Privacy Policy

1. Information We Collect

1.1 Information You Provide Directly

• Account registration: name, email address, company name, and password when you sign up.
• Billing information: payment card details processed securely by our payment provider (Stripe). We never store raw card numbers.
• Communications: messages you send us via email, support tickets, or contact forms.
• Waitlist: email address submitted through our early-access form.

1.2 Information Collected Automatically

• Log data: IP address (truncated to /24 for anonymisation), browser type and version, operating system, referring URL, pages visited, and timestamps.
• Device data: screen resolution, language preference, and time zone — used solely to categorise visitor segments.
• Usage data: features used, dashboard interactions, and API call patterns.

1.3 Tracking Script Data (Collected on Your Visitors' Behalf)

When you install the Prism tracking script on your website, the script collects the following data about your visitors on your behalf. You are the data controller for this data; Prism acts as a data processor.

• Page URL and referrer
• Anonymised visitor identifier (session-scoped, never stored on the visitor's device)
• Country and city (derived from truncated IP; raw IP is discarded immediately)
• Browser family, OS family, and device type
• UTM campaign parameters
• Custom events you define via our JavaScript API

1.4 Information from Meta Platforms

If you connect your Prism account to a Meta platform (e.g. to track conversions via the Meta Pixel integration), we may receive:

• Your Meta user ID and public profile name (for OAuth authentication).
• Ad account IDs and campaign metadata you explicitly authorise.
• Aggregated conversion event data returned by Meta's Conversions API.

We do not receive or store individual Meta users' personal data beyond what is necessary to deliver the integration you requested. See Section 4 for full details.

2. How We Use Your Information

We do not sell your data, use it for advertising profiling, or share it with data brokers.

3. Legal Bases for Processing (GDPR)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, our legal bases for processing personal data are:

• Contractual necessity — to fulfil our agreement with you as a customer.
• Legitimate interests — to operate, secure, and improve the Service, provided these interests are not overridden by your rights.
• Consent — where we explicitly ask for your permission (e.g. marketing emails, Meta integrations). You may withdraw consent at any time.
• Legal obligation — where processing is required to comply with applicable law.

4. Meta Platform Data

This section addresses Meta's specific requirements for applications that access its platforms via the Meta Business SDK, Meta Login, or Meta's Marketing API.

4.1 Data Obtained from Meta

When a user authenticates Prism via "Login with Facebook" or authorises our Meta Business integration, we request only the permissions necessary to deliver the requested features:

• email — to associate your Meta identity with your Prism account.
• ads_read — to fetch campaign performance data you choose to display in Prism dashboards.
• ads_management — only if you explicitly enable the write-back feature to sync conversion events.

4.2 How We Use Meta Data

• To authenticate you and link your Prism account to your Meta Business Manager.
• To pull authorised ad performance metrics into your Prism dashboard.
• To send server-side conversion events to Meta's Conversions API on your behalf, solely as directed by you.

We do not use Meta user data to serve advertisements, build behavioural profiles, or share it with any third party except as required to operate the integration.

4.3 Restricted Data Use

We comply with Meta's Platform Terms and Developer Policies. In particular:

• Meta data is used only for the purpose for which it was obtained.
• We do not transfer Meta data to data brokers, ad networks, or analytics companies other than as described here.
• We do not use Meta data to make eligibility decisions (credit, employment, insurance, housing).
• We retain Meta tokens only for as long as the integration is active. Revoking access in your Facebook Settings immediately invalidates the token on our side.

4.4 Data Deletion Callback

Meta requires apps to implement a data-deletion callback. If you remove our app from your Facebook settings, or submit a deletion request directly to Meta, we receive a signed notification and will delete all data obtained via Meta within 30 days. You may also request deletion directly at any time — see Section 11.

4.5 Contact for Meta-Related Privacy Requests

Email: privacy@prism.example.com with the subject line "Meta Data Request".

