Privacy Policy

• Terms of Use
• Privacy Policy
• Data Processing Addendum
• Subprocessor List
• Accessibility Statement

1. Scope and contact

Prism IO is operated by PopTech Studio LLC, a Florida limited liability company doing business as Prism IO (“Prism IO,” “we,” “us”). This Privacy Policy explains how we handle personal information when you visit our website or use our services, including:

• prismio.ai, including contact forms, account pages and the Brand Audit at prismio.ai/brand-audit/;
• Brand System Architect at https://app.prismio.ai/bsa/;
• the client dashboard at app.prismio.ai;
• the Prism IO API, the BrandOS MCP server and the Python SDK; and
• related authorized integrations, support, meetings and communications.

This policy covers visitors, prospects, account holders and authorized users. It does not govern unrelated websites operated by our customers or other businesses.

For privacy questions, requests or complaints, contact support@prismio.ai (subject line “Privacy request”) or +1 (310) 849-0119. You do not need to create an account to contact us about privacy. Our mailing address is at the end of this policy.

Our role. We determine how information is used for our own account administration, service delivery, security, billing and business communications; for that information we are the controller (or “business” under California law). Your Brand Identity System and the materials you provide to build it may contain personal information about other people, such as your leadership, your customers, testimonials and personas built from real customer language. For that information we act on your behalf as your processor (or “service provider” under California law): you determine the purposes, and our processing is governed by your instructions, your agreement with us and our Data Processing Addendum. Your organization’s administrator may manage your access and the materials shared within its workspace.

In short: we collect what we need to run your account, produce your work, bill you and keep the services secure. We do not sell personal information. Your brand content, prompts and files are yours, and we do not use them to train AI models. Our servers are in the United States. You can get a copy of your data and delete your account (Section 10).

2. Information we collect

The information collected depends on your interaction with Prism IO.

Payment information is processed through the payment service identified at checkout. Do not send card details, passwords or access tokens through ordinary support messages or brand-content fields.

Public information may still be personal information. We use relevant public sources to perform the requested assessment and explain its findings. Contact us about inaccurate personal information or a source you believe should not be processed.

Required fields are identified in the relevant flow. Without information needed to provide an account, assessment or purchase, we may be unable to complete that function. We do not knowingly collect sensitive personal information such as health, biometric, precise geolocation, government identifiers or financial account credentials, and our Terms of Use ask you not to submit it.

3. How we use information

We use relevant information to:

• create accounts, authenticate users and manage access;
• prepare Brand Audit reports and assist with brand discovery and development;
• store and deliver brand materials, revisions, source references and work product;
• provide authorized AI processing, governance features, API and MCP access, and connections;
• respond to enquiries, conduct requested brand reviews and deliver support;
• administer orders, billing, subscriptions and contractual obligations;
• understand service use, diagnose failures, maintain reliability and prevent misuse;
• send permitted business and marketing communications and apply your preferences; and
• meet legal obligations, respond to lawful requests and protect legitimate rights.

Where EU or UK data protection law applies, our legal bases are:

Our legitimate interests are subject to the rights and interests of affected people. For customer-controlled personal information, the customer determines its lawful basis and supplies documented instructions.

Accepting service terms is different from giving permission for an optional use. Creating an account, running a Brand Audit or joining a wait list does not sign you up for marketing. We send marketing email only if you opt in or, where the law permits, if you are an existing customer and the message concerns similar products, and every such email carries an unsubscribe link. We do not treat merely visiting the website as permission for unrelated processing.

We do not use your personal information to make decisions that produce legal or similarly significant effects on you without human involvement. Governance results and scores are produced for you to review; they are not decisions about you.

4. AI processing, training and human review

Prism IO uses AI to assist with research, assessment and preparation of proposed brand-system content. To build a Brand Identity System, answer a chat message, produce an embedding for search, run a governance check or generate a Brand Audit, we send the relevant text (your answers, messages, extracted file text, the parts of your brand model needed for the task, and the public brand content we retrieved) to a large language model provider through its application programming interface. Prism IO is model-agnostic: requests are routed through a provider-neutral layer, and the providers that can receive your content at any time are the AI providers named in our Subprocessor List, with the locations where they process data. Today those are OpenAI and Anthropic. We may add other providers, including providers of open-source models, and we update the Subprocessor List before a new provider receives your content. AI-assisted results and associated source or revision records are retained in your account or workspace.

