Privacy Policy
Last updated: 4 October 2026
1. Who we are
Prompten ("we", "us") operates the website at www.prompten.xyz, a free self-paced course in prompt engineering.
- Data controller: Daniels Bloom
- Contact for privacy matters: privacy@prompten.xyz
- Location: Nigeria
If you have a question about this policy or about your data, email the address above. We aim to respond within 30 days.
2. What we collect, and why
We collect only what the course needs to work. We do not sell data, we do not run advertising, and we do not use third-party trackers.
When you create an account
As you use the course
When you earn a certificate
If you leave a review
3. Certificates are publicly verifiable — please read this
Every certificate has a verification page at www.prompten.xyz/verify/<credential-ID>.
Anyone who has that link can see the name on the certificate, the score, the grade, and the issue date. That is the purpose of the page — it lets an employer confirm a certificate is real.
- Your email address is never shown on the verification page.
- Verification pages are marked
noindex, so search engines are instructed not to list them. - The link is not secret. If you share it — for example on LinkedIn — anyone with the link can view it.
If you would prefer your certificate not to be publicly verifiable, email privacy@prompten.xyz and we will remove it.
Reviews you choose to publish
Leaving a review is optional and never required for your certificate. If we approve one, it appears on the home page, which is public and indexed by search engines, under the name format you chose when you submitted it: your first name and last initial, or your full name. There is no anonymous option, because an unattributed review on our own home page would be indistinguishable from one we made up.
You can withdraw or change your review at any time from your profile page, or by emailing privacy@prompten.xyz. A changed review comes down until we approve it again. A withdrawn review is removed from the site within 7 days; search engines may keep a copy for a while after that.
4. Our lawful basis for processing
Under section 25 of the NDPA, we rely on:
- Contract — for your account, progress and certificate. We cannot provide the course without this data.
- Consent — for optional profile fields, for publishing a review you submit, and for any future emails. You may withdraw consent at any time.
5. Where your data is stored, and cross-border transfer
Our database and authentication are provided by Supabase, and the site is hosted by Vercel. Both are outside Nigeria; our database is located in West EU (Ireland), AWS region eu-west-1.
This means your personal data is transferred outside Nigeria. Under sections 41–43 of the NDPA we rely on the contractual protections in our agreements with these providers, which require them to protect your data to a standard comparable to the NDPA.
6. Cookies and local storage
We do not use cookies for tracking or advertising.
To keep you signed in, we store an authentication token in your browser's local storage. This is strictly necessary for the site to function — without it you would be signed out on every page. It contains no advertising or tracking identifiers, and it is removed when you sign out.
We use no analytics cookies, no advertising cookies, and no third-party trackers.
7. How long we keep it
- Account, profile and progress — until you delete your account.
- Certificates — for as long as your account exists, unless you ask us to remove yours sooner.
- Reviews — until you withdraw them or delete your account.
When you ask us to delete your account, we delete your profile, progress, certificate and any review. Your certificate's verification link stops working at that point, so if you've shared it — on a CV or LinkedIn, for example — save a copy of the certificate before you ask.
Until 4 October 2026 we also kept a record of when each person registered and finished the course, with their name and email. We no longer collect it, and we have deleted it from our database.
8. Your rights
Under the NDPA you have the right to:
- Access the personal data we hold about you
- Correct anything inaccurate
- Delete your data ("right to erasure")
- Restrict or object to processing
- Portability — receive your data in a usable format
- Withdraw consent at any time, where we rely on consent
- Not be subject to solely automated decisions with legal or similarly significant effects. We make none.
To exercise any of these, email privacy@prompten.xyz. We will respond within 30 days and will not charge you.
If you are unhappy with how we handle your data, you may complain to the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng.
9. If you are in the UK or EU
If you access the course from the UK or EU, the UK GDPR or EU GDPR may also apply. The rights in section 8 are substantially the same, and you may complain to your national supervisory authority as well as, or instead of, the NDPC.
10. Security
We protect your data with:
- Encrypted connections (HTTPS) throughout
- Row-level access controls, so one account cannot read another's data
- Passwords hashed by our authentication provider — we never store or see them
- Server-side issuing of certificates, so they cannot be fabricated by a browser
No system is perfectly secure. If we discover a personal data breach we will report it to the NDPC within 72 hours of becoming aware of it, and will notify you directly where the risk to you is high, as required by the GAID.
11. Children
This course is intended for adults. You must be 18 or older to create an account.
Under the NDPA, processing a child's data requires verifiable parental consent, which we are not set up to obtain. If you believe someone under 18 has created an account, email privacy@prompten.xyz and we will delete it.
12. Changes to this policy
If we change this policy we will update the date at the top. If the change materially affects your rights we will tell you by email before it takes effect.