Data Handling
This page describes what PrompTick stores, where it stores it, which third parties receive it, and the retention behavior implemented in the platform today.
What we store
| Data | Notes |
|---|---|
| Account identity | Email, display name, and auth provider. Created on first sign-in. |
| Organizations and members | Org name, member list, roles, status, join timestamps. |
| Projects, prompts, prompt versions | Your prompt content, model settings, variables, and version history. |
| Test sets and test run results | Inputs, expected outputs, per-row scores, latency, and token usage. |
| Agent definitions | Pinned prompt version, required variables, and API settings. |
| Agent and MCP API keys | Hashed before storage. Only the hash, prefix, and name are kept. The full key is shown once and cannot be recovered afterwards. |
| Execution / job progress | Short-lived tracking records for in-flight and recently completed executions. |
| Uploaded files (when an agent accepts files) | File binary plus metadata, used to serve the agent's requests. |
| Subscription and billing state | Plan, seat count, usage counters. Payment card data is held by the payment processor, not us. |
| Queue state (running jobs, retries) | Transient, drained as jobs complete. Not a system of record. |
Where it lives
- Primary data store and application runtime — Google Cloud, europe-west1 region.
- File storage — Google Cloud, same EU region.
- Job queue — A dedicated server operated by Pragee Technologies LLP in the EU. Holds only transient job state; not used for permanent records.
- Secrets — A dedicated secrets store, EU region.
Third-party processors
When you use PrompTick, these third parties can receive data as part of fulfilling your request:
| Processor | Data they receive | Purpose |
|---|---|---|
| Google Cloud | All application data above | Hosting, database, and storage. |
| AI model providers (the provider serving the selected model) | The prompt content and variables you send for inference | Language model inference. Which provider receives a given request depends on the model you pick; the current list is available on request and is also reflected on your invoices and usage breakdowns. |
| Resend | Recipient email address, OTP code, or transactional email content | Sending sign-in codes and notifications. |
| Sentry | Error messages, stack traces, a user ID for context | Error monitoring and debugging. |
| Mixpanel | Product events and a user ID | Product analytics. |
| Payment processor (as shown at checkout) | Name, billing address, card details you enter directly at checkout | Payment processing. Card numbers are not sent to or stored by PrompTick. |
Prompts and inputs are sent to the AI provider that serves the selected model. Do not send regulated data (PHI, cardholder data, government IDs, etc.) through prompts unless you have confirmed that both your provider agreements and your use case permit it.
Retention
The following retention behavior is implemented in the platform today:
- Job progress records — transient tracking for in-flight and recently completed executions:
- Archived (soft-deleted) 30 days after completion or failure.
- Hard-deleted 90 days after creation.
- Stuck
runningjobs are archived after 7 days. - This cleanup runs daily and only touches progress tracking. It does not delete your permanent records: prompts, prompt versions, agents, test runs, or agent execution results.
- Uploaded files marked as temporary (files attached to one-off runs rather than saved to your library) are hard-deleted from storage once their expiry passes. Cleanup runs on a short interval.
- Permanent records — prompts, agents, saved test sets, and agent execution results — are retained until you delete them or close your account.
There is no automatic N-day purge of permanent records beyond the above. If you need stricter retention for compliance reasons, contact us.
Deletion
- Individual items: delete a prompt, agent, project, or organization from the UI; this removes it from storage.
- Account deletion: contact support to request full account deletion. Operational backups may retain data for a short period after deletion per standard industry practice.
Opt-outs
- Sentry and Mixpanel are used on first-party surfaces to operate the product. If you need a deployment without product analytics (e.g. for regulated use cases), that is part of the enterprise conversation — see Compliance.