Privacy Policy

1. Who we are

PrismPoster is operated by PrismLabs OÜ. This policy explains how we collect, use, disclose, retain, and protect personal data when you visit https://www.prismposter.com or use PrismPoster's SaaS application, generation tools, creation and editing workflows, community features, and related services.

For account, billing, website, security, analytics, and product operations, we generally act as the data controller. For customer content that a business user uploads or processes on behalf of its own customers or audience, we may act as a processor under the applicable customer agreement or data processing addendum.

2. Personal data we process

• Account data: name, email address, profile image, public usertag, password hash, OAuth provider identifiers, and verification state.
• Billing data: Stripe customer, subscription, invoice, credit, and transaction metadata. We do not store full payment-card numbers.
• Content and media data: prompts, drafts, uploaded files, generated text, images, videos, music, captions, metadata, exported media, and published community content.
• Connected-account data: for live-streaming integrations (e.g. Twitch, YouTube), the connected-account username, granted scopes, connection status, and encrypted access tokens needed to power live-streamer tools.
• Verified identity and likeness data: if you use consent-backed real-person features, we process capture evidence, likeness references, consent records, audience-gate data, and generated fan/video outputs for that feature. Biometric identifiers (facial geometry and voiceprint) are collected only with explicit consent and handled under the retention and deletion schedule in our Biometric Data Policy.
• Usage, device, and security data: IP-derived request metadata, browser/device information, rate-limit events, audit logs, diagnostics, and consent-choice records.
• Partner program data: if you join our creator/streamer partner program, your name, email, chosen promo code, referral attribution, and commission/payout records. We run this program ourselves and do not share these details with a third-party affiliate platform. If you arrive through a partner referral link, a strictly necessary first-party cookie records which partner referred you so they can be credited if you subscribe.
• Support and feedback: messages, attachments, contact details, and administrative notes needed to respond to you.

3. Why we process data

We process personal data only when we have a lawful basis, including:

• Contract performance: creating accounts, authenticating users, generating content, storing projects, providing downloads, billing subscriptions, and operating connected live-streaming integrations at your direction.
• Consent: optional analytics/marketing cookies, verified identity likeness capture, and other opt-in workflows where consent is requested.
• Legitimate interests: service security, abuse prevention, debugging, reliability, fraud prevention, and product improvement that does not override your rights. This also covers our cookieless first-party measurement of page views and product usage, which stores nothing on your device and uses a per-day code that cannot be linked across days or reversed to your IP address. It respects Global Privacy Control and Do Not Track, and account holders can switch it off in privacy settings.
• Legal obligations: tax, accounting, sanctions, security, consumer protection, copyright, and regulatory compliance.

4. Cookies, analytics, and privacy signals

Essential cookies and storage keep authentication, security, consent records, and core product workflows working. Optional analytics, functional, and marketing categories load only according to your cookie choices. See the Cookie Policy.

PrismPoster honors browser Do Not Track and Global Privacy Control by keeping optional analytics and marketing disabled. You can also manage choices at Privacy Choices or, when signed in, at Settings > Privacy.

5. Sub-processors and third parties

We use vetted service providers for hosting, database storage, payments, transactional email, browser analytics after consent, operational and security telemetry (error and performance monitoring on a legitimate-interest basis), AI/media generation, live-streaming integrations, font delivery, partner payout transfers, and file storage. The current list is maintained on our Sub-Processors page.

If you opt a track into PrismRadio broadcast (optional and off by default), your public track, usertag, and cover art are aired on PrismRadio and simulcast to YouTube Live and Twitch, which act as independent controllers for their own viewers and may run their own advertising. PrismPoster may monetize these surfaces; the broadcast license is royalty-free, as described in our Terms.

We do not sell personal information for money. If optional analytics, advertising, or cross-context disclosures are considered a sale or sharing under applicable US privacy law, you can opt out through Privacy Choices, Global Privacy Control, or Settings > Privacy.

6. Your privacy rights

Depending on your location, you may have rights to:

• Access personal data and receive information about how it is used.
• Receive portable data in a structured, machine-readable format.
• Correct inaccurate or incomplete personal data.
• Delete personal data, subject to legal, security, fraud-prevention, and billing exceptions.
• Restrict or object to certain processing.
• Withdraw consent for optional processing.
• Object to solely automated decisions with legal or similarly significant effects.
• Opt out of sale/sharing and limit sensitive personal information under CCPA/CPRA.
• Exercise rights without unlawful discrimination.
• Lodge a complaint with a data protection supervisory authority (EEA/UK residents).

Signed-in users can exercise these rights in Settings > Privacy. You can also email dpo@prismposter.com. We aim to respond within 30 days unless applicable law permits or requires a different timeline. If you are in the EEA, you also have the right to lodge a complaint with your local data protection authority. Our lead supervisory authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), Tatari 39, 10134 Tallinn, Estonia — www.aki.ee.

7. Retention and deletion

• Active accounts: account, project, media, and workspace data are retained while needed to provide the service.
• Deleted accounts: account-linked product data is deleted or detached according to the account deletion workflow. Backups are purged on their normal rotation, generally within 30 days.
• Legal records: billing, tax, fraud-prevention, security, audit, consent, and dispute records may be retained as required or permitted by law, typically up to 7 years for financial records.
• Aggregated data: anonymized or aggregated metrics that no longer identify an individual may be retained for product, security, and business analysis.

8. International transfers

PrismPoster and its providers may process data in the European Economic Area, United Kingdom, United States, and other countries where our providers operate. Where required, we use safeguards such as data processing agreements, Standard Contractual Clauses, transfer impact assessments, and provider security commitments.

If you opt in to verified real-person video, your liveness biometric data and portrait likeness are transferred to and stored by a specialist identity-verification provider located outside the European Economic Area, in a country without an EU adequacy decision. That transfer takes place only after your separate, explicit consent, and is safeguarded by the EU Standard Contractual Clauses (GDPR Art. 46) incorporated into our data processing agreement with the provider — which commits it to processing your data solely on our instructions and never using it to train its models. It is named on our Sub-Processors page, and the full detail is in our Real-Person Video Verification Policy.

9. Security

We use technical and organizational measures including TLS, encrypted provider storage, password hashing, scoped OAuth access, rate limiting, origin checks, audit logging, and access controls. No system is perfectly secure, but we work to prevent, detect, and respond to unauthorized access. See our Security page for more detail.

10. Children

PrismPoster is not directed to children. You may not use the service if you are under 13, or under 16 where EEA/UK law requires a higher age for consent to online services. If we learn that we collected personal data from a child without appropriate consent, we will delete it.

11. Changes

We may update this policy as PrismPoster, our providers, or applicable law changes. Material changes will be posted on this page and, where appropriate, communicated in the product or by email.