Privacy Policy

1. Information We Collect

We collect several types of information to provide and improve our services to you:

• Personal Identification Information (PII): Name, email address, phone number, and location data when you register for an account.
• Professional & Career Data: Information you provide about your professional background, industry, company, job title, and career goals.
• User-Generated Content: Documents, files, strategies, and notes you upload or create within your workspace.
• AI Interactions: Chat histories, prompts, and queries you submit to our AI systems (including "Airis"), as well as the AI-generated responses.
• Social & Collaboration Data: Information about your connections within the platform, direct messages, and shared workspaces.
• Email Sent to a PRISM Address: If someone sends an email to a PRISM email address, we store that email, including the sender's name and address, its contents, and its attachments, in the inbox of the account that address belongs to. This applies whether or not the sender has a PRISM account. If you ask Airis about something in your PRISM inbox, Airis may read the relevant messages to answer you, including emails sent to your PRISM address and their attachments.
• Technical Data: IP addresses, browser types, operating systems, and platform usage metrics (e.g., login times, features used).
• Billing Information: Payment histories and subscription details (payment processing is handled securely by our third-party payment providers).

2. How We Use Your Data

We use your data strictly to operate, secure, and improve PRISM OS:

• Service Delivery: To manage your account, authenticate you, and provide workspace functionality.
• AI Processing: To generate strategic insights, provide tailored advice, and maintain context across your interactions with our AI systems. Your data helps personalize your experience.
• Communication: To send you service updates, daily digests, security alerts, and support messages.
• Security & Fraud Prevention: To monitor for suspicious activity and protect the integrity of our platform.
• Analytics: To understand how users interact with PRISM OS and improve our features.

3. Third-Party Processors

To deliver our service, we rely on trusted third-party providers. We do not sell your data to these providers; they act as data processors on our behalf, and each maintains its own security and compliance program.

The providers below reflect our standard configuration and may include vendors that not every account uses: several apply only when you use a particular feature, and enterprise or custom configurations may substitute, restrict, or omit specific vendors. For the current list that applies to your account, or to discuss a custom configuration, contact us (Section 8).

AI model and research providers:

• Anthropic: AI model provider. We send your prompts and relevant context to Anthropic's APIs to generate responses. Note: We have enterprise agreements ensuring your data is not used to train their foundational public models without explicit consent.
• OpenAI: AI model provider. Powers portions of our conversational AI, voice features, and text embeddings for knowledge search. Receives prompts, relevant workspace context, and documents submitted for analysis.
• Google (Gemini and Web Risk): AI model provider and web safety screening. Gemini contributes supplementary analysis in multi-model panel sessions and receives prompts and relevant workspace context for those sessions. Web Risk receives the address of each web page Airis is asked to read, before it is fetched, to screen it against known unsafe sites.
• Perplexity: AI-powered web search. Receives search queries derived from your prompts when real-time internet research is performed on your behalf.
• Voyage AI (a MongoDB company): Text embeddings for knowledge search. Receives workspace text — briefs, notes, activity summaries, document excerpts, and saved memories — to convert into numerical search vectors; it does not generate responses.
• Deepgram: Meeting transcription. When you record a meeting or upload meeting audio, that audio is sent to Deepgram to be converted into text with speaker separation. Deepgram does not train on customer data. You may instead choose AWS-only transcription, which keeps the audio inside our own AWS account and sends it to no other provider.

Infrastructure and communications:

• Supabase: Database hosting, file storage, and user authentication.
• Vercel: Web application hosting, serverless function execution, and privacy-friendly aggregate analytics. If you choose one of the free AI models offered through Vercel, your prompts and relevant workspace context are routed through the server platform, Vercel, for contracted zero data retention (ZDR) and no-training terms.
• Amazon Web Services (AWS): Background job execution for longer-running work, such as multi-model panel sessions and document processing, and the isolated browser Airis uses to read web pages on your behalf. Prompts and relevant workspace context for those jobs pass through AWS infrastructure while a job runs. If your turn runs on Amazon Nova, the model itself runs inside AWS, which does not retain your prompts or use them for training. Requests to the other AI models are sent directly to the model providers listed above, or routed through Vercel as described in its entry.
• E2B: Isolated, sandboxed code execution for data analysis features. Workspace data may be processed inside these sandboxes when you use analysis tools.
• Resend: Sending email from PRISM, and receiving email sent to PRISM addresses.
• Daily: Hosted video meetings. If you start or join a call inside PRISM OS, Daily operates the real-time audio and video for that call and, if the call's owner turns on recording, transcribes it. Recordings and transcripts are written directly into our AWS storage; Daily does not retain recordings or transcripts.
• Composio: Only if you choose to connect third-party tools (e.g., Google, Slack) to your workspace: Composio orchestrates those integrations, holding the authorization tokens for your connected services and processing the data exchanged with them. If you connect no tools, no data flows to Composio.

Analytics:

• PostHog: Product analytics and feature-usage measurement.
• Microsoft Clarity: Session replay and heatmap analytics, used to understand and improve the user experience. Runs only where analytics cookies have been consented to (see Section 6).

4. Data Retention

We retain your information for as long as your account is active or as reasonably necessary to provide our services. Some actions — such as editing or regenerating a conversation — delete the underlying data immediately and permanently.

When you delete content or your account, it is removed from your workspace and is no longer visible to you or other users, or used to inform AI responses. We may retain deleted records where reasonably necessary to comply with legal obligations, resolve disputes, prevent fraud and abuse, or establish, exercise, or defend legal claims, after which they are permanently removed from our systems. Account billing and payment records are retained as required by law.

5. Your Data Rights

Depending on your location (e.g., GDPR in Europe, CCPA in California), you have significant rights regarding your data:

• Right to Access / Data Portability: You can request a complete export of your data at any time via your Account Settings. This data will be provided in a structured, machine-readable format (.zip containing JSON files).
• Right to Erasure (Right to be Forgotten): You may delete your account and content through the platform's settings. We honor erasure requests except where continued retention is permitted by applicable law — such as for compliance with a legal obligation or the establishment, exercise, or defense of legal claims (Article 17(3) GDPR).
• Right to Rectification: You can update or correct your personal data at any time via your profile page.
• Right to Restrict Processing: You may opt-out of certain data processing activities, such as AI memory retention, via your account settings.

6. Cookies and Tracking

We use cookies and similar tracking technologies to track activity on our platform and hold certain information:

• Essential Cookies: Required for authentication and security. You cannot opt out of these.
• Functional Cookies: Remember your preferences (e.g., theme, sidebar state).
• Analytics Cookies: Help us understand how users interact with the platform. This includes session replay tooling (Microsoft Clarity), which records how you navigate and interact with pages so we can improve the experience. Session replay runs only if you accept analytics cookies, and you can decline or withdraw that consent at any time via the cookie banner.

You can instruct your browser to refuse all cookies or to indicate when a cookie is being sent. However, if you do not accept essential cookies, you may not be able to use some portions of our service.

7. Security Measures

We implement robust security measures, including encryption at rest and in transit, strict access controls, and regular security audits. However, no method of transmission over the Internet or method of electronic storage is 100% secure.

8. Contact Us

If you have any questions about this Privacy Policy or wish to exercise your data rights, please contact our Data Protection Officer at: