Privacy Policy

1. Scope

This Policy applies to PRISM, prismcreate.app, and related account, billing, support, and creative services. It does not govern third-party sites or services you independently access.

2. Information we collect

PRISM collects account information such as email address, authentication identifiers, display name, profile image when provided by an authentication provider, profile information, plan information, signup consent records, and age-confirmation records.

PRISM collects billing records such as customer identifiers, subscription status, plan, renewal dates where available, purchase references, invoices, payment intent or Checkout references, refund or reversal metadata, transaction history, and PRISM Credit ledger entries. Payment card details are collected and processed by the payment processor and are not stored directly by PRISM.

PRISM collects content and creation data such as prompts, uploaded media, generated media, project names, project versions, instructions, settings, selected or routed model information, job status, PRISM Verify results, provider request summaries, provider cost metadata, and related support details you provide.

PRISM may process operational data needed to run and secure the Service, including timestamps, feature interactions, error diagnostics, signed-link activity, and infrastructure-level logs such as IP address, device, browser, session, and security-event information generated by hosting, authentication, payment, and storage systems.

3. Google Sign-In

If you choose Sign in with Google, PRISM may receive information authorized by you, including your name, email address, profile picture, and Google account identifier. PRISM uses this information to authenticate you, create or connect your PRISM account, display permitted account information, and protect account security.

PRISM does not receive your Google password.

PRISM does not access Gmail, Google Drive, Google Calendar, contacts, or other Google services unless a separate future feature specifically requests and obtains authorization for that access.

PRISM does not sell Google authentication data or use Google authentication data for advertising. The intended Google scopes are limited to basic authentication: openid, email, and profile.

4. How we use information

We use information to provide and personalize PRISM; authenticate users; process subscriptions, PRISM Credits, payment records, cancellations, legally required reversals, and billing disputes; store projects and versions; operate PRISM Auto and PRISM Verify; run safety and abuse controls; prevent fraud; troubleshoot reliability; communicate service information; enforce policies; and comply with law.

Current product analytics are limited to sanitized operational events queued in the application. Prompts, uploaded media, generated media, and direct personal identifiers are excluded from those analytics events.

5. How information is shared

We share information only as needed with service providers supporting AI processing, hosting, private storage, authentication, communications, payments, fraud prevention, security, legal compliance, and support; when you direct us to; in a business transaction; or where reasonably necessary to comply with law, protect rights and safety, or enforce agreements.

6. AI processing

Prompts, settings, and relevant uploaded media may be transmitted to the AI provider needed to perform your request. Provider processing and retention practices may vary according to the provider and applicable service terms. PRISM itself does not claim that customer content is used to train a proprietary PRISM model unless a future feature specifically says so and obtains any required notice or consent.

7. Storage and security

Projects and media are private by default unless you intentionally choose to publish, share, or otherwise make specific content available to other people through a PRISM sharing or community feature. PRISM will not automatically make existing private content public because a future sharing feature is launched.

PRISM uses safeguards such as HTTPS/TLS, access controls, private storage, short-lived signed media links, row-level authorization, restricted admin access, encrypted secrets, server-side authorization, and webhook signature validation. No internet service can guarantee absolute security.

8. Retention

We retain account, billing, consent, project, media, job, and support-related data while your account is active and as reasonably needed to provide PRISM. After deletion requests, some records may remain for financial records, fraud prevention, legal obligations, dispute records, security records, policy enforcement, or backups pending normal deletion cycles. Retention periods vary by data type and legal requirement.

9. Your choices and rights

Depending on where you live, you may have rights to access, correct, delete, restrict, object to, or receive a copy of personal information, and to appeal a denied request. You may manage billing through your account and request account deletion through Support. We may verify your identity before completing a request. You may also complain to your local data-protection authority.

Deleting your PRISM account is different from canceling your subscription. Deleting your account may permanently delete projects, uploaded files, generated media, and unused PRISM Credits. Cancel any active subscription before deleting your account.

10. International processing

PRISM and its providers may process information in countries other than yours. Where required, we use recognized legal mechanisms intended to protect transferred personal information.

11. Sale and advertising

PRISM does not sell personal information for money. PRISM does not currently use cross-context behavioral advertising trackers. If PRISM later uses cross-context behavioral advertising or nonessential cookies requiring consent, PRISM will update this Policy and provide controls required by law before deployment.

12. Children

PRISM is not restricted to adults. You must be at least 13 years old to create an account. If you are under the age of majority where you live, your parent or guardian must review and agree to our Terms and this Privacy Policy on your behalf and is responsible for your use of PRISM. PRISM does not currently offer accounts to children under 13 and does not knowingly collect their personal information; if we learn that we have, we will delete it. Parents or guardians can contact us to review or delete a minor's information.

13. Changes

We may update this Policy. We will post the revised version with a new date and provide additional notice where required by law.

14. Contact

Use the PRISM Support Center as the primary contact method for privacy questions and rights requests. You may also email prismcreateai@gmail.com.