Privacy Policy
What GPTPro collects, why, who it is shared with, and how long it is kept.
1. Who is responsible
1.1 The controller of the personal data processed through https://www.gptpro.ai is GPT Pro Limited (C 114704), .
1.2 Any question about this policy, and any request to exercise a right, can be sent to [email protected].
2. Scope
2.1 This policy covers the data processed when a visitor browses https://www.gptpro.ai, creates an account, uses the GPTPro assistant and its generation workspaces, pays for a subscription or credits, or contacts support.
2.2 It applies under Regulation (EU) 2016/679 (GDPR) and the Maltese Data Protection Act, together with the local law of the user's country of residence where that law affords additional protection.
3. What is collected
- Account data
- Email address, display name, profile picture where one is set, a hashed password or the identifier of the social account used to sign in, language, and the preferences held in the account settings.
- Content
- The prompts submitted, the files and images attached to them, the responses returned, the generated images, clips, audio and code, the titles and history of conversations, favourites, and the personal context a user chooses to save so the assistant can reuse it.
- Usage data
- For each generation: the workspace used, the model called, the volume processed, the resulting cost and the credits debited. Also the rate-limit counters, and the number of free messages already served.
- Billing data
- Subscription and credit purchases, their amounts, dates and status, and the invoices issued, which carry the buyer's name and address. Card details are entered directly with the payment provider and are never received by GPTPro.
- Support data
- The content of messages sent through the contact form or by email, and of feature requests posted on the public board.
- Technical data
- IP address, user agent, timestamps, application logs and error reports, and the anti-abuse signals produced when an account is created.
4. Prompts, generated content, and what leaves the service
4.1 A prompt and its attachments are transmitted to the artificial-intelligence provider that answers it, through the inference gateway GPTPro uses. That transmission is what produces the answer; it is not optional, and it is limited to what the request needs.
4.2 Prompts may contain whatever a user chooses to type. Do not submit another person's personal data without a lawful basis for doing so, and do not submit special-category data — health, beliefs, political opinions, sexual orientation, biometric or genetic data — or payment card numbers.
4.3 Conversations, generated media and saved context remain in the account until the user deletes them, or deletes the account. Attachments and generated media are stored as private objects in European object storage and are readable only by the account that produced them.
4.4 A conversation for which a share link has been created can be read by anyone holding that link, without an account. The link is the only access control; revoking it from the account ends that access.
5. Why it is processed, and on what basis
| Purpose | Legal basis |
|---|---|
| Creating and maintaining the account; authenticating the user | Performance of the contract |
| Running the assistant and the generation workspaces, including transmitting prompts to the model provider | Performance of the contract |
| Storing conversations, generated media and saved context so they can be found again | Performance of the contract |
| Metering credits, enforcing allowances and rate limits | Performance of the contract |
| Taking payment, issuing invoices, keeping accounting records | Performance of the contract; legal obligation |
| Preventing fraud, abuse and payment disputes | Legitimate interest in protecting the service |
| Answering support requests | Performance of the contract; legitimate interest |
| Measuring audience and improving the service | Legitimate interest |
| Sending service and contractual emails | Performance of the contract |
| Responding to a request from a competent authority | Legal obligation |
5.1 No decision producing legal effects for a user is taken solely by automated means. Automated checks may flag an account for review; a suspension or closure under the Terms is decided by a person.
6. Training of AI models
6.1 GPTPro does not use prompts, attachments or generated content to train artificial-intelligence models, and does not sell them or make them available for anyone else to train on.
6.2 GPTPro trains no model of its own. Requests are routed to third-party providers, whose own terms govern what they do with a request they receive; GPTPro selects providers on terms that exclude training on customer content, and updates the list below when a provider changes.
7. Who else processes the data
7.1 Personal data is never sold or rented. It is shared only with the providers below, each bound by a data-processing agreement, and with a public authority where the law requires it.
| Provider | Role | Data concerned |
|---|---|---|
| OVHcloud (OVH SAS) | Hosting of the application, the database and the object storage, in the European Union | All data held by the service |
| OpenRouter, Inc. | Inference gateway routing each request to a model provider | Prompts, attachments and the resulting outputs |
| Model providers reached through that gateway (including Google and OpenAI) | Producing the response to a request | The prompt of the request they answer, and its attachments |
| Stripe Payments Europe, Ltd. | Payment, card storage, subscription management and fraud prevention | Billing identity, payment method, transactions |
| Cloudflare, Inc. | Content delivery, protection against attacks, and the anti-bot check on sign-up | IP address, request metadata |
| Resend, Inc. | Sending transactional email | Email address and message content |
| Google Ireland, Ltd. | Audience measurement and tag management | Browsing data and cookie identifiers |
| Chargeblast, Inc. | Early warning of payment disputes | Transaction identifiers |
8. Transfers outside the EEA
8.1 The application, the database and stored media are hosted in the European Union.
8.2 Some providers listed above, in particular the inference gateway and the model providers it routes to, process data outside the European Economic Area. Those transfers are covered by the European Commission's Standard Contractual Clauses, together with the technical and organisational measures needed to make them effective, and — where the provider is certified — by the EU–US Data Privacy Framework.
9. How long it is kept
| Category | Retention |
|---|---|
| Account data | For as long as the account exists |
| Conversations, generated media, saved context | Until deleted by the user, or until the account is deleted |
| Usage and credit ledger | For as long as the account exists, then anonymised |
| Invoices and accounting records | 10 years, as required by accounting and tax law |
| Payment-dispute evidence | Until the dispute window has closed, then redacted |
| Application logs and technical data | 12 months |
| Support correspondence | 3 years from the last exchange |
| Audience-measurement cookies | 13 months at most |
9.1 Deleting the account removes the account and the content attached to it. Records that the law requires GPTPro to keep — invoices above all — are retained for their statutory period; where they name the customer, the law is what prevents them being anonymised. Everything outside that set is deleted or irreversibly anonymised.
10. Security
10.1 Traffic is encrypted in transit. Passwords are stored hashed, never in clear. Stored media are private objects, reachable only through the account that owns them; a request for one is authorised against the caller before any byte is read.
10.2 Access to production systems is restricted to the staff who need it, over a private network, and is logged.
10.3 No system is perfectly secure. Where a breach is likely to result in a high risk to users' rights, the affected users and the supervisory authority are notified within the periods the GDPR prescribes.
11. Cookies and similar technologies
11.1 The Site uses:
- strictly necessary cookies — the session, the language, the anti-bot check and the security protections, without which the service cannot work;
- audience-measurement cookies (Google Analytics, deployed through Google Tag Manager) that measure how the Site is used, in aggregate;
- an attribution cookie recording how a visitor reached the Site, used to measure advertising.
11.2 Measurement and attribution cookies can be refused through the browser's settings, or through Google's own opt-out add-on. Refusing strictly necessary cookies prevents the service from working.
12. Rights of the data subject
12.1 Every user has the right of access, rectification, erasure, restriction, objection, and portability, and the right to withdraw a consent already given, without that affecting what was done beforehand.
12.2 Several of these can be exercised directly: conversations and generated media can be deleted individually from the account, and the account itself can be deleted from the account settings.
12.3 Any other request can be sent to [email protected]. It is answered within one month, extendable by two months where the request is complex. Proof of identity may be requested where there is genuine doubt about who is asking.
12.4 A user who considers their rights have not been respected may complain to the Office of the Information and Data Protection Commissioner in Malta, or to the supervisory authority of their own country of residence.
13. Minors
13.1 The Services are not intended for persons under eighteen (18), and no account may be created by one. An account discovered to belong to a minor is closed and its data deleted.
14. Changes to this policy
14.1 This policy may be updated. The version that applies is the one published on the Site at the time of consultation; a material change is notified by email or in the account.
How Google uses your data
When you accept advertising and measurement cookies, Google processes your personal data as an independent controller for its own purposes. Google explains those uses, and the choices you have, here: How Google uses data from sites or apps that use its services