Who operates the service
Prismatory is an independent beta project. Privacy questions and requests can be sent to [email protected].
Information we process
- Account and access: email address, an internal account identifier, code-delivery status, authentication challenges, and protected hashes or digests used for sessions, codes, and abuse controls. If you choose Google sign-in, Prismatory also receives your verified email address and a Google account subject identifier used to recognize the same sign-in securely.
- Observation content: the submitted subject, generated model material, the resulting public observation, and methodology, provenance, cost, and operational records.
- Billing and subscriptions: customer, order, subscription, variant, and invoice references; plan and subscription status; period allowances, reservations, use, refunds, reversals, and dispute adjustments. Prismatory does not receive or store your full payment-card number.
- Service and security data: timestamps, request status, technical errors, and server or network logs that may include an IP address and user-agent information.
- Limited analytics: local, first-party product events with an ephemeral browser-session identifier. Browser “Do Not Track” is honored.
How information is used
Information is used to authenticate accounts; create and serve observations; preserve the public research archive; manage subscriptions, allowances, payments, refunds, and disputes; prevent abuse and protect security; diagnose reliability; communicate essential service messages; and comply with legal obligations.
Prismatory does not sell personal information and does not use behavioral advertising.
What becomes public
The subject you submit, the generated observation, and non-personal methodology or provenance can become publicly accessible and may be retained for reproducibility and archive integrity. Your email address is not displayed publicly. Any account reference included