1. Controller and scope

Metaspectrum operates Paste Prompt and is the data controller. Send privacy and rights requests to contact@meta-spectrum.com.

This policy applies to the public gallery, Google account sign-in, member classes, and prompt save, use, and request features at paste-prompt.com. External AI tools and third-party services are governed by their own policies.

Korean privacy law is our baseline. Where the CCPA/CPRA applies to a California consumer or the GDPR applies to an EU/EEA user, the regional rights below also apply. Actual statutory coverage depends on legal thresholds, processing activities, user location, and other applicable facts.

2. Information, sources, purposes, and retention

Paste Prompt limits collection to what is needed to provide the service. We do not currently offer paid checkout and do not intend to collect payment information, precise location, government identifiers, biometric data, or health information.

Before a paid offering launches, we will add the payment processor, payment, billing, and transaction data handled, purposes, retention criteria, and relevant international transfers to this policy and the checkout notice. Payment credentials such as full card numbers will be handled directly by the payment processor wherever practicable.

Dynamic prompt field values currently generate completed text in your browser and are not stored on our servers. Do not enter confidential or sensitive information into prompt fields.

• Account and profile: Supabase Auth and Google provide account ID, email, display name, and profile-image URL for authentication, display, and abuse prevention. We delete or de-identify this data after account deletion except where law requires retention, and remove it from operator-controlled backups through a reasonable rotation cycle.
• Session and security: login cookies, session identifiers, access time, IP address, browser or device data, and error logs support sign-in, security, and incident response. Sessions end on logout or expiry; security records are retained only as long as needed for their purpose or legal requirements.
• Service activity: saves, copies, shares, recent use, requests, and class assignments support the related feature and operational records. Server-side records, when enabled, are kept for the shorter of the account lifetime or a feature-specific disclosed period.
• Device preferences: language, theme, and local state may be stored in cookies or localStorage until the user clears browser data.

3. Purposes and EU/EEA legal bases

We process information to authenticate accounts, provide user-specific features, apply prompt and class permissions, respond to requests, protect and troubleshoot the service, improve the product, and meet legal obligations.

Where the GDPR applies, we rely on performance of a contract or pre-contract steps for account and request features; legitimate interests that do not override user rights for security, abuse prevention, and service improvement; consent when required for optional features; and legal obligation or legal claims for required retention and disputes. Withdrawing consent does not affect processing that was lawful before withdrawal.

Paste Prompt does not currently make decisions based solely on automated processing that produce legal or similarly significant effects on users.

4. Providers, disclosures, sale, sharing, and transfers

We use Supabase for authentication and database services, Google OAuth for Google account authentication, and OpenAI Sites and related hosting infrastructure for web hosting. Providers process necessary information to deliver their services, maintain security, and meet legal obligations.

Paste Prompt does not sell personal information or Google user data for money and does not ‘share’ personal information for cross-context behavioral advertising as defined by California law. We do not use personal information for personalized advertising. We disclose information only for necessary service-provider processing, security response, the user’s direction, or a legal obligation.

Our access, use, storage, and disclosure of Google user data are limited to the practices described here and follow the Limited Use requirements of the Google API Services User Data Policy.

Cloud infrastructure may process information in Korea, the United States, or other countries. We apply notice, consent, or another lawful transfer ground where Korean law requires it. Where the GDPR applies, we use applicable adequacy decisions, Standard Contractual Clauses, or other lawful safeguards available through our providers.

5. Rights in Korea

Where Korean privacy law applies, contact contact@meta-spectrum.com to request access, correction, deletion, suspension of processing, withdrawal of consent, or to raise an objection. We may request the minimum information needed to verify the requester or an authorized representative.

We respond under the procedures and periods required by applicable law. If a lawful exception permits us to limit or deny a request, we explain the reason and available objection process. Data approved for deletion is handled so that it is not reasonably recoverable unless law requires retention.

6. California privacy rights

Where the CCPA/CPRA applies, California residents may have the right to know and access the categories and specific pieces of personal information collected, used, or disclosed; correct inaccurate information; delete information; receive a portable copy; opt out of sale or sharing; limit certain uses of sensitive personal information; and receive equal service without discrimination for exercising privacy rights.

Submit a request to contact@meta-spectrum.com. We use reasonable verification and respond within the period required by applicable law. An authorized agent may submit a request when agency authority and the consumer’s identity can be verified.

Paste Prompt does not sell or share personal information for cross-context behavioral advertising and does not currently infer or use sensitive personal information for nonessential purposes. We therefore do not currently conduct processing that requires a ‘Do Not Sell or Share’ or ‘Limit the Use of My Sensitive Personal Information’ link. If our practices change, we will provide notice at collection and the required choices first.

7. EU/EEA and UK rights

Where the GDPR or equivalent law applies, users may have rights of access, rectification, erasure, restriction, portability, objection to processing based on legitimate interests, withdrawal of consent, and complaint to a competent supervisory authority.

Submit a request to contact@meta-spectrum.com. Where the GDPR applies, we ordinarily respond within one month and notify the requester if a lawful extension is needed because of complexity or request volume.

Users may request information about safeguards for transfers outside the EU/EEA. We will add an EU/EEA representative or data-protection officer to this policy if applicable law requires one.

8. Cookies, security, children, and changes

We use essential login cookies and browser storage for language, theme, and local state. We do not currently use behavioral-advertising cookies. Blocking essential storage may prevent sign-in or preferences from working.

Paste Prompt is designed to use least privilege, Row Level Security, encrypted transport, and access controls. No transmission or storage method can guarantee absolute security. We provide legally required incident notices to users and authorities where applicable.

The service is not directed to children who require parental consent under applicable law. Contact us if you believe such a child’s information has been processed.

We will provide notice before material changes take effect, update the date above, and obtain additional consent when applicable law requires it for a materially different purpose.