Promake Privacy Policy

Last Updated: 2 September 2026

Promake Labs Incorporated ("Promake," "we," "us," or "our") is an AI-powered platform that lets small businesses, entrepreneurs, and non-technical founders build, launch, and run a business — website, domain, payments, marketing, and (where enabled) paid advertising through Promake Ads — entirely through natural-language chat prompts. Our mission is to simplify starting and running a small business through innovative tools, seamless integrations, and collaborative features, while prioritizing the privacy and security of your data. We are committed to fostering a vibrant community and ensuring compliance with applicable privacy laws in the United States (including all applicable state privacy statutes), European Economic Area, United Kingdom, Switzerland, and Canada.

This Privacy Policy ("Policy"), available online at promake.ai/privacy, outlines how Promake collects, uses, shares, and otherwise processes personal information from users, including business owners, entrepreneurs, and visitors ("User," "you," or "your") of our website, platform, and services (collectively, our "Services"). By using our Services, you acknowledge this Policy; our legal basis for processing may include contract performance, legitimate interests, or legal obligations, as set out in Section 3. This Policy incorporates our Terms of Service, any applicable Supplemental Terms (including the Promake Ads Supplemental Terms), and any applicable Data Processing Agreement (DPA) by reference. You may view our Data Processing Agreement at promake.ai/data-processing-agreement. If you do not agree with the terms of this Policy, please discontinue your use of our Services. In the event of any conflict between this Policy and a signed DPA, the DPA will control with respect to Customer Personal Data.

1. Personal Data

For purposes of this Policy, "personal data" (also called "personal information" under the California Consumer Privacy Act/Privacy Rights Act and similar U.S. state laws) means any information that relates to an identified or identifiable natural person or is reasonably capable of being linked to a particular consumer or household, as set out in the EU GDPR, UK GDPR, Canada's PIPEDA, the revised Swiss Federal Act on Data Protection, and all applicable U.S. federal or state privacy statutes. Personal data may include, for example, your name, business email address, postal address, telephone number, username, unique device or browser identifiers, IP address, authentication tokens, usage and telemetry logs, or other information generated through your use of our Services. Operational metrics and telemetry that Promake processes independently for security, billing, analytics, or product-improvement purposes ("Service Data") are handled separately as described in Section 8 and are not treated as Customer Personal Data.

Promake does not intentionally collect special-category or sensitive personal data, such as biometric identifiers, health information, or precise geolocation, and instructs customers not to upload such information.

Children's Data

Promake's Services are not intended for individuals under the age of eighteen (18), and we do not knowingly collect or solicit personal data from anyone under this age. By using our Services, you represent that you are at least 18 years old or the age of majority in your jurisdiction. If we discover that we have collected personal data from a minor without verifiable parental consent, we will promptly delete that information. If you believe we may have collected such data, please contact us at legal@promake.ai.

2. Collection and Use of Information

Information You Provide Directly: When you create an account, purchase a subscription, open a support ticket, or otherwise use our Services, you may supply personal data such as your name, business email address, phone number, payment information, and project artifacts (for example, natural-language prompts, generated websites and code, or deployment configurations). These artifacts are used to operate and support your workspace and, subject to your subscription plan and the AI-training terms described in the "Data usage, training, and learning" section of the Terms of Service, may be used — excluding any Personally Identifiable Information ("PII") — to train and improve our AI models. In summary: Enterprise Plan customers are automatically excluded from this use; Business Plan customers may opt out; Free and Pro plan Customer Data is used for these purposes by default. The Terms of Service is the authoritative, current description of plan-specific data usage and controls in the event of any inconsistency with this summary.

Information Collected Automatically: When you interact with the Services, we automatically collect technical data such as IP address, browser type, operating system, device identifiers, pages visited, timestamps, and error logs. Certain operational metrics and telemetry ("Service Data") are processed by Promake as an independent controller for security, billing, analytics, and product-improvement purposes (see Section 8).

Usage and Analytics Data: We record how you engage with key features (e.g., prompts submitted, websites and code generated, build and deployment events, clicks on integrations such as payment or domain providers, and — where you use Promake Ads — campaigns configured and ad platforms connected). If you authorize a third-party integration, Promake accesses only the minimum data required to provide that integration and processes it under the same terms as other Customer Personal Data.