We do not use your nonpublic customer materials, prompts, brand model or outputs to train or fine-tune generalized Prism IO or third-party AI models, and we do not authorize anyone else to, without a separate, specific written opt-in. Ordinary service use does not provide that opt-in. Our providers process your content under their business API terms, which do not permit them to use API inputs or outputs to train their models. Providers may retain API data for a limited period for abuse and safety monitoring under their own policies, after which it is deleted.

We do not use one customer’s private brand materials, prompts, brand model or outputs to develop another customer’s brand system. Your content is stored and served under your tenant only. Access and use must serve the agreed customer relationship or another specifically authorized or legally required purpose.

If an optional training program is ever offered, we will explain its purpose, data, recipients and available choices before requesting permission. Withdrawal applies to future consent-based processing; it does not necessarily reverse a model’s completed training, and we will not promise reversal without establishing that capability.

Your organization may also connect its own AI or other software accounts, including an AI assistant, MCP host or workflow tool that reads your Brand Identity System. When it authorizes a connection, selected information passes to that service under its own terms and settings, and we tell you in the product when a connected provider is being used. What that tool does with the context, including any memory, upload, caching or logging it performs, is governed by its own terms, not this policy. Connection is not the same as Prism IO governance. Revoking a connection stops future access through that authorization; it does not automatically erase copies already received by the other provider.

AI results can be inaccurate or incomplete. A Brand Audit assesses the materials and context identified in the report. It is not a certification or a prediction of business results. You may ask us to correct personal information and discuss the findings with our team.

Our brand services are not intended to determine an individual’s eligibility for employment, credit, housing, insurance or comparable significant opportunities. Any new use involving legally significant automated decisions would require a separate assessment and applicable notices and safeguards.

5. Service providers, technology and other disclosures

We use service providers (subprocessors) for infrastructure, AI processing, payments, communications, meetings, analytics, advertising measurement, support and business operations. We disclose information relevant to their role, under contracts that limit their use of it to providing their service to us. We do not sell personal information. The only “sharing” for advertising we may do is described under Meta below, and you can opt out of it (see “Your privacy choices” in Section 6).

Our technology also includes WordPress, WooCommerce, LiteSpeed Cache, n8n workflow automation, Redis and PostgreSQL operated within our own infrastructure. Installing software does not by itself mean its publisher receives customer information. The maintained list, with the date of each change, is at prismio.ai/subprocessors/; we update it before adding a provider that receives customer content.

Other recipient categories can include storage and backup services, security and support providers, meeting services, professional advisers and contractors engaged for the service, each under confidentiality obligations.

We may also disclose information to your authorized organization members; to recipients you direct; where required by law, subpoena or court order (where lawful, we will tell you before disclosing your data in response to a legal demand); where reasonably necessary to address fraud, security incidents or legal claims; and in a permitted business transaction, including a transfer of the Prism IO business to a successor entity, subject to appropriate protections and notice to you. We may share aggregated or de-identified statistics that cannot reasonably identify you or reconstruct your content.

We do not sell or rent your private customer content, and we never use it for advertising. Our website analytics measure our own site. Where the Meta Pixel is enabled on prismio.ai, website activity (never your account content, prompts, files or brand system) may be shared with Meta to measure our advertising and reach people like our visitors; Section 6 explains how to opt out.

6. Cookies and communication choices

On prismio.ai (the website) we use:

Your privacy choices. You can block or remove analytics, marketing and advertising cookies at any time through your browser settings, the Google Analytics opt-out browser add-on, HubSpot’s cookie opt-out and Meta’s Ad Preferences. To opt out of the sharing of your website activity with Meta for advertising, email support@prismio.ai with the subject line “Do not share my personal information”, and we will honor the request for the browser and account you identify; we also treat a Global Privacy Control signal from your browser as that opt-out request. If you would rather we did not measure your visit at all, say so in the same message. Blocking essential storage can prevent sign-in or other requested functions. Browser controls do not stop server-side processing or erase previously collected information.

