One-off prompt pack

Privacy

What we collect when you buy a prompt pack, why we need it, who handles it and how long we keep it.

Who we are

What To Prompt is run by Lewis Media Ltd, trading as What To Prompt, a company registered in England and Wales, company number 16880260. Registered office: 82 Surbiton Court, St Andrew’s Square, Surbiton, KT6 4EE. We are the data controller for the information described here.

Lewis Media Ltd is registered with the Information Commissioner’s Office (ICO), registration number ZC275944.

For anything about your information, email support@whattoprompt.ai.

What we collect and why

• Your brief. Your profession and role, the focus you chose, what you tell us about your work and who it is for, the tasks you want help with, and anything else you add. We use it to write your pack. Lawful basis: it is needed for our contract with you, and for the steps you ask us to take before you buy.
• Your email address. We use it to send your pack and to answer you about your order. Lawful basis: contract.
• Your order and payment record. Your order reference, the amount, dates, Stripe’s payment references, the result of the UK card check, the version of the terms you bought under and the time you asked us to start. Lawful basis: contract, and our legal obligation to keep business records.
• Your pack and its delivery record. The pack we wrote, the checks it went through, and when and where it was sent. Lawful basis: contract, and our legitimate interest in answering questions and complaints.
• Your marketing choice. Only if you tick the optional box at checkout. We are not sending marketing emails at the moment. If we start, every email will have an unsubscribe link, and you can withdraw your choice at any time by emailing us. Lawful basis: your consent.
• Security checks. Cloudflare Turnstile checks that a person, not a script, is using our forms. We also keep a scrambled form of your IP address to limit repeated requests, and remove it in our monthly clean-up. Lawful basis: our legitimate interest in keeping the service secure.
• Emails you send us. We use them to help you. Lawful basis: contract, and our legitimate interest in answering you.

Buying a pack does not sign you up to marketing.

Please leave out passwords, card details, sensitive personal information, and names or details that identify your own clients or customers. We do not need them.

How we use AI

We use AI models to turn your answers into a brief, and to write and check your pack. Your email address is not sent to the models. Every request carries settings that restrict it to providers committed to not storing your information and not training on it.

Every pack is checked against your brief by an automatic quality review before it is sent. A pack that does not pass is not sent; a person looks at it instead.

Who handles it

We do not sell your information or share it for advertising. These companies process it for us:

• Cloudflare hosts this site and our database, and runs the security check.
• Stripe takes your payment. Your card and billing details go straight to Stripe, which handles them under its own privacy policy. We never see or store your full card details.
• OpenRouter passes your brief to the AI model providers that write and check your pack.
• Resend sends your pack by email and handles the emails you send to support@whattoprompt.ai.

These companies may process information outside the UK, including in the United States. We rely on the safeguards in their data processing terms for those transfers.

How long we keep it

• Answers you submit but do not confirm: the draft stops working after 30 minutes.
• A confirmed brief you do not pay for, including a checkout you start but do not finish: 30 days. After that, an unfinished checkout leaves only a record with no email address and no brief: its dates, the amount and Stripe’s reference.
• Your brief, your pack and its delivery record: 12 months from the day you buy.
• Your order, payment and refund record: six years from the end of the financial year in which you bought. Our financial year ends on 30 November. This record holds amounts, dates, payment references and the email address you bought with. It does not hold your brief or your pack.
• Emails with support: 12 months after the matter is closed.

We clear out expired information by hand at least once a month, so it can remain for up to six weeks after the periods above. Our database provider also keeps restore points for up to 30 days, so deleted information can stay in backups for that long.

Cookies and browser storage

We do not set our own cookies, and we do not use analytics or advertising trackers.

While you fill in your brief, your answers and a key to your order are kept in this browser tab’s session storage. They are cleared when you close the tab. Cloudflare Turnstile and Stripe’s payment page may use essential storage of their own to run the security check and take your payment.

Your rights

You can ask us for a copy of your information, to correct it, to delete it, or to restrict or object to how we use it. Where we rely on your consent, you can withdraw it at any time. Email support@whattoprompt.ai and we will reply within one month. We may ask you to show that the order’s email address is yours before we act.

If you ask us to delete your information, we delete your brief, your pack and its delivery record, and remove your email address from the order. We keep the order and payment record the law requires, a note of the deletion, and a scrambled form of your email address so that we do not use it again. That address can then no longer be used to buy from us. Stripe and our email provider keep their own records under their own policies.

If you are unhappy with how we handle your information, you can complain to the Information Commissioner’s Office. Read more about your data protection rights.

Changes

We will update this page when anything changes.

Version: guest-privacy-2026-11-12