Privacy Policy — Prompt Gateway

Effective date: October 14, 2026  ·  Contact: admin@promptgateways.com

This policy explains what the Prompt Gateway Chrome extension and the Prompt Gateway service collect, how that information is used, where and for how long it is stored, and who it is shared with. It is written to match how the software actually behaves today.

1. Who we are

Prompt Gateway is operated by Varad Software Solutions LLC ("we", "us"). Prompt Gateway is the brand name of the extension and the service. If you signed up yourself, we are the controller of your personal data. You can reach us about anything in this policy at admin@promptgateways.com.

2. What the extension does

Prompt Gateway is a Chrome (Manifest V3) extension that opens a side panel. In it you type or speak a rough idea, answer a few clarifying questions, and receive a better-structured prompt. You then copy that prompt and paste it into any AI chatbot yourself. To do this, the extension sends your input to the Prompt Gateway service and shows you the result. The extension does not read, fill in or send anything to the web pages you visit. It has no page access of any kind, and it does not answer your question itself.

3. Data we collect

In the extension

• Sign-in details. The email address and password you enter to sign in. They are sent directly to Google Identity Platform to sign you in. The extension does not store your password.
• Sign-in tokens. The tokens Google Identity Platform returns after you sign in. They are used to authenticate your requests to our service.
• Voice audio, recorded only while you hold down the microphone button (push-to-talk). It is sent to our service to be transcribed.
• Prompt text. This covers what you type, the transcript of what you say, your answers to clarifying questions, and the prompt produced for you.
• Your usage policy and plan. The extension fetches the usage settings and plan information that apply to your account so it can show what you are allowed to use.

When you create an account in the web portal

The extension's "Create a free account" button opens our web portal at app.promptgateways.com. When you sign up there we collect your email address, a password (held by Google Identity Platform; we never see it), your name (optional) and your acceptance of our terms. We then create an account record containing your email address, whether it has been verified, your name if you gave one, an internal user ID, and your organization, role, plan and trial dates.

Payment data

If you subscribe, you enter your payment details on a checkout page hosted by Stripe. We never receive or store your card number. We keep only the identifiers Stripe gives us (a customer ID and a subscription ID) plus your plan, billing interval, seat count, subscription status and renewal date.

Request metadata and logs

When the extension talks to our service, our hosting provider (Google Cloud) records standard request metadata. That includes your IP address, browser user agent, the request URL and method, the response status, the time and how long the request took. Our own services also log operational events, which contain only identifiers, status codes, timings and counts. No log contains the content of your prompts, audio, transcripts or results.

Account activity

For each account we keep a small activity record: the number of prompt sessions you have started, the number you have completed, the time you first used Prompt Gateway, and the time your third prompt was completed. This record holds only identifiers, counts and times. It never contains the content of your prompts.

4. How we use it

• To produce your result, meaning to transcribe your voice, check your input for safety, ask clarifying questions and write your prompt.
• To sign you in and authenticate each request.
• To enforce your plan and usage limits, including trials, seats and request quotas.
• To bill you for a paid subscription.
• To keep the service secure and working, which includes detecting abuse, rate limiting and diagnosing errors.
• To email you. We send three kinds of email: onboarding emails (how to install and use the extension), trial notices (for example, that your trial ends in 3 days or has ended) and upgrade offers (for example, a discount for annual billing). Your account activity record decides when these emails are sent.

We use your account activity only to time the emails we send you. We do not use your data for third-party advertising or ad targeting, we do not sell it, and we do not use your prompts to train models.

5. How we store it and for how long

On your device

• Session storage. Your sign-in tokens and your usage policy are kept in chrome.storage.session. This is an in-memory area that Chrome clears when the browser closes and that web pages cannot read.
• "Keep me signed in on this device" (optional). Only if you tick this box, the extension saves one sign-in refresh token to chrome.storage.local so you stay signed in after a browser restart. The token is stored only in encrypted form. Its encryption key is created in your browser, cannot be exported and never leaves your device. Signing out deletes the saved token and its key.
• A UI preference (which view was last open) is kept in chrome.storage.local. It records a setting and contains no content.
• Your prompts, audio, transcripts and results are not stored by the extension. They exist only in the memory of the open side panel and are gone when you close it.
• Downloads. A file is written to your device only when you click Save chat. That saves the conversation as a Markdown (.md) file to your own downloads. The extension never uploads or reads that file again.

On our servers

We do not store the content of your prompts. Your text, voice audio, transcripts, clarifying answers and generated prompts are held only in memory while your request is processed. They are not written to any database, file or log.