On app.prismio.ai (the dashboard), the API and the MCP server we use no advertising or marketing cookies. The dashboard keeps your sign-in token in your browser’s local storage so that you stay signed in for up to 24 hours, and uses the product analytics and error monitoring described in Section 5 where enabled. The API and MCP server use no cookies; they authenticate by credential.

Legacy Do Not Track signals have no agreed meaning and do not change our processing. A Global Privacy Control signal is treated as an opt-out of the advertising sharing described above; it does not affect strictly necessary cookies or the services you sign in to use.

We send communications necessary to provide your requested report, appointment, account, purchase or support (verification, password resets, security alerts, billing notices, changes to our terms); these cannot be turned off while you have an account. Optional promotional communications are handled according to your choices and applicable law. Where opt-in is required, registering or requesting an audit is not a substitute for it. You can unsubscribe from marketing using the message’s unsubscribe link or by contacting us, and we keep a minimal suppression record to honor that choice permanently. Our emails come from addresses ending in @prismio.ai, and we will never ask for your password by email.

A requested brand-review conversation may include discussion of Prism IO services. That request does not grant permission for every other marketing campaign. Meetings are held on Zoom, and we may use Fireflies.ai to record, transcribe and summarize a meeting. We announce recording or AI transcription at the start of the meeting and proceed only with your agreement; permission to attend is not permission to record, and you may ask us to stop or to delete a recording at any time.

Marketing email. Every marketing email we send identifies Prism IO as the sender, uses a subject line that reflects its content, includes our physical mailing address, and carries a working unsubscribe link that we honor within ten business days. Service and account emails are not marketing.

7. Retention and deletion

We keep personal information only as long as needed for the purposes in this policy and documented legal, security and contractual needs, then delete or de-identify it. The main periods are:

A deletion request is assessed against applicable rights and lawful exceptions. Information retained for a legal duty, a legal hold or a dispute is restricted to that purpose. Aggregated or de-identified data may be kept indefinitely. Provenance does not require us to retain every prompt or output indefinitely; content, approval records, diagnostic events and security logs have different purposes and retention needs.

8. International processing

Prism IO operates from the United States and our servers are located there. If you use the services from outside the United States, your information is transferred to, stored and processed in the United States and in the countries where the providers in Section 5 operate.

For personal information from the EU, EEA, UK and Switzerland, we rely on the European Commission’s Standard Contractual Clauses (and the UK International Data Transfer Addendum) incorporated into our Data Processing Addendum and our agreements with providers; on a provider’s certification under the EU-U.S. Data Privacy Framework and its UK and Swiss extensions where available; and, for the specific transfer you initiate by using the services, on the performance of your contract with us or your explicit consent where the law allows. Contact us for a copy of the safeguards we rely on. Acceptance of our terms or visiting the website does not itself replace a required transfer mechanism.

9. Security and restricted information

We apply administrative, technical and organizational safeguards appropriate to our services and the information processed. Today these include: encryption in transit (TLS) for the website, dashboard, API and MCP server; passwords stored only as salted bcrypt hashes; API keys stored only as one-way hashes; connected provider keys stored encrypted and never displayed after entry; authenticated, tenant-scoped, deny-by-default access to content; short-lived sign-in tokens with server-side revocation and single-use verification and reset links; rate limits on authentication endpoints; security and audit logging of authentication, credential and administrative events; access to customer content limited to authorized personnel who need it, under confidentiality obligations; infrastructure we control with routine backups and periodic restore drills; and scrubbing of passwords, tokens and secrets from error reports.

No service can promise absolute security. Prism IO is not SOC 2 certified today, and we do not claim certifications, audits or insurance coverage that we do not hold. A supplier’s security attestation does not mean that the whole Prism IO service holds the same attestation. Security commitments specific to a customer are stated in its applicable agreement. If we learn of a breach affecting your personal information, we will notify you and the relevant authorities as applicable law requires. Tell us right away at support@prismio.ai (subject line “Security”) if you believe your credentials have been compromised.

Do not submit unnecessary sensitive information, government identifiers, payment-card details, account secrets, biometric identification data or children’s information through general brand features. Processing requiring special safeguards must be separately agreed.

