Effective Date: Jan 23rd 2025
Welcome to BlitzPrompts! We are dedicated to protecting the privacy and security of your personal information. This Privacy Policy provides detailed information on how we collect, use, and share information about you as you interact with our Chrome extension and related services. We aim to be transparent about our data practices and show our commitment to protecting your privacy.
Information We Collect
In order to provide you with a seamless experience on our platform, we collect certain information from you when you register an account and as you use our services. The types of information we gather include:
Why We Collect This Information
The information we collect serves several purposes:
We are committed to handling your personal data with care and in compliance with applicable privacy laws and regulations. By using BlitzPrompts, you acknowledge that you understand and agree to the collection, use, and sharing of your information as described in this Privacy Policy. Please take the time to read through this policy thoroughly to fully understand how we handle your personal information.
1. Definitions and Interpretation
In this Privacy Policy, the following definitions are used to ensure clarity and consistency in the interpretation of terms:
Rules of Interpretation:
2. Legislative and Regulatory Framework
The Provider commits to compliance with all applicable data protection laws, regulations, and standards that govern the collection, use, and retention of personal information. Specifically, the Provider adheres to the following principal legal frameworks:
Additionally, compliance with the following regulatory standards and statutes is ensured:
This Policy shall be governed by and construed in accordance with the substantive laws of the State of California, USA, without regard to its conflicts of law provisions, except as otherwise specifically stated or as applicable to users in jurisdictions which mandate the application of another jurisdiction's laws (such as the GDPR for residents of the European Union).
The Provider reserves the right to modify its practices and this Policy at any time, in accordance with changes to our services and the evolving regulatory framework. Changes to the regulatory framework as set out in this Policy may be made with or without prior notice to you, but any significant changes will be communicated through official channels.
3. Data Collection Modalities
The Provider employs various methods and technologies to collect data from Users of the Services to ensure functionality and enhance user experience. This data is classified into two primary categories:
Account Data:
Nature of Data: This category includes digital identifiers necessary for the creation and security of user accounts. Specifically, it consists of usernames and encrypted tokens used for authentication and session management.
Purpose of Collection: Account Data is collected to establish and maintain a secure and personalized user account for each User. The usernames facilitate user identification and interaction, while encrypted tokens enhance security by enabling secure sessions and interactions without storing passwords directly.
Usage Data:
Nature of Data: Usage Data encompasses a variety of information generated by the User's interactions with the Services. This includes, but is not limited to, prompts that Users create or modify, user-defined settings within the extension, and analytics data derived from session logs.
Purpose of Collection: This data is integral for the operation and optimization of the Services. Saved prompts and settings allow for a customized and efficient user experience, adapting the Services to meet user preferences. Session analytics help the Provider monitor service performance, identify potential areas for improvement, and ensure the stability and security of the extension.
Collection Techniques:
Legal Basis for Collection:
Data Minimization Principles: In adherence to principles of data minimization, the Provider ensures that only the data necessary for the specified purposes is collected, processed, and retained. All personal data is treated with strict confidentiality and security, reflecting the Provider's commitment to protecting user privacy.
4. Legal Grounds for Data Processing
The Provider processes personal data under strict adherence to established legal bases as defined under the General Data Protection Regulation (GDPR) and other applicable data protection laws. The rationale for processing personal data is twofold:
Performance of a Contract (GDPR Article 6(1)(b)):
Applicability: This legal basis is applicable when processing personal data is necessary for the performance of a contract to which the data subject is party, or in order to take steps at the request of the data subject prior to entering into a contract.
Implementation: In the context of our Services, processing under this legal ground includes, but is not limited to, using Account Data to register and maintain user accounts, enabling users to access and utilize the Services as per the terms agreed upon at the time of account creation.
Legitimate Interests (GDPR Article 6(1)(f)):
Applicability: This basis permits processing based on the legitimate interests pursued by the Provider or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data.
Balancing Test: In asserting this basis, the Provider has conducted a balancing test to ensure that our legitimate business interests, such as improving and personalizing the Services, enhancing security, and conducting marketing activities, do not disproportionately impact the rights and freedoms of the data subjects. Documentation of this balancing test is maintained as part of our compliance records and is available for review by regulatory authorities upon request.