We process this information on the legal basis of contract performance, legitimate interests, compliance with legal obligations, and your consent, for the following purposes: to provide, operate, and maintain the Services, including storing your content, generating suggestions, deploying websites, and (where enabled) configuring and optimizing advertising campaigns; to personalize your experience and tune AI-driven features for your workspace; to analyze usage patterns and improve performance, functionality, and reliability; to detect, prevent, and investigate fraud, abuse, or security incidents; to deliver product updates and measure the effectiveness of our own marketing; to communicate with you and provide customer support; to process payments and other transactions you authorize; to comply with legal, regulatory, export-control, and sanctions obligations; and to meet record-keeping, accounting, and audit requirements.

Promake does not engage in automated decision-making that produces legal or similarly significant effects on individuals (GDPR Art. 22). We collect only the personal data necessary for these purposes and retain it in line with the schedule in Section 11. You can exercise your opt-out or objection rights to certain processing activities as described in Section 9 ("Your Privacy Choices").

3. Legal Bases for Processing Your Data

Promake processes personal data only where a valid legal ground applies under each privacy regime that governs our Services, including: United States — CCPA/CPRA (California), VCDPA (Virginia), CPA (Colorado), UCPA (Utah), CTDPA (Connecticut), and any other applicable U.S. state privacy law; International — GDPR (EEA), UK GDPR, and the revised Swiss Federal Act on Data Protection (rev-FADP); and Canada — PIPEDA.

Legal bases we rely on: Performance of a Contract (to provide, maintain, and support the Services you have requested); Legitimate Interests (to secure the platform, detect fraud, generate aggregate analytics, and improve AI features where these interests are not outweighed by your privacy rights); Consent (for non-essential cookies, marketing e-mails, and any other processing that requires consent; you may withdraw consent at any time without affecting the lawfulness of prior processing); Legal Obligations (bookkeeping, export-control and sanctions regulations, court orders, or other legal duties); and Protection of Vital Interests (in rare cases, to prevent serious harm or respond to an emergency).

4. Purposes of Use and Processing

We use personal information for the following business and commercial purposes: Service Delivery and Support (providing and maintaining our AI-driven platform, including website generation, debugging, deployment, and — where enabled — advertising-campaign configuration and optimization); Service Integrity (preventing fraud or unauthorized access); Service Improvement and Research (analyzing prompts, usage data, and generated content to refine algorithms, enhance AI performance, and develop new features, performed on de-identified or aggregated data where feasible); Personalization; Product Updates and Limited Marketing; Business Continuity and Security; Legal and Regulatory Compliance; Auditing, Accounting, and Corporate Governance; and Dispute Resolution and Legal Defense.

5. Data Processing and Sub-Processors

As a data processor, Promake processes personal information on behalf of our customers in accordance with their instructions and applicable DPAs. We engage third-party sub-processors to support our Services, such as: hosting and maintaining our platform, website, and databases; processing payments through secure third-party payment processors; providing technical support, customer service, and analytics; storing and securing data; and, where you use Promake Ads, delivering advertising campaigns through third-party ad platforms (such as Google, Meta, TikTok, and X) on your instructions.

All sub-processors are bound by contractual obligations equivalent to those in our DPAs, ensuring compliance with applicable data protection laws. We provide notice of sub-processor changes, allowing customers ten (10) business days to object. The current list of authorized sub-processors is always available at trust.promake.ai and includes the sub-processor's name, location, and processing purpose.

6. International Data Transfers

For customers in the EEA, UK, or Switzerland, we may transfer personal information to the United States or other jurisdictions whose privacy laws have not been deemed "adequate" by European or Swiss authorities. Promake safeguards these transfers through: the EU–US Data Privacy Framework (DPF), where eligible, including its UK and Swiss Extensions; the EU Standard Contractual Clauses (SCCs), Module 2 (Controller-to-Processor) per Commission Decision 2021/914, incorporated into our DPAs; the UK International Data Transfer Addendum, Version B1.0; and the Swiss Addendum, naming the Swiss FDPIC as the competent authority.

7. Investigations

Promake may investigate and disclose information, as permitted by law, if we believe in good faith that such action is necessary to comply with a valid legal process or governmental request (unless legally prohibited, Promake will notify the affected customer before producing data, consistent with our SCC and DPA obligations); helpful to prevent, investigate, or identify fraud, security incidents, or other wrongdoing; or necessary to protect our rights, reputation, property, or those of our users, affiliates, or the public. Disclosures will comply with applicable privacy laws and be limited to what is necessary.

