Privacy Policy

1. Who we are

PrismPoster is operated by PrismLabs OÜ. This policy explains how we collect, use, disclose, retain, and protect personal data when you visit https://www.prismposter.com or use PrismPoster's SaaS application, generation tools, creation and editing workflows, community features, and related services.

For account, billing, website, security, analytics, and product operations, we generally act as the data controller. For customer content that a business user uploads or processes on behalf of its own customers or audience, we may act as a processor under the applicable customer agreement or data processing addendum.

2. Personal data we process

• Account data: name, email address, profile image, public usertag, password hash, OAuth provider identifiers, and verification state.
• Billing data: Stripe customer, subscription, invoice, credit, and transaction metadata. We do not store full payment-card numbers.
• Content and media data: prompts, drafts, uploaded files, generated text, images, videos, music, captions, metadata, exported media, and published community content.
• Connected-account data: for connected accounts (e.g. Twitch, YouTube, or a previously connected X/Twitter account), the connected-account username, granted scopes, connection status, and encrypted access tokens needed to power the connected features.
• Usage, device, and security data: IP-derived request metadata, browser/device information, rate-limit events, audit logs, diagnostics, and consent-choice records.
• Approximate location: the country your request comes from, derived by our content-delivery network from your IP address and recorded when you sign up. It is country-level only — we do not collect precise location, GPS coordinates, or device location data — and we use it to understand which markets our signups come from and to determine eligibility for free and promotional offers, as described in section 3.
• Support and feedback: messages, attachments, contact details, and administrative notes needed to respond to you.

3. Why we process data

We process personal data only when we have a lawful basis, including:

• Contract performance: creating accounts, authenticating users, generating content, storing projects, providing downloads, and billing subscriptions.
• Consent: optional analytics/marketing cookies and other opt-in workflows where consent is requested.
• Legitimate interests: service security, abuse prevention, debugging, reliability, fraud prevention, and product improvement that does not override your rights. This also covers our cookieless first-party measurement of page views and product usage, which stores nothing on your device and uses a per-day code that cannot be linked across days or reversed to your IP address. It respects Global Privacy Control and Do Not Track, and account holders can switch it off in privacy settings.
• Legal obligations: tax, accounting, sanctions, security, consumer protection, copyright, and regulatory compliance.

3.1 Eligibility for free and promotional offers

Free plans, trial credits, and complimentary generations are discretionary offers rather than part of a paid contract, and they are not available in every country or region. To decide whether an account receives one, we use the country associated with your request — derived from your IP address by our content-delivery network, or, where that is unavailable, from the registration country of the network your request came through — together with the anti-abuse checks described in section 2. Our lawful basis is our legitimate interest in setting the terms on which we make a free promotion available, and in preventing the same person from claiming it repeatedly.

This decision affects only whether a free promotional credit is granted. It is not a decision producing legal or similarly significant effects, and Article 22 of the GDPR does not apply: your account is created and fully usable either way, every paid plan and credit pack remains available on identical terms, and nothing you purchase is affected. Where an offer is unavailable to you, we tell you so in the product. The contractual terms are set out in section 3.5 of our Terms of Service. If you believe an eligibility decision about your account is wrong, contact us using the details in section 12 and a person will review it.

4. Cookies, analytics, and privacy signals

Essential cookies and storage keep authentication, security, consent records, and core product workflows working. Optional analytics, functional, and marketing categories load only according to your cookie choices. See the Cookie Policy.

PrismPoster honors browser Do Not Track and Global Privacy Control by keeping optional analytics and marketing disabled. You can also manage choices at Privacy Choices or, when signed in, at Settings > Privacy.

5. Sub-processors and third parties

We use vetted service providers for hosting, database storage, payments, transactional email, browser analytics after consent, operational and security telemetry (error and performance monitoring on a legitimate-interest basis), AI/media generation, font delivery, and file storage. For checkout purchases, Stripe acts as merchant of record and processes the related billing data as an independent controller under its own privacy policy. The current list is maintained on our Sub-Processors page.

If you opt a track into PrismRadio broadcast (optional and off by default), your public track, usertag, and cover art are aired on PrismRadio and simulcast to YouTube Live, which acts as an independent controller for its own viewers and may run its own advertising. PrismPoster may monetize these surfaces; the broadcast license is royalty-free, as described in our Terms.

We do not sell personal information for money. If optional analytics, advertising, or cross-context disclosures are considered a sale or sharing under applicable US privacy law, you can opt out through Privacy Choices, Global Privacy Control, or Settings > Privacy.

6. Your privacy rights

Depending on your location, you may have rights to:

• Access personal data and receive information about how it is used.
• Receive portable data in a structured, machine-readable format.
• Correct inaccurate or incomplete personal data.
• Delete personal data, subject to legal, security, fraud-prevention, and billing exceptions.
• Restrict or object to certain processing.
• Withdraw consent for optional processing.
• Object to solely automated decisions with legal or similarly significant effects.
• Opt out of sale/sharing and limit sensitive personal information under CCPA/CPRA.
• Exercise rights without unlawful discrimination.
• Lodge a complaint with a data protection supervisory authority (EEA/UK residents).

Signed-in users can exercise these rights in Settings > Privacy. You can also email dpo@prismposter.com. We aim to respond within 30 days unless applicable law permits or requires a different timeline. If you are in the EEA, you also have the right to lodge a complaint with your local data protection authority. Our lead supervisory authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), Tatari 39, 10134 Tallinn, Estonia — www.aki.ee.

7. Retention and deletion

• Active accounts: account, project, media, and workspace data are retained while needed to provide the service.
• Deleted accounts: account-linked product data is deleted or detached according to the account deletion workflow. Backups are purged on their normal rotation, generally within 30 days.
• Abuse-prevention markers:so that the one-off free starter credits cannot be claimed repeatedly, we keep a one-way cryptographic hash of the sign-up email address, the network block, and the browser identifier described in our Cookie Policy. These are irreversible — they cannot be turned back into an address, an IP, or a device — and they are kept deliberately after an account is deleted, because a record that is erased with the account cannot prevent the same person from claiming the grant again. They are held for up to 24 months and are used for no other purpose.
• Legal records: billing, tax, fraud-prevention, security, audit, consent, and dispute records may be retained as required or permitted by law, typically up to 7 years for financial records.
• Aggregated data: anonymized or aggregated metrics that no longer identify an individual may be retained for product, security, and business analysis.

8. International transfers

PrismPoster and its providers may process data in the European Economic Area, United Kingdom, United States, and other countries where our providers operate. Where required, we use safeguards such as data processing agreements, Standard Contractual Clauses, transfer impact assessments, and provider security commitments.

9. Security

We use technical and organizational measures including TLS, encrypted provider storage, password hashing, scoped OAuth access, rate limiting, origin checks, audit logging, and access controls. No system is perfectly secure, but we work to prevent, detect, and respond to unauthorized access. See our Security page for more detail.

10. Children

PrismPoster is not directed to children. You may not use the service if you are under 13, or under 16 where EEA/UK law requires a higher age for consent to online services. If we learn that we collected personal data from a child without appropriate consent, we will delete it.

11. Changes

We may update this policy as PrismPoster, our providers, or applicable law changes. Material changes will be posted on this page and, where appropriate, communicated in the product or by email.