Additional Legal Bases:
Transparency and Data Subject Rights: The Provider ensures transparency in its data processing activities. Data subjects are informed of the specific legal basis for processing their data at the point of collection. Furthermore, data subjects are afforded various rights under the GDPR, including the right to access, correct, delete, or restrict processing of their personal data, the right to object to processing, and the right to data portability.
Review and Adjustment of Legal Bases: The Provider regularly reviews the legal bases for processing personal data to ensure that they remain appropriate and valid. Adjustments may be made in response to changes in our business practices, user feedback, or regulatory changes.
5. Specific Purposes for Processing Personal Data
The Provider collects and processes personal data strictly for predefined and legitimate purposes which are essential for delivering our Services efficiently and securely. These purposes are elaborated below, along with their corresponding legal bases:
Provision of Tailored Services (Legal Basis: Performance of a Contract, GDPR Article 6(1)(b)):
Purpose: To register user accounts, maintain user settings, and facilitate the customization of the user experience according to individual preferences. This includes processing Account Data to authenticate users and Usage Data to remember user-specific settings and preferences.
Operational Necessity: Ensuring that each user can personalize and use the Services in a manner that is most effective and convenient for them.
Enhancing User Interface (Legal Basis: Legitimate Interests, GDPR Article 6(1)(f)):
Purpose: To continuously improve the design and functionality of our Services, making them more user-friendly and responsive to user needs. This involves analyzing Usage Data to understand how users interact with our Services and implementing changes that enhance usability and accessibility.
Balancing Test: The Provider has conducted a balancing test to ensure that these activities do not infringe on the rights and freedoms of the data subjects, concluding that the enhancements serve to improve user satisfaction and overall service quality without compromising privacy.
Ensuring Network Security (Legal Basis: Legal Obligation, GDPR Article 6(1)(c) and Legitimate Interests, GDPR Article 6(1)(f)):
Purpose: To protect the data and privacy of our users as well as the integrity of our Services. This includes monitoring for and preventing unauthorized access, data breaches, and other cyber threats.
Operational Necessity: Implementing security measures such as data encryption, secure server configuration, and intrusion detection to safeguard personal and sensitive information against loss, theft, misuse, and unauthorized access.
Compliance with Legal, Regulatory, and Policy Requirements (Legal Basis: Compliance with a Legal Obligation, GDPR Article 6(1)(c)):
Purpose: To fulfill our legal duties under applicable laws, regulations, and international standards. This includes processing personal data to comply with tax laws, anti-fraud regulations, and other legal obligations.
Operational Necessity: Ensuring that our business operations are in full compliance with legal statutes and regulations to maintain our licensure and authority to operate.
Research and Development (Legal Basis: Legitimate Interests, GDPR Article 6(1)(f)):
Purpose: To conduct research and analysis to develop new features, products, and services that meet the evolving needs of our users.
Balancing Test: The Provider assesses the impact on the rights and privacy of individuals against the benefits of innovation and service improvements, ensuring that personal data is processed in a manner that respects individual rights.
Transparency and Informing Users: The Provider is committed to transparency in its data processing activities. Prior to collecting and using personal data, users are informed of these specific purposes, and where necessary, consent is obtained. Users are also provided with the option to opt-out or restrict certain types of processing, especially in cases where data is processed based on legitimate interests.
6. Conditional Disclosure of Data
The Provider takes the privacy and security of user data seriously and adheres to strict guidelines when disclosing data to third parties. Disclosure occurs only under the following conditions and in accordance with applicable data protection laws:
To Service Providers (Legal Basis: Performance of a Contract, GDPR Article 6(1)(b)):
Purpose: Data may be shared with service providers who perform services on our behalf, such as data hosting, customer service, and analytics services. These providers are contractually obligated to protect the data and use it only to provide the services for which they are engaged.
Safeguards: We ensure that all service providers are subject to confidentiality agreements and adhere to our data protection standards and procedures. Service providers are carefully selected and reviewed periodically to ensure compliance with our data security and privacy policies.
