, Prompt & Dragon prepares instructions from the brief and chosen settings, then sends them to OpenRouter . OpenRouter routes the request to the selected model provider. Intermediate outputs are then assembled and stored by Prompt & Dragon to deliver the Kit.

Prompt & Dragon does not use your briefs or Kits to train its own model. Any move toward reusing content for training or evaluation not essential to the Service would require prior notice and a separate legal basis.

5. Recipients and processors

Data is accessible only to authorized Prompt & Dragon personnel and providers needed to deliver the Service, within the limits of their assignment:

  • OVH SAS (OVHcloud) , hosting of the application and PostgreSQL database;
  • Stripe , displaying the payment form, processing transactions, and preventing fraud;
  • OpenRouter, Inc. and selected model providers, for generating the requested content;
  • Plus Five Five, Inc. (Resend), for sending transactional emails;
  • advisers, authorities, or courts where the law requires it or to defend a right.

We do not sell or rent personal data. A more detailed list of model providers and their terms may be supplied on request when that information is available.

6. Transfers outside the European Economic Area

The main infrastructure is hosted by OVHcloud. Stripe, Resend, OpenRouter, or some model providers may nevertheless process data from the United States or another country outside the European Economic Area.

Where required by the GDPR, these transfers must rely on an adequacy decision, the European Commission’s standard contractual clauses, or another appropriate legal mechanism, supplemented where necessary by additional safeguards. The applicable safeguards may be requested from the contact listed in Article 1.

7. Retention periods

We do not retain data indefinitely. The period depends on the purpose, legal obligations, and the need to establish, exercise, or defend a right.

  • Account, Kits and game state: for the lifetime of the account. Deletion from “My account”, after confirmation and password verification, erases this data from the active database along with sign-in tokens and the credit balance. A pending payment must first be completed or its expiration confirmed.
  • Orders and accounting records: Payment data required for accounting obligations (purchase reference, billing email, amount, currency, date and Stripe references) is retained separately after account deletion, with access restricted to accounting needs, for ten years from the end of the relevant financial year.
  • Data needed to prove the contract: for the applicable limitation period, with restricted access once it is no longer needed for the current Service.
  • Authentication tokens: links become unusable after their technical expiry — one hour for password resets and twenty-four hours for verification or magic login — or as soon as they are used.
  • Rights requests and complaints: for the time needed to handle the request, then for the period needed to prove how it was handled.

Backups are overwritten according to their technical cycle and restored only in the event of an incident. Final periods must be aligned with the deletion procedures actually deployed before commercial launch.

8. Cookies and local storage

Prompt & Dragon uses one strictly necessary session cookie named adonis-session , to maintain the connection, protect forms, and temporarily retain the purchasing journey. The session expires after about two hours of inactivity. This cookie is configured to be inaccessible to browser JavaScript and sent only over HTTPS in production.

Payment pages integrate Stripe, which may use its own cookies and technologies strictly necessary for security, fraud prevention, and payment operation. Prompt & Dragon currently installs no advertising cookie or third-party audience-measurement tool. If a non-essential tracker were added, it would be activated only after notice and, where required by law, your consent.

9. Security

Proportionate technical and organizational measures are implemented, including HTTPS encryption, password hashing, hashed authentication tokens, access controls, input validation, signed verification of Stripe webhooks, technical-event logging, and separation of environment secrets.

No system is entirely free of risk. If a data breach may create a risk to your rights and freedoms, we will apply the documentation, authority-notification, and individual-notification obligations required by regulation.

10. Your rights

Under the GDPR and French Data Protection Act, you may request:

  • access to your data and a copy of it;
  • correction of inaccurate or incomplete data;
  • deletion of your data where no legal reason justifies retaining it;
  • temporary restriction of processing;
  • objection to processing based on our legitimate interest, for reasons related to your situation;
  • portability of data you provided when processing is automated and based on the contract or consent;
  • withdrawal of your consent, without affecting the lawfulness of prior processing;
  • information about safeguards applicable to international transfers.

Prompt & Dragon does not make, solely on the basis of automated processing, a decision producing legal effects or similarly significantly affecting you. Kit generation is automated, but it is the creative service requested and not a decision about your rights.

To exercise your rights, write to [email protected]. We may request reasonable information to verify your identity. You may also set instructions about what happens to your data after your death, under French law.

11. Complaint to the CNIL

If you believe your rights are not respected, you may lodge a complaint with the French data-protection authority: www.cnil.fr/fr/plaintes , CNIL — 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07.

12. Changes to this policy

This policy may be updated to reflect changes to the Service, providers, or regulations. The version date appears at the top of the page. If a substantial change is made, affected users will be informed by an appropriate means before it takes effect where required by law.