8. Log Data

When you use our Services, Promake automatically collects operational telemetry ("Log Data") that helps us secure and improve the platform, including your device's IP address and approximate location; browser type and version; pages, APIs, or features you access; timestamps and time spent on specific screens or functions; unique session or device identifiers and error/debugging codes; and other usage statistics. Log Data is retained for up to ninety (90) days, unless required by law, to monitor performance, troubleshoot issues, and improve user experience.

9. Cookies and Other Tracking ("Your Privacy Choices")

Promake and selected third-party partners use cookies, pixels, and similar technologies ("Cookies") to operate, secure, and analyze our Services. We deploy four types of Cookies: Strictly Necessary Cookies (sign-in, session routing, fraud prevention, consent storage — set on the basis of legitimate interests/contract performance, no consent required); Analytics & Performance Cookies (first-party PostHog and third-party Google Analytics and TikTok — consent required in the EEA/UK/CH, and we honor CPRA opt-out signals such as Global Privacy Control in the United States); Functional Cookies (remember your preferences); and Marketing Cookies (conversion tracking via TikTok, Facebook/Meta, and Google Ads — we do not "sell" or "share" Customer Personal Data for cross-context behavioral advertising as defined under applicable privacy laws, and these cookies require consent in the EEA/UK/CH and respect opt-out preferences elsewhere).

You can manage or withdraw your Cookie preferences at any time by clicking the Cookie Preferences button in our Cookie Policy, changing your browser controls, or enabling an authorized browser signal such as the Global Privacy Control. Disabling non-essential Cookies will not affect core functionality but may limit analytics-based improvements. Cookie-derived identifiers are retained only for the period necessary to fulfil the purposes above and never longer than thirteen (13) months for analytics cookies, after which they are deleted or irreversibly anonymized.

10. Information Security and Accuracy

Promake is committed to protecting your personal information and maintaining its accuracy. We implement reasonable industry-standard safeguards, including: Data in Transit (industry-standard end-to-end encryption); Data Storage (database encryption with secure key management and pseudonymization/anonymization where feasible); Access Controls (role-based access, multi-factor authentication, regular reviews); System Resilience (continuous backups with industry-standard recovery objectives); Security Monitoring (real-time monitoring and centralized logging); Physical Security (reputable, certified data-center facilities); Staff & Vendor Oversight (background checks, confidentiality agreements, yearly security training, vetted sub-processors); and Incident Response (a dedicated incident-response process, with notice to affected customers within 72 hours of confirming any notifiable breach).

Promake keeps a record of processing activities in line with GDPR Article 30(2) and performs regular risk assessments to adapt these measures as threats evolve. If you believe your account information is inaccurate, contact us as set out in Section 16 and we will correct it promptly.

11. Retention of Your Information

We retain personal information only as long as necessary to fulfill the purposes outlined in this Policy or as required by applicable law. Personal data that constitutes your live website, store, business content, and account configuration is retained for as long as your account or subscription remains active, so that we can continue providing the Services to you. Certain transient operational data not needed to operate your live Services is retained for no more than ninety (90) days (see Section 8, Log Data).

Once you cancel your account or submit a valid deletion request, we remove your data from active production systems within ninety (90) days and from encrypted backups within three-hundred-sixty-five (365) days, consistent with our Data Processing Agreement, unless a longer period is required by law. To cancel your account or request data deletion, contact us as outlined in Section 16.

12. Links to Other Sites

Our Services may include links or integrations (for example, domain registrars, payment providers, or advertising platforms) that are not controlled by Promake. Your interactions with those third-party services are governed by their own privacy policies and terms. We encourage you to review those policies before providing personal data, as Promake is not responsible for the privacy or security practices of external sites.

13. Notice and Communications

By using the Services, you consent to receive transactional or administrative electronic communications from Promake — such as account alerts, security notifications, and billing messages. You may opt out of non-essential marketing e-mails at any time via the "unsubscribe" link or your account settings; this will not affect core service communications. To send formal privacy notices to Promake, e-mail legal@promake.ai or post to the address in Section 16. Promake may provide legal or privacy notices to you via e-mail, in-product banners, or any other method allowed by law.

14. Governing Law & Venue

This Policy is governed by and construed in accordance with the laws of the State of Delaware, USA, without regard to its conflict-of-law principles, consistent with the Terms of Service. However, if you are located in a jurisdiction that grants you mandatory consumer-protection or data-protection rights under local law, those provisions take precedence to the extent they conflict with this Policy. For residents of the EEA, UK, or Switzerland, international data transfers are subject to the EU Standard Contractual Clauses (governed by Irish law, courts of Dublin), the UK International Data Transfer Addendum (governed by the laws of England and Wales, courts of London), and the Swiss Addendum (Swiss law, FDPIC as competent authority). Any other disputes arising under this Policy shall be exclusively resolved in the state or federal courts located in Wilmington, Delaware, unless otherwise required by applicable mandatory law.