To Legal Authorities (Legal Basis: Compliance with Legal Obligations, GDPR Article 6(1)(c)):
Purpose: Data may be disclosed to legal authorities, such as law enforcement agencies, regulatory bodies, or courts, when required by law, such as in response to a subpoena, court order, or other legal process.
Conditions: Such disclosure will only be made when legally compelled and strictly necessary to comply with our legal obligations. The Provider evaluates each request to ensure that it complies with applicable law before any personal data is released.
In Event of Business Transfers (Legal Basis: Legitimate Interests, GDPR Article 6(1)(f)):
Purpose: In the event of a merger, acquisition, restructuring, bankruptcy, or other corporate reorganization, data may be transferred as part of that transaction.
Safeguards: We will ensure that the new entity is contractually obliged to follow this Privacy Policy with respect to your personal data; notifications will be sent to all affected users if the new entity intends to handle your data contrary to this policy.
For Legal Defense and Security (Legal Basis: Legitimate Interests, GDPR Article 6(1)(f)):
Purpose: Data may be disclosed if necessary to protect the rights, property, or safety of the Provider, our users, or others, including to prevent fraud or other illegal activities and to defend ourselves against third-party claims.
Conditions: Disclosures for these purposes are considered and made on a case-by-case basis, ensuring they are justified by a clear and present need to protect legal rights or ensure the safety of individuals.
Transparency in Disclosure: The Provider commits to maintaining transparency with users regarding the circumstances under which their data may be shared. Users are informed through this Privacy Policy and direct communication when applicable.
Review and Limitation: All data disclosures are subject to a rigorous review process to ensure that any data shared is strictly necessary for the purpose specified. The amount of data disclosed is limited to what is strictly necessary to fulfill the purpose of the disclosure.
7. Transborder Data Flow
The Provider recognizes the global nature of its operations and the need for the efficient transfer of personal data across international borders to maintain the efficacy of its Services. The international transfer of personal data is conducted in strict compliance with applicable data protection laws and regulations, specifically under the framework provided by the General Data Protection Regulation (GDPR):
Compliance with Adequacy Decisions (GDPR Article 45):
Purpose: Personal data may be transferred to countries that have been formally recognized by the European Commission as providing an adequate level of data protection comparable to that offered within the EU.
Implementation: The Provider ensures that data transfers to these countries occur seamlessly, relying on the European Commission's adequacy decisions, which eliminate the need for any further safeguards.
Implementation of Suitable Safeguards (GDPR Article 46):
Purpose: In the absence of an adequacy decision, the Provider implements appropriate safeguards to protect the personal data transferred across borders. This includes transferring personal data to countries or entities that have not been assessed as adequate by the European Commission.
Safeguards: These may include the use of binding corporate rules approved by competent supervisory authorities, standard contractual clauses issued or approved by the European Commission, certification mechanisms, codes of conduct approved by supervisory authorities, or contractual commitments that ensure the protection of personal data to EU standards.
Derogations for Specific Situations (GDPR Article 49):
Purpose: In limited and exceptional cases, personal data may be transferred to countries without adequacy decisions or suitable safeguards if one of the specific derogations under GDPR Article 49 applies. These situations include explicit consent by the data subject, transfer necessary for the performance of a contract, or for important reasons of public interest.
Conditions: The Provider only resorts to these derogations in circumstances where no other legal basis for the transfer is applicable, ensuring that such transfers are legally permissible and necessary under specific conditions outlined by the GDPR.
Transparency and Data Subject Rights: The Provider ensures transparency in its practices of transborder data flows. Data subjects are informed about the transfer of their data to third countries, the legal bases for such transfers, and the safeguards implemented to protect their data. Data subjects retain the right to obtain a copy of the safeguards put in place by contacting the designated data protection officer.
Regular Review and Compliance Monitoring: The Provider conducts regular reviews of its data transfer practices to ensure ongoing compliance with GDPR and other relevant data protection laws. Adjustments are made in response to changes in law, guidance from regulatory bodies, or operational requirements of the Services.
