Privacy notice
Version: 2.4 · Effective: 11 September 2026
1. Who we are
This notice explains how theround ltd uses personal data collected through RateMyPrompts (ratemyprompts.com), a free tool that grades the prompt sets marketers use to track their brand in AI assistants. We also run Zebora (zebora.io), an AI-visibility consultancy; this notice mentions Zebora where RateMyPrompts passes an enquiry to it.
theround ltd is the controller for the personal data described here. We are a private limited company registered in England and Wales, company number 15402779, registered office 131 Finsbury Pavement, London EC2A 1NT, United Kingdom. VAT number 459080279.
Contact for anything in this notice: privacy@theround.com, or by post to the registered office. Our directors are responsible for data protection. We are not required to appoint a Data Protection Officer.
2. The data we hold, why, on what basis, and for how long
2.1 RateMyPrompts
| What we do | Data | Lawful basis | How long |
|---|---|---|---|
| Grade a prompt set you upload | The prompts you upload, the columns in your file, the analysis we produce, and any brand, category, markets, neighbouring categories and prompt sources you tell us | Legitimate interests: providing the service you asked for | 30 days from upload, then deleted automatically, together with the analysis |
| Improve the grader | The same stored sets, during those 30 days | Legitimate interests, assessed in a written balancing test available on request | Within the same 30 days. We keep only aggregate figures afterwards, never prompt text |
| Keep a scorecard private to you | A random identifier stored in a cookie on your browser. We keep only a one-way hash of it | Legitimate interests: security | Cookie: 12 months. Hash: deleted with the scorecard |
| Confirm your email address | Your email address and a single-use confirmation link, of which we keep only a one-way hash | Legitimate interests: preventing misuse of our email | Links expire after 7 days and are deleted 7 days after that |
| Send you your scorecard and follow up | Email address, any name you give, your score, which visibility tracking tool you use, and which Zebora offers you clicked (recorded in our CRM only once you have confirmed your email) | Legitimate interests, for business contacts. You can object at any time and every email has an unsubscribe link | Until you object, or 24 months after our last contact with you, whichever is sooner |
| PromptSet newsletter | Email address, any name you give, and a record of your consent: the words you agreed to, their version, the page you signed up on, your network address and the time. If you signed up from a scorecard, also your score band, coverage band, tool used and markets. Sent to Loops only after you confirm | Consent. The scorecard box is unticked and the sign-up form is separate, and we confirm by email before sending anything | Until you unsubscribe. Sign-ups never confirmed are deleted after 30 days |
| Publish anonymised research | Your prompt set with brand and personal details removed | Consent, the separate research box | Until you withdraw consent. Already-published aggregate findings cannot be withdrawn |
| Prevent abuse | Your network address, in rate-limit counters | Legitimate interests: security | 2 days |
| Pro accounts and scorecard packs | Your email address, a sign-in session cookie (we keep only a one-way hash), your plan, renewal date and pack balance. Payment details are handled by Paddle and never reach us | Contract | While you have an account, then 12 months after your plan ends or your last sign-in, whichever is later. Sign-in links expire after 30 minutes and sessions after 30 days |
| Score history (Pro) | For each set graded while you have Pro: brand, category, markets, scores and the date. Never prompt text | Contract | 12 months from grading, then deleted automatically |
We never publish your prompt text. Anyone you share a scorecard link with sees scores and reasons, not your prompts. Prompt text is shown only on the browser that graded the set, or one that confirmed its email.
Automated processing. Your prompt set is graded automatically against a published rubric. The grade is an assessment of a list of questions, not a decision about you, so it has no legal or similarly significant effect on you. If you think a grade is wrong, email privacy@theround.com and a person will review it.
Personal data inside your prompts. Please do not upload prompts containing anyone's contact details or confidential information. The tool warns you if it finds any. You confirm when uploading that you have the right to share the prompts with us.
2.2 Zebora
If you ask to hear from Zebora through RateMyPrompts, for example by booking a call or clicking one of its offers after confirming your email, we use your details to reply and to discuss the service you asked about, on the basis of legitimate interests. They are kept with your CRM record, as above.
2.3 Marketing emails to business contacts
We may email people at businesses about our services on the basis of legitimate interests, because the law on electronic marketing treats company addresses differently from personal ones. That does not apply to sole traders or partnerships, whom we email only with consent. Every marketing email identifies us, includes our postal address and has a working unsubscribe link, which we honour promptly.
