Legal / privacy

Privacy,
plainly.

This notice explains what we collect when you visit the Prism Labs websites, join the waitlist or ask for a pilot, how we keep business contact records, and what you can choose.

Who is responsible

Prism Labs operates these websites and is the contact for their data practices. Formal entity and postal notice details will be added before commercial contracting begins. Send questions or requests to [email protected].

Information processed

Website and security data

Our hosting and network providers may process request data such as IP address, approximate location derived from IP, browser and device information, requested URL, timestamps, referral information, and security or performance events. We use it to deliver, protect, troubleshoot, and understand the websites.

Basic visit counts (everyone, no cookie)

We count visits ourselves, on a server we operate, to learn which pages are useful and what is broken. For each page we store: the page and site, the site you came from (its domain only), campaign tags in the link (such as utm_source) and, on the rover simulator, the field number you opened; what you clicked (the label of the link or button); how far down the page you scrolled and how long it was on screen; how fast it loaded; any script error it showed; steps you took in our tools (for example, loading a field in the simulator); your approximate location (city, region and country), looked up from your IP address on our own server with a location database, without keeping the address; and whether the device is a phone, tablet or desktop. Visits are tied together only by a visitor code that is a one-way hash of your IP address and browser type mixed with a random value we replace every day and delete after two days, so it cannot be turned back into an IP address or linked across days. These counts use no cookie and nothing stored in your browser, and never include what you type. Events are deleted after 400 days. We may also use Cloudflare Web Analytics for aggregate traffic and performance measurement; Cloudflare states that this service does not collect or use visitors’ personal data, and Cloudflare may set a security cookie to tell people from bots.

With your permission

We show a cookie banner on your first visit. If you choose Accept all:

• A visitor cookie. We set a cookie named prism_vid holding a random code, shared across our sites, which lasts 13 months. It lets us recognise a return visit and see the pages you read across visits.
• Your IP address. We store your full IP address with each visit event, to understand where our visitors are and to investigate abuse. IP addresses are cleared after 90 days.
• A recording of your visit. We record how pages change as you use them: scrolling, clicks, mouse movement and what appeared on screen, so we can see where pages confuse people. Everything you type into any field is hidden in your browser before anything is sent, and never reaches us. Recordings are stored on our own server and deleted after 30 days. The 3D rover simulator is not recorded.
• Linking your visits to your waitlist or pilot request. If you later join the waitlist or ask for a pilot, we attach the visitor cookie to your entry so we can see which pages you read before joining.

If you choose Reject all, only the basic counts above apply. We remember your choice in a cookie named prism_consent for 13 months. You can change it at any time with Privacy choices, also linked at the bottom of every page; choosing Reject all deletes the visitor cookie. Ask us at the address below and we will delete the visits, recordings and IP addresses linked to you.

Global Privacy Control and Do Not Track

If your browser sends a Global Privacy Control or Do Not Track signal, we treat it as a refusal: no banner, no visitor cookie, no stored IP address and no recording. Only the basic counts above apply, which link nothing across days and are never shared.

What we do not do

We do not run advertising pixels or advertising analytics, track you on other companies’ sites, fingerprint your device, buy data about you, or sell or share personal information for advertising. If that ever changes, this notice will change first.

Information you send

If you email us, we receive your address, message, attachments, and delivery metadata. We use it to respond, evaluate early access, handle a privacy or security report, and maintain an appropriate business record.

The waitlist and pilot forms

If you join the waitlist or ask for a pilot, we store what you type into the form: your name, work email, organisation, the platforms or pilots you chose, and anything you wrote about how you would use Prism. We also store which page the form was on and, only if you chose Accept all, your visitor cookie (see above). We store it in a database and a customer-records system on servers we operate ourselves. We do not store your IP address or browser details with your entry; your IP address is used briefly in memory to limit repeated submissions. When you join, we are sent a notification email containing the same details. We use your entry only to contact you about access to Prism. We do not add you to a newsletter, and we do not share the list.

Business contacts

We keep records of people we work with or may work with: investors, programme and university staff, prospective customers and partners. A record can hold a name, work email, phone number, role, organisation, business address, website and professional profile links, where the details came from (for example a business card you gave us, an introduction, or a public professional listing such as your organisation’s own website), the date we added it, and our notes on conversations and next steps. Each record notes how we came to have it, because a public listing tells us how to reach someone, not that they agreed to hear from us. Records are kept in our customer-records system on servers we operate ourselves. We use them to keep track of professional relationships and to contact people about Prism; if you ask us to stop, we mark your record and stop. Write to the address below to see, correct or delete your record.

Google account data in our internal tools

Our customer-records system can be connected to the Gmail account of a Prism Labs team member who chooses to connect their own account; it is not offered to anyone outside Prism Labs. Once connected, it asks Gmail only for email sent to, from or copied to a prismlabs.solutions address and keeps nothing else, so that our business correspondence appears on the matching contact and company records. It can also send an email, or save it as a Gmail draft, when a team member writes or approves that email in the system and chooses to send or save it; it never sends anything on its own, does not delete or change other email, and does not read calendar events. This data is stored on servers we operate. It is not given to the AI assistants we use, not used for advertising, not sold, and not used to develop, improve or train AI or machine-learning models. No one reads it except the team member whose account it is, or as needed for security or to comply with the law. Disconnecting the account removes its synced email from the system; access can also be withdrawn at any time in the Google Account’s security settings.

Prism Labs’ use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Purposes and disclosures

• Operate, secure, and improve the public websites, including learning which pages lead people to join the waitlist.
• Respond to inquiries and early-access requests.
• Keep track of our professional relationships and contact people about Prism.
• Detect abuse and investigate security events.
• Comply with legal obligations and protect rights.

Cloudflare provides network delivery, security, analytics, and email-routing infrastructure. Resend delivers the email we send, including the waitlist notification email to us. Google provides company email to our customer-records system when a team member connects their own Gmail account. Telegram delivers reminders and short summaries to our team about our own deadlines, tasks and pipeline; they can name the organizations and people involved and include counts of email waiting for a reply, never the content of email. AI assistants from Anthropic and OpenAI that we use to work with our business contact records receive the records a request needs, without the content of emails kept with them; they are not given synced Google account data. We may disclose information when required by law, to investigate abuse, or to providers working under our direction. We do not sell personal information.

Retention

We retain information only as long as reasonably necessary for its purpose, security, legal obligations, and disputes. Email may be retained as a business record. Visit events: 400 days. IP addresses: 90 days. Recordings: 30 days. A waitlist entry is kept until you have been given access or ask us to remove it; write to the address below and we will delete it. Business contact records are kept while they serve a professional relationship, and deleted when you ask. Synced email is kept while the account stays connected and removed when it is disconnected. Provider logs follow the applicable provider configuration.

Your choices and rights

Depending on your location, you may request access, correction, deletion, restriction, objection, portability, or appeal, and you may withdraw permission at any time with Privacy choices. We may need to verify a request before acting. We honour Global Privacy Control as an opt-out.

Cookies and browser storage

prism_consent remembers your banner choice (13 months). prism_vid is the visitor cookie, set only after Accept all (13 months). While a recording runs, a session code is kept in your browser tab’s session storage and disappears when the tab closes. We set no advertising cookies.

Children, transfers, and changes

The site is for professional audiences and is not directed to children under 13. Information may be processed in the United States and locations where providers operate. Material changes will be posted here with a new effective date.