Privacy Policy

1. Who this policy covers

This policy describes the information processed through Prism's website, onboarding, client portal, AI work, and subscription services. In this policy, “Prism,” “we,” and “us” mean the operator of Prism.

[NEED FACT: legal name and business address of the Prism operator, and effective date after approval.]

2. Information you provide and account records

The following inventory describes fields in the supplied database migrations. Not every field is collected from every customer. Some fields are generated by the service, and some support earlier or alternative versions of the data model.

Account and profile

Account records include your account identifier, email address, and authentication information handled by Supabase Auth. Profile fields include account ID (id), first name or nickname (first_name), full name (full_name), time zone (timezone), industry (industry), onboarding status (onboarding_status), onboarding step (onboarding_step), onboarding completion time (onboarding_completed_at), hands-on or hands-off choice (work_mode), and record creation and update times (created_at, updated_at).

[NEED FACT: complete Supabase Auth field inventory actually retained or used by Prism, including session, identity, authentication metadata, and any security logs.]

Business and onboarding answers

Business records include record and owner identifiers (id, owner_id); business or store name (store_name); business stage (business_stage); store platform and other-platform answer (store_platform, store_platform_other); business or store URL (store_url); product description (product_description); product categories (product_categories); target customer description (target_customer); goals and other-goal answer (goals, goal_other); brand voice (brand_voice); words to avoid (avoid_words); work mode (work_mode); additional onboarding answers (extra_answers); onboarding version (onboarding_version); and creation and update times (created_at, updated_at).

Step-by-step onboarding records also contain your account identifier (user_id), the step name (step), the answers saved for that step (answers), and the last update time (updated_at). Free-text and structured answer fields contain the business information you enter, including any personal information you choose to include.

[NEED FACT: Hannah's complete inventory of keys saved inside answers and extra_answers. These flexible fields must be checked against the implemented onboarding screens before publication.]

Store platform and product questions apply to E-commerce and Retail onboarding, rather than every industry.

Your team's configuration

Team records include team, owner, and business identifiers (id, owner_id, store_id); team name (name); status (status); subscription tier (plan_tier); monthly task limit (monthly_task_limit); and creation and update times (created_at, updated_at).

Worker records include worker and team identifiers (id, team_id); role identifier (slug); display name (display_name); persona name (persona_name); face image path (face_path); Team Lead indicator (is_lead); display order (sort_order); status (status); current task identifier (current_task_id); and creation and update times (created_at, updated_at).

Team-member records also include role title (role_title), Team Lead indicator (is_boss), reporting relationship (reports_to), position (position), job description (job), runtime role (runtime_role), and first-task examples or instructions (first_tasks), along with member and team identifiers, role identifier, display name, and creation time (id, team_id, slug, display_name, created_at).

These records describe your AI team's configuration, not a team of human employees.

3. Tasks, drafts, reports, and decisions

Task records include task and team identifiers (id, team_id); parent task identifier (parent_task_id); assigned worker identifier (assigned_worker_id); task origin (origin); requesting account identifier (requested_by); title (title); request or Team Lead brief (request_text); task type (task_type); task size (size); usage units (units); status (status); whether approval is needed (needs_approval); revision count (revision_count); error message (error_message); and start, completion, creation, and update times (started_at, completed_at, created_at, updated_at).

Runtime task records include task and account identifiers (id, user_id); worker role (worker_role); title (title); task details (details); whether the task was created by you or the Team Lead (created_by); parent report identifier (parent_report_id); status (status); your change-request or decision note (customer_note); decision time (decided_at); and creation and update times (created_at, updated_at).

Runtime report records include report, task, and account identifiers (id, task_id, user_id); worker role (worker_role); report or draft content (body); status (status); Team Lead review note (boss_note); AI model identifier (model); input and output token counts (input_tokens, output_tokens); and creation time (created_at).

Requests, drafts, reports, and review notes may contain personal information if you include it in the work you ask Prism to do.

[NEED FACT: complete column inventory for task_outputs, reports, approvals, and the original usage_events table, plus any task fields after the truncated portion of 0001_init.sql. The supplied read stopped before these definitions.]

4. Usage and billing records

Customer-plan records include account identifier (user_id), tier (tier), usage-period start (period_start), and approval mode (approval_mode).

Runtime usage records include event identifier (id), account identifier (user_id), task identifier (task_id), units used or refunded (units), event kind (kind), and event time (created_at).

Billing-customer records include account identifier (user_id), email (email), Stripe customer identifier (stripe_customer_id), time the trial was used (trial_used_at), and creation and update times (created_at, updated_at).