3. Who we share data with
We use these providers to run the services. Each processes data only on our instructions under a written contract.
| Provider | What for | Where | Transfer safeguard |
|---|---|---|---|
| Vercel | Hosting | US and EU | UK International Data Transfer Agreement |
| Supabase | Database | EU (Ireland) | UK adequacy regulations for the EU |
| Resend | Sending scorecard and confirmation emails | US | UK Extension to the EU-US Data Privacy Framework, and the UK Addendum |
| Attio | Customer relationship records | UK, and outside the UK through its sub-processors | EU Standard Contractual Clauses and the UK Addendum |
| Vercel AI Gateway, routing to OpenAI by default | Suggesting the topics a category covers. It receives only the brand, category and markets, never your prompts | US | Vercel: UK International Data Transfer Agreement. OpenAI: EU Standard Contractual Clauses and the UK Addendum. Neither trains on this data |
| Loops | Sending the PromptSet newsletter | US | Standard Contractual Clauses under Loops' data processing addendum |
| Paddle | Checkout, payments, tax and invoices, as merchant of record, so Paddle is a separate controller for payment data. We receive your email, plan and purchase status | UK | Not a transfer |
| Google (Google Analytics, via Google Tag Manager) | Counting visits and how the site is used. It sets cookies only if you accept analytics cookies; otherwise it sends basic measurements with no cookies or identifiers. It never receives your prompts or your email address | US and EU | UK Extension to the EU-US Data Privacy Framework |
| PostHog | Understanding which steps of the tool people reach, and, if you accept analytics cookies, recordings of how pages are used with all text on screen hidden. It never receives your prompts or your email address, and it discards IP addresses | EU (Germany) | Standard Contractual Clauses under PostHog's data processing agreement |
| Sentry | Error reports when something on the site breaks: which page, what failed and on what browser. We remove request contents, cookies, query strings, IP addresses and user details before anything is sent | EU (Germany) | Standard Contractual Clauses under Sentry's data processing addendum |
| LinkedIn (Insight Tag) | Only if you accept marketing cookies: measuring which companies and roles visit and whether our posts or adverts lead to sign-ups, and showing our adverts to people who have visited. LinkedIn Ireland is a separate controller for the data it collects on LinkedIn. It never receives your prompts or email address from us | Ireland, and the US | EU Standard Contractual Clauses and the UK Addendum, under LinkedIn's advertising terms |
Google Analytics sets cookies only if you accept analytics cookies. Before you choose, or if you reject them, Google's tag still sends basic measurements, such as that a page was viewed, without setting or reading cookies or any identifier, so you cannot be recognised; Google uses them to estimate overall traffic. We keep Google Analytics data for 14 months. PostHog keeps nothing on your device until you accept analytics cookies; until then it counts page views and steps in memory only. Apart from the LinkedIn Insight Tag above, which runs only if you accept marketing cookies, we do not use advertising services at present. If we add any, we will list them here before they are switched on, and advertising will only run with your consent.
We may also share data with professional advisers, with authorities where the law requires it, and with a buyer if we sell all or part of the business.
Zebora and RateMyPrompts are brands of the same company, so passing your enquiry from one to the other is not sharing with a third party. We tell you here so it is not a surprise.
4. Your rights
You can ask us to give you a copy of your data, correct it, delete it, restrict how we use it, move it to another provider, or stop using it where we rely on legitimate interests. You can withdraw consent at any time, which does not affect anything we did before. You can object to direct marketing at any time and we will stop.
If you have an account, you can do two of these yourself, straight away, under your data:
- Take a copy. One file containing your account, every scorecard with the prompts behind it, your score history, your newsletter record and the apps you have connected. It is built when you ask for it and never stored.
- Delete everything. Your account, your scorecards and their prompts, your score history, your newsletter and waitlist entries, your connected apps and your sign-in. It cannot be undone.
Two things survive that deletion, and we would rather say so than let you find out. Your payment and invoice records are held by Paddle, the merchant of record and a separate controller for payment data — ask Paddle to erase those. And anything already sent to Attio or Loops lives in those systems; email us and we will remove it there too.
If you have connected an assistant such as Claude to RateMyPrompts, you can disconnect it at any time under connected apps. Disconnecting stops that app using the access it already holds, not just future access.
For anything else, email privacy@theround.com. We reply within one month.
5. Complaints
Please tell us first, at privacy@theround.com, and we will investigate and reply. You also have the right to complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
6. Security
Data is encrypted in transit and at rest. Access to stored prompt sets is limited to our servers and to staff who need it. Scorecard links are unguessable, and the ability to change a scorecard is tied to your browser.
7. Children
Our services are for businesses and people aged 18 and over. We do not knowingly collect data about children.
8. Visitors outside the UK
European Union. Our services are aimed at businesses in the UK. We do not target individuals in the EU, and any processing of EU visitors' data is occasional, so we have not appointed a representative in the EU.
United States. The California Consumer Privacy Act and similar state laws apply to businesses above thresholds we do not meet. We describe our practices here anyway. We collect the categories listed in section 2. We do not sell personal information. We do not use advertising tags at present. If we add them, they will only load if you accept marketing cookies, and you can change that at any time from the cookie settings link in the footer.
9. Cookies
See our cookie policy. Nothing except strictly necessary cookies is set before you choose.
10. Changes
We will post any change here with a new version number and date, and email you about significant changes if we hold your address.