Legal & Compliance

Regulatory & compliance framework

We design with data protection from the ground up. Highlights of our approach:

• GDPR (EEA/UK): lawful basis, data subject rights, and data minimization for users in the EU/UK.
• CCPA/CPRA (California): rights to know, delete, and opt-out of sale/sharing of personal information.
• Data minimization: we collect only what the service requires (email, display name, and your task content).
• Encryption: TLS in transit, encryption at rest, and per-user API keys encrypted with Fernet.
• Isolation: row-level security isolates every account in the database.

Your data rights

You may exercise the following rights at any time by emailing [email protected]:

• Access a copy of the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Erase your account and personal data (right to be forgotten).
• Restrict or object to processing of your data.
• Request portability of your data in a machine-readable format.
• Withdraw consent where processing relies on it.

Cookies

Prysm Note uses only technically necessary cookies (for authentication and session continuity). We do not use third-party advertising or tracking cookies, and we do not run analytics scripts. A non-blocking notice is shown on first visit so you can acknowledge this and link to the full Cookie Policy.

Sub-processors & vendors

We may engage third-party sub-processors to deliver the service, including our hosting and database providers, our transactional email provider, and the LLM providers that power AI features. Hosted PrysmAI responses are processed by the OpenRouter gateway with Zero Data Retention (ZDR) enabled on every request, so prompts and completions are not stored or used for training. Each request is served by an efficient, effective model selected by region, so the exact model serving a request can vary. When you connect your own API key (BYOK), your prompts go to the provider you choose and are subject to that provider's policy; note that OpenRouter can route models across multiple hosting providers, some of which may be located outside the EEA, and you can restrict routing or enable Zero Data Retention in your OpenRouter settings. Your LLM key is used only to call the provider you configure.

Contact & DPO

For any privacy or data-protection question, contact us at [email protected]. We respond to all verifiable requests within legal timeframes.