8. Data Protection Measures
The Provider is committed to ensuring the security and integrity of personal data through the implementation of comprehensive administrative, technical, and physical security measures designed to protect personal data against loss, misuse, unauthorized access, disclosure, alteration, and destruction. The following are key components of our data protection strategy:
Administrative Measures:
Data Access Controls: Access to personal data is strictly limited to personnel who need access to perform their job functions. Access controls are enforced through role-based permissions and authentication protocols.
Training and Awareness: All employees and contractors are required to complete privacy and security training upon hire and at regular intervals thereafter to ensure they understand how to handle personal data securely.
Data Protection Policies: Internal policies and procedures are regularly reviewed and updated to reflect current best practices and legal requirements for data protection.
Technical Measures:
Data Encryption: Personal data is encrypted during transmission and while at rest using industry-standard encryption technologies to prevent unauthorized access.
Secure Software Development: The Provider adopts secure coding practices and regularly updates and patches software to protect against vulnerabilities.
Intrusion Detection and Prevention Systems: Advanced monitoring systems are deployed to detect and respond to potential security incidents in real time.
Physical Measures:
Secure Facilities: Physical access to facilities where personal data is stored is secured with access controls, surveillance monitoring, and security personnel to prevent unauthorized access.
Data Disposal: Physical and electronic records containing personal data are securely destroyed in accordance with legal and regulatory requirements when no longer needed.
Regular Security Assessments:
Risk Assessments: Regular security risk assessments are conducted to identify and mitigate potential threats to the confidentiality, integrity, and availability of personal data.
Penetration Testing: Periodic penetration tests are performed by independent security experts to assess the effectiveness of our security measures.
Incident Response Plan:
Rapid Response: The Provider has established an incident response plan to quickly address and mitigate the effects of a data breach or other security incident.
Notification Procedures: In the event of a data breach, affected individuals and relevant authorities will be notified in accordance with applicable legal requirements.
Compliance with Best Practices and Standards: The Provider commits to following internationally recognized best practices and standards for data security, including but not limited to ISO/IEC 27001, and remains compliant with all relevant data protection laws and regulations.
9. Criteria for Data Retention
The Provider adheres to a strict data retention policy to ensure that personal data is not kept longer than necessary for the purposes for which it is processed, in line with the legal, regulatory, and operational requirements. The following criteria are used to determine the retention periods for different types of data:
Regular Review of Data Retention Policies:
Deletion Procedures:
Transparency with Users:
10. Protection of Minors
Policy Statement: BlitzPrompts is committed to protecting the privacy of young individuals. Consistent with this commitment, the Services offered by BlitzPrompts are not designed for, targeted at, or intended to be used by individuals under the age of sixteen (16).
Data Collection Restrictions:
Parental Notice and Consent:
Educational and Awareness Efforts:
Compliance with Laws:
Reporting and Addressing Violations:
Transparency and Responsibility:
11. Statutory Rights of Data Subjects
BlitzPrompts recognizes and upholds the statutory rights afforded to data subjects under the General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), and other relevant data protection legislation. These rights are fundamental to our commitment to data privacy and transparency. Below, we detail each of these rights and the means by which data subjects may exercise them:
Exercising Your Rights: BlitzPrompts provides easily accessible methods for data subjects to exercise these rights:
Right to Lodge a Complaint with a Supervisory Authority: If data subjects believe that BlitzPrompts has not complied with the requirements of the GDPR or other applicable data protection laws regarding their personal data, they have the right to lodge a complaint with a supervisory authority, particularly in the Member State of their habitual residence, place of work, or place of the alleged infringement.
12. Withdrawal of Consent
BlitzPrompts acknowledges the right of data subjects to withdraw their consent at any time. This clause outlines the procedures and legal implications associated with the withdrawal of consent under applicable data protection laws, such as the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA).
Right to Withdraw Consent:
General Principle: Data subjects have the right to withdraw their consent for the processing of their personal data at any time. This right ensures that individuals retain control over their personal information, even after they have initially agreed to the processing.
Exercise of Right: Withdrawal of consent can be executed by notifying BlitzPrompts through designated communication channels, such as a dedicated section on our website, via email, or through any other means specifically provided for this purpose.