5. Sharing & Disclosure

We share personal data only in the following circumstances:

• Service providers: Stripe (payments), AWS (infrastructure), Postmark (transactional email), and Cloudflare (CDN / DDoS protection). Each is bound by a data processing agreement and processes data only on our instructions.
• Your instructions: When you configure integrations (e.g. Meta Conversions API, Slack, Google Sheets), you direct us to share specific data with those platforms.
• Legal requirements: If we are compelled by a court order, subpoena, or other legal process, we will disclose the minimum information required and, where permitted, notify you.
• Business transfer: In the event of a merger, acquisition, or asset sale, personal data may transfer to the new entity, subject to the same protections described here.
• Safety: To prevent imminent harm, fraud, or illegal activity.

We never sell personal data to third parties.

6. Cookies & Tracking Technologies

The Prism tracking script (embedded on your visitors' sites) sets no cookies.

The Prism dashboard (our own web application) uses a minimal set of first-party cookies:

No third-party advertising or tracking cookies are set anywhere on our Site or in our Service. You can disable cookies via your browser settings; this will prevent dashboard login.

7. Data Retention

• Account data is retained for the duration of your subscription plus 90 days after account closure, unless a longer period is required by law.
• Analytics data (page-view events on your site) is retained according to your plan tier (30 days on Starter, 1 year on Pro, unlimited on Business), after which it is permanently deleted.
• Meta integration data (tokens, ad account IDs) is deleted within 30 days of integration removal or account closure.
• Waitlist email addresses are retained until the product launches or you unsubscribe, whichever is sooner.
• Invoices and payment records are retained for 7 years to satisfy accounting and tax obligations.

8. Security

We implement industry-standard technical and organisational safeguards, including:

• TLS 1.2+ encryption in transit for all data.
• AES-256 encryption at rest for stored data.
• Role-based access controls limiting employee access to production data.
• Regular penetration testing and third-party security audits.
• Automated anomaly detection and intrusion-detection systems.
• Signed, isolated execution environments for the ingestion pipeline.

No method of transmission over the internet or electronic storage is 100% secure. If you discover a vulnerability, please report it responsibly to security@prism.example.com.

9. Children's Privacy

The Service is directed to businesses and is not intended for individuals under the age of 13 (or 16 in the EEA where applicable). We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us at privacy@prism.example.com and we will delete it promptly.

If you are deploying our tracking script on a site that may be accessed by children, you are responsible for complying with COPPA, GDPR-K, and any other applicable children's privacy laws.

10. Your Rights & Choices

Depending on your location, you may have the following rights regarding your personal data:

To exercise any right, email privacy@prism.example.com. We will respond within 30 days (EEA/UK: within 1 month as required by GDPR).

California residents (CCPA/CPRA): You have the right to know, delete, and opt out of the sale of personal information. We do not sell personal information. To submit a request, contact us at the address above or use our data deletion form.

11. Data Deletion Request

To request deletion of your Prism account and all associated personal data (including any data obtained via Meta), use one of the following methods:

1. In-app: Settings → Account → Delete Account.
2. Email: Send a request to privacy@prism.example.com from the address associated with your account, with the subject "Data Deletion Request".
3. Meta callback: Remove the Prism app from your Facebook Settings → Apps and Websites. We receive a signed deletion notification and process it within 30 days.

Upon verified request we will:

• Delete or anonymise all personal data within 30 days.
• Notify you by email when deletion is complete.
• Retain only data required by law (e.g. invoices) for the minimum legally mandated period.

12. International Data Transfers

Prism is headquartered in the United States. If you are accessing the Service from outside the United States, your data may be transferred to and processed in the United States or other countries where our service providers operate.

For transfers from the EEA/UK to the United States, we rely on:

• EU Standard Contractual Clauses (SCCs) as approved by the European Commission.
• UK International Data Transfer Agreements (IDTA) for UK-originating transfers.
• EU–US Data Privacy Framework where our processors are certified.

Copies of our data processing agreements are available upon request.

13. Third-Party Links

Our Site may contain links to third-party websites, integrations, or documentation. We are not responsible for the privacy practices or content of those sites. We encourage you to review the privacy policies of any third-party services you use in connection with Prism.

14. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will:

• Update the "Last reviewed" date at the top of this page.
• Send an email notification to registered users at least 14 days before the changes take effect.
• Display a prominent banner on the dashboard for 30 days after the change.

Continued use of the Service after the effective date constitutes acceptance of the revised policy. If you do not agree, you may delete your account before the effective date.

15. Contact Us