10. Your rights and complaints

We extend the following to every user, wherever you live: access to and a portable, machine-readable copy of the personal information and content we hold about you; correction; deletion; objection to direct marketing at any time; withdrawal of consent, which does not affect earlier consent-based processing; and the cookie choices in Section 6. Depending on your jurisdiction you may also have rights to restrict or object to processing based on legitimate interests, to opt out of covered sale, sharing, targeted advertising or profiling (none of which we do), and rights concerning sensitive information and significant automated decisions.

How to exercise them.

• Export. Email support@prismio.ai from your account address with the subject line “Data export” and we will send you a complete export of your account, brand models, sessions, chat history, exports and scores in JSON. Developers can also call the account export endpoint documented in the API reference with their own credential. We aim to deliver within 30 days.
• Delete. Email support@prismio.ai from your account address with the subject line “Delete my account”, or call the account deletion endpoint documented in the API reference with your own credential. Deletion is immediate and cannot be undone: your account, brand models, sessions, chat history, uploaded files and connected keys are removed, your Brand Audit account on prismio.ai is deleted, and your identifiers are removed from audit records. Records we must keep by law (billing and tax records, and de-identified audit entries) are retained as described in Section 7.
• Everything else. Email support@prismio.ai from the address on your account, call +1 (310) 849-0119, or write to the mailing address below.

We verify requests proportionately, normally by confirming control of your account email, and may ask for more information for sensitive requests. Authorized agents may act with proof of authorization. We respond within the time the applicable law requires: within 30 days for GDPR and UK GDPR requests (extendable by 60 days for complex requests, with notice) and within 45 days for California requests (extendable by 45 days, with notice), explaining any permitted exception. We do not discriminate against you for exercising privacy rights. You may ask us to review a denied request; where a formal appeal right applies, we provide the process and further complaint options, including how to contact your state attorney general.

Where we process information on a customer’s behalf (for example, your details appear in a customer’s brand materials), please contact that customer; we will support them in responding.

California residents. In the past 12 months we have collected these categories of personal information, from the sources and for the purposes in Sections 2 and 3: identifiers (name, email, IP address, account identifiers); customer records (billing name and address, payment method details held by our processor); commercial information (plans purchased, transaction history); internet and network activity (usage, device and connection data, cookies); approximate geolocation derived from IP; audio (only if you use a voice feature); professional information (organization, role, brand type); and inferences about your brand drawn from the content you provide, which describe your brand, not you. We do not collect the sensitive personal information categories other than account login credentials, which we use only to authenticate you. We disclose these categories to the service providers in Section 5 for business purposes. We have not sold personal information in the past 12 months. Where the Meta Pixel is enabled on prismio.ai, we “share” identifiers and internet activity with Meta for cross-context behavioral advertising, and you can opt out through “Your privacy choices” in Section 6 or the “Your Privacy Choices” link in our website footer; we honor Global Privacy Control signals as that opt-out. You have the rights to know, delete, correct, opt out of sale or sharing, limit use of sensitive personal information and not be discriminated against, exercised as described above. There is no financial incentive program: the free Brand Audit is a free service, not a payment for data, and you may delete the account it creates at any time.

Other U.S. states. Residents of states with comprehensive privacy laws have similar rights of access, correction, deletion, portability and opt-out, which we honor through the process above regardless of whether a particular statutory threshold applies to us.

EEA, UK and Switzerland. You may lodge a complaint with your supervisory authority (in the UK, the Information Commissioner’s Office). Canada. We comply with PIPEDA and applicable provincial laws; you may complain to the Office of the Privacy Commissioner of Canada. We would appreciate the chance to address your concern first, and contacting us does not waive access to a regulator.

11. Children

Prism IO’s services are for adults acting for businesses or in a professional capacity and are not directed to children. We do not knowingly collect personal information from anyone under 18 and do not allow anyone under 18 to create an account. Institutions that use an education plan are responsible for their students’ eligibility and for any consents their students’ data requires under their agreements with us. If you believe a child has supplied personal information, contact us and we will delete it.

12. Policy changes

We publish updates here and identify the effective date. If we make a material change, we will give at least 30 days’ notice by email to your account address or by a prominent notice on the services before it takes effect, and we will not apply a material change to how we use previously collected information without your consent where the law requires it. Posting a revised policy does not change your marketing preferences, authorize optional training or override a signed agreement. Prior versions are available on request.