6. Who we share it with

We share data only with the service providers we need to run Prompt Gateway, and only for that purpose:

• A third-party AI model provider. Your prompt text, transcript and clarifying answers are sent to it only to run the safety check and to generate your questions and your prompt. Your voice audio is also sent to it to be transcribed.
• A third-party cloud computing provider that hosts our speech-to-text service. It receives your voice audio only, and only to transcribe it.
• Google. Google Identity Platform handles sign-in and holds your email address and password hash. Google Cloud hosts our service and logs, and screens your prompt text for prompt-injection and jailbreak attempts (Model Armor); that screening keeps no copy of your text.
• Neon. Neon hosts our database (account, subscription and account-activity records) on Amazon Web Services in the United States. It never receives the content of your prompts.
• Stripe. Stripe processes payments. You give your payment details to Stripe directly.
• A third-party email delivery provider, which sends our onboarding, trial-notice and upgrade-offer emails. It receives your email address, your plan status, your trial end date and account milestones (signed up, first prompt completed, 3 prompts completed). It never receives the content of your prompts. The provider may record whether an email was opened and whether a link in it was clicked.
• Your organization's administrator, if your employer or another organization set up Prompt Gateway for you. Your administrator can see your membership and role and controls the usage policy applied to your account.

We do not sell user data. The extension and the service use no advertising or analytics services, and the extension contains no third-party tracking. Apart from the email open and click records described above, there is no third-party tracking. The extension makes network requests only to our service at https://edge.promptgateways.com and to Google Identity Platform (identitytoolkit.googleapis.com, securetoken.googleapis.com). Its host_permissions and Content Security Policy allow no other network destinations. We may also disclose information if the law requires it.

7. Security

Every connection between the extension, our service and our providers is encrypted in transit with TLS. Access to our systems is restricted, and our services authenticate every request.

Please note: in the current configuration, our service's automated redaction and encryption stages are turned off. Your text therefore reaches the AI model provider without automated redaction of personal information. A safety check still runs on every request. Please avoid entering sensitive personal information, such as passwords, financial details or health information, that you would not want processed by that provider.

8. Permissions and why

• sidePanel: shows the side panel, which is the extension's only interface.
• storage: holds the session-only sign-in tokens and usage policy, the UI preference and, only if you choose "Keep me signed in", the encrypted refresh token.
• contextMenus: adds a right-click menu entry that opens the panel.
• Host permissions: limited to https://edge.promptgateways.com (our service), https://securetoken.googleapis.com and https://identitytoolkit.googleapis.com (Google Identity Platform sign-in). The extension requests no access to web pages or tabs.
• Microphone: Chrome asks for this at runtime the first time you use push-to-talk. It is used only to record your voice while you hold the button. It is not declared in the manifest.

9. Your choices and deletion

• Sign out in the panel to delete the sign-in tokens, the usage policy and any saved "Keep me signed in" token and key from your device. Closing the browser also clears session storage.
• Uninstall the extension to remove everything it stored on your device. Files you chose to download stay yours.
• Voice is optional. You can type instead, and you can revoke microphone access in Chrome's site settings at any time.
• Emails. Every onboarding and upgrade-offer email contains an unsubscribe link. Trial notices and billing service notices may still be sent while your account is active.
• Access or deletion. To get a copy of your account data or to delete your account, email admin@promptgateways.com from the address on the account. When we delete your account, we remove your account, sign-in, subscription and account activity records. Remaining copies in backups and logs expire on the schedule in section 5. Stripe keeps its own payment records under its own privacy policy. You can cancel a paid subscription at any time from the billing page of the web portal.
• If your organization deployed Prompt Gateway for you, that organization configures the service and sets the usage policy applied to your account. It is the controller for the content you submit through it, and we process that content on its behalf. Contact your organization's administrator first. You can also write to us at the address above and we will direct your request.

10. Chrome Web Store Limited Use

Prompt Gateway's use of information received complies with the Chrome Web Store User Data Policy, including the Limited Use requirements.

11. Children

Prompt Gateway is a productivity tool for general and professional use. It is not directed to children under 14, and we do not knowingly collect personal information from children under 14. You must be at least 14 years old to create an account. If you believe a child has given us personal information, contact us and we will delete it.

12. Changes to this policy

If we change this policy, we will update this page and the effective date above.

13. Contact

Varad Software Solutions LLC, operator of Prompt Gateway: admin@promptgateways.com.