Subscription records include record and account identifiers (id, user_id); Stripe subscription and customer identifiers (stripe_subscription_id, stripe_customer_id); plan identifier (plan_id); subscription status (status); billing-period start and end (current_period_start, current_period_end); trial end (trial_end); cancellation-at-period-end setting (cancel_at_period_end); cancellation time (canceled_at); latest invoice identifier and status (latest_invoice_id, latest_invoice_status); and creation and update times (created_at, updated_at).

Credit records include record and account identifiers (id, user_id); credits added or deducted (delta); reason, such as a purchase, usage, refund, or adjustment (reason); pack identifier (pack_id); Stripe reference (stripe_ref); amount in cents (amount_cents); expiration time (expires_at); and creation time (created_at). A calculated balance record contains the account identifier (user_id) and credit balance (balance).

Stripe event records include event identifier (id), event type (type), and receipt time (received_at).

Trial eligibility rules call for an email eligibility check and a Stripe payment-card fingerprint check. A fingerprint is an identifier used to recognize a card, not its full card number.

[NEED FACT: whether normalized trial email identifiers and card fingerprints are implemented, where they are retained, who receives them, and how long they are kept.]

Stripe handles payment information entered in its checkout. Do not enter card information in Prism task requests. The billing integration is currently in test mode; this draft does not authorize real payment collection.

5. Why information is used

The proposed purposes are to create and authenticate accounts; save and resume onboarding; shape your team for your industry and business; plan, perform, and review requested work; display drafts and decisions; enforce task budgets and trial eligibility; manage subscriptions and credits; send account, service, and usage emails; answer support requests; investigate errors or misuse; and satisfy applicable legal obligations.

[NEED FACT: implemented support record handling, operational logging, analytics, cookies beyond authentication, and retention for each. Do not publish claims about unverified tracking or data practices.]

6. Service providers and other disclosures

Supabase supports login and storage of account, business, team, task, review, usage, and billing records. Resend supports service emails and receives the recipient address and the email content needed for those messages. OpenAI receives business context, task text, and related draft or review content selected for AI work, and returns AI output. Stripe supports subscriptions and payments and receives the checkout and billing information needed for those services.

Prism's proposed sharing is limited to information needed for these functions. Each provider operates under its own applicable terms and privacy practices. This policy does not promise that a provider never retains data, never uses it for another permitted purpose, or processes it only in a particular country.

[NEED FACT: actual provider configurations, data-processing arrangements, processing locations, and retention settings, including OpenAI settings.]

Information may also be disclosed when legally required, to respond to valid legal process, or as necessary to protect lawful rights and investigate misuse. Any such disclosure must comply with applicable law.

[NEED FACT: whether Prism has any additional recipients, sale or advertising-related sharing, or business-transfer practices that need disclosure.]

7. Security and third-party risks

No online service can guarantee complete security or uninterrupted availability. Accounts, databases, communications, and outside providers may be affected by unauthorized access, breaches, hacks, outages, or other failures.

To the fullest extent permitted by applicable law, Prism disclaims liability for breaches, hacks, outages, data loss, and acts or omissions of Supabase, Resend, OpenAI, Stripe, and other third-party providers. This does not remove any security, notification, privacy, or other duty that applicable law does not allow Prism to disclaim.

The warranty disclaimers and liability limits in the Terms of Service apply to use of the service to the extent legally permitted. They do not eliminate nonwaivable privacy rights.

8. Retention and requests about your information

[NEED FACT: approved retention periods or criteria for active accounts, closed accounts, task content, billing and tax records, security records, provider copies, and backups; deletion workflow and timing.]

To ask about access, correction, deletion, or another applicable privacy right, email help@prismworkforce.ai. Prism may need information to verify that the request concerns your account. Requests are subject to applicable law, identity verification, and lawful record-retention requirements. Cancellation of a subscription is not, by itself, a request to delete account records.

[NEED FACT: jurisdictions served, applicable rights and legal bases, any required appeal process, and children's eligibility restrictions.]

9. AI output and your responsibilities

AI output may be inaccurate, incomplete, biased, or unsuitable for your purpose. You are responsible for reviewing it and for anything you publish, send, or act on. Hands-off mode does not transfer this responsibility to Prism. Submit only information you have the right to provide and that is appropriate for processing by the providers described above.

10. Changes and contact

[NEED FACT: implemented notice process for material policy changes.]

For privacy questions or requests, contact help@prismworkforce.ai.