15. No Coding Advice

Our Services provide AI-assisted tools that can generate or suggest code, website configurations, and advertising campaigns, but they are not a substitute for professional judgment. You remain responsible for reviewing, testing, and validating any output produced by the platform, including any Promake Ads campaign configuration. Reliance on generated output is at your own risk. Intellectual-property ownership, license terms, and usage restrictions are detailed in the "Intellectual Property Rights" section of our Terms of Service (promake.ai/terms).

16. Contact Details

If you have questions, concerns, or wish to exercise your privacy rights, please contact us:

• Email: legal@promake.ai
• Mail: Promake Labs Incorporated, 131 Continental Drive, Newark, DE 19713, USA — +1 (986) 786-4206
• Turkey Support & Billing Address: PAI Bilişim Ticaret A.Ş., Atakent Mah. Mithatpaşa Cad. Çağla Plaza No: 116/18, Ümraniye / Istanbul / Turkey
• Privacy Contact: legal@promake.ai

For clarity, PAI Bilişim Ticaret A.Ş. is Promake's Turkey-based affiliate and provides local billing, invoicing, and customer-support functions only. It does not independently determine the purposes or means of processing Customer Personal Data; Customer Personal Data is processed by Promake Labs Incorporated as described in this Policy.

We aim to respond to verified data-subject requests within thirty (30) days, or longer where permitted under applicable law, in which case we will notify you of the delay and reason. If you believe your inquiry has not been satisfactorily resolved, you may lodge a complaint with your local supervisory authority, the Irish Data Protection Commission, the UK Information Commissioner's Office, or the Swiss FDPIC, as appropriate.

17. Residents of the United States, Canada, EEA, United Kingdom, and Switzerland

This section supplements the rest of the Policy and applies to individuals located in the United States — including California, Colorado, Connecticut, Virginia, Utah, Florida, Nebraska, and any other state with an active consumer-privacy statute — as well as Canada, the EEA, the United Kingdom, and Switzerland. Promake collects the personal data categories below when you use the Services: identifiers (name, business e-mail, phone number, user ID, IP address at city-level location only); commercial information (subscription tier and purchase history — full payment-card numbers are processed solely by our PCI-compliant provider and never stored by Promake); internet/network activity (log-in events, feature usage, prompts submitted, content generated, and telemetry, including Promake Ads campaign configuration where applicable); inferences drawn to personalize the platform; and project information you upload.

Sensitive Personal Information is not intentionally collected, and customers are instructed not to upload sensitive data. Depending on where you live, you may have some or all of the rights listed below (subject to legal limits), exercisable by e-mailing legal@promake.ai: Right of Access/Portability; Right of Deletion; Right to Correct; Right to Withdraw Consent; and the right to opt out of the sale, sharing, or targeted advertising of personal information — Promake does not sell or share personal information as defined under U.S. privacy laws. Promake will not discriminate against you for exercising your privacy rights. If you believe a request has been wrongly denied, U.S. residents may file an appeal by replying to our decision within sixty days; EEA, UK, or Swiss residents may contact their supervisory authority.

18. Changes to This Policy

Promake reserves the right to update or revise this Privacy Policy to reflect changes in our practices, legal requirements, or the Services themselves. We will post any revised Policy at promake.ai/privacy and indicate the "Effective" date at the top of the document. For material changes that reduce your rights or expand our processing purposes, we will provide at least thirty (30) days' advance notice by e-mail or in-product banner. Your continued use of the Services after the new Policy takes effect constitutes acceptance of the revised terms.

19. Severability

If any provision of this Policy is found to be unlawful, void, or unenforceable under applicable law, that provision will be interpreted to achieve its intent as closely as possible, or, if impossible, deemed severed, and the remaining provisions will remain in full force and effect.

20. Entire Agreement

This Policy, together with the Terms of Service, any applicable Supplemental Terms, the applicable Data Processing Agreement (DPA), and any supplemental product terms, constitutes the entire agreement between you and Promake regarding privacy and data protection in connection with the Services. In the event of a conflict, the DPA will control with respect to Customer Personal Data, followed by this Privacy Policy, then the Terms of Service.

View our Cookie Policy and opt-out of non-essential cookies here: promake.ai/cookie-policy. View our Data Processing Agreement here: promake.ai/data-processing-agreement.