Procedure for Withdrawal:
Immediate Effect: Upon receipt of a notice of withdrawal, BlitzPrompts will cease the processing of the data subject's personal data for the purposes for which consent was originally granted, unless there is another legal ground for the processing under applicable law, such as contractual necessity or compliance with a legal obligation.
Acknowledgment of Withdrawal: BlitzPrompts will acknowledge the receipt of the withdrawal request and inform the data subject of the cessation of processing or any continuing actions based on other legal grounds.
Implications of Withdrawal:
Non-Affecting Lawfulness of Previous Processing: The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal. Any processing carried out prior to the withdrawal remains valid and lawful.
No Detrimental Effects: The withdrawal of consent shall not affect any contractual obligations to which the data subject is party, nor shall it result in any negative consequences or penalties for the data subject.
Communication and Transparency:
Clear Instructions: BlitzPrompts ensures that the procedure for withdrawing consent is as easy as the procedure to give consent. Clear and simple instructions on how to withdraw consent are provided at the time of data collection and are accessible at all times on the BlitzPrompts website.
Ongoing Communication: Data subjects are regularly reminded of their right to withdraw their consent through periodic communications and updates to our privacy practices.
Handling of Withdrawn Consent:
Data Handling Post-Withdrawal: In cases where BlitzPrompts relies solely on consent for the processing of personal data, and such consent is withdrawn, the respective data will be deleted or anonymized, unless the retention of the data is required or permitted by law.
Record of Withdrawals: BlitzPrompts maintains a record of consent withdrawals to ensure compliance with data subject requests and to document our adherence to data protection laws.
Further Assistance: For further information or assistance regarding the process of withdrawing consent, data subjects may contact our Data Protection Officer (DPO) through the contact information provided on our website.
13. Modifications to the Policy
BlitzPrompts reserves the right to update or amend this Privacy Policy at any time to reflect changes in our practices, service offerings, legal or regulatory requirements. The following outlines the process for making such amendments and how they will be communicated to users:
Notification of Amendments:
Method of Communication: Any amendments to this Privacy Policy will be communicated through official channels, which may include email notifications to users, announcements on our website, or through our service platforms.
Accessibility: The updated policy will be made available on the BlitzPrompts website with the changes clearly highlighted, enabling users to easily review the amendments.
Effective Date and Implementation:
Immediate Effect: Amendments to this policy will take effect immediately upon their posting on the website unless a later effective date is specified. In cases where changes have a significant impact on the treatment of user data, we will provide a more prominent notice, including, if necessary, email notification with sufficient lead time for users to review the changes before they become effective.
Grace Period: When feasible, a grace period may be provided where users can review the changes and adjust their interactions with the services accordingly.
User Consent:
Implicit Consent: By continuing to use the BlitzPrompts services after amendments are made, users implicitly agree to be bound by the revised policy. If the changes are substantial, explicit consent may be required from users to continue using the services.
Opt-Out Options: If a user does not consent to the revised policy, they will be provided with the option to delete their account or cease using the services.
Archival of Previous Versions:
Documentation: BlitzPrompts will maintain an archive of previous versions of the Privacy Policy for users to access upon request. This archive will help users understand how their personal data has been handled over time and clarify the evolution of our data protection practices.
Legal Compliance and Consultation:
Regulatory Review: Before the implementation of any significant changes, the proposed amendments will undergo a review to ensure compliance with applicable data protection laws and regulations.
Stakeholder Consultation: Significant changes to the policy may also be subject to a consultation period during which stakeholders, including users, can provide feedback on the proposed changes. This feedback will be considered prior to finalizing the amendments.
Responsibilities and Inquiries:
14. Legal Recourse and Remedies
BlitzPrompts is committed to the lawful and fair handling of all personal data and upholds the rights of data subjects to seek recourse should they feel their data protection rights have been infringed. The following outlines the remedies available and the process for pursuing such remedies:
Right to Lodge a Complaint:
Supervisory Authority: Data subjects who believe that their personal data has not been processed in accordance with applicable data protection laws, including the General Data Protection Regulation (GDPR), have the right to lodge a complaint with a supervisory authority. This right is specifically protected under GDPR Article 77.
Competent Authority: The complaint should be submitted to the supervisory authority in the member state of the data subject's habitual residence, place of work, or place of the alleged infringement. This ensures that the complaint is handled by an authority familiar with the jurisdictional context of the data subject.
Process for Lodging a Complaint:
Documentation: Data subjects should provide detailed information about their concerns and any evidence of the alleged non-compliance by BlitzPrompts. This documentation helps the supervisory authority to conduct a thorough investigation.
Assistance from BlitzPrompts: Although data subjects have the right to approach the supervisory authority directly, BlitzPrompts encourages data subjects to first reach out to our Data Protection Officer (DPO) to discuss any concerns. Our DPO is committed to addressing and resolving complaints amicably and efficiently.
Contact Information: The contact details for our DPO are readily available on our website, and our team is prepared to provide assistance with navigating the complaint process.
Legal Remedies Beyond Supervisory Authorities:
Judicial Remedies: Under GDPR Article 78, data subjects have the right to an effective judicial remedy against a legally binding decision of a supervisory authority concerning them. Additionally, data subjects have the right to an effective judicial remedy if the competent supervisory authority does not handle a complaint or does not inform the data subject within three months on the progress or outcome of the complaint lodged pursuant to Article 77.
Representation: Data subjects may choose to be represented by a body, organization, or association which has been properly constituted according to the law of a Member State, has statutory objectives which are in the public interest, and is active in the field of the protection of data subjects' rights and freedoms with regard to the protection of personal data.
Transparency and Follow-Up:
Updates on Proceedings: BlitzPrompts will keep the data subject informed about the progress of their complaint and any subsequent actions taken by the supervisory authority.
Public Reporting: Where applicable, BlitzPrompts will publicly report on the outcomes of significant data protection disputes and the measures taken to rectify any issues, while respecting the confidentiality of the data subjects involved.
15. Contact and Communication
BlitzPrompts is committed to maintaining open lines of communication with our users regarding our privacy practices. We provide a structured approach to handling queries and concerns related to the handling of personal data:
Designated Data Protection Officer:
Role and Responsibilities: BlitzPrompts has appointed a Data Protection Officer (DPO) who is responsible for overseeing data protection strategies and ensuring compliance with data protection laws. The DPO serves as a point of contact for data subjects concerning all issues related to the processing of their personal data and the exercise of their rights under the GDPR and other applicable privacy laws.
Availability: The DPO is available during regular business hours to address any questions or concerns regarding our privacy practices. The DPO is committed to providing timely, clear, and effective communication to ensure that data subjects understand how their personal data is being handled.
Contact Information:
Email Communication: Data subjects can reach out to our DPO at [email protected]. This email is monitored regularly, and we ensure that all inquiries are addressed promptly.
Mailing Address: For those who prefer or require formal written communication, correspondence can also be sent to our mailing address, which is provided on our website under the 'Contact Us' section.
Alternative Contact Methods: Data subjects may also contact BlitzPrompts through any other contact methods listed on our website, such as a contact form or via direct phone call, if available.
Processing Queries and Complaints:
Acknowledgment of Receipt: All queries and complaints are acknowledged upon receipt, and data subjects are informed of the estimated time frame for a detailed response.
Investigation and Response: The DPO will investigate each query or complaint thoroughly and provide a detailed response that addresses the concerns raised. The DPO will also offer guidance on additional steps the data subject can take if they are not satisfied with the response.
Transparency and Documentation:
Record-Keeping: BlitzPrompts maintains records of all communications with data subjects to ensure a transparent audit trail and to improve our privacy practices continually.
Feedback and Improvement: Feedback received from data subjects is taken seriously and used to improve our privacy practices. The DPO reviews and considers feedback in regular privacy audits and compliance reviews.
16. Governing Law
This Privacy Policy and any disputes related thereto are governed by and construed in accordance with the substantive laws of the State of California, United States of America, without regard to its conflict of law principles. This choice of governing law ensures a consistent legal framework that guides both the interpretation and enforcement of this policy:
17. Jurisdiction
Any legal disputes or claims arising under or in connection with this Privacy Policy, including disputes relating to its validity, interpretation, or enforceability, shall be subject to the exclusive jurisdiction of the competent courts located in San Diego County, California:
Implications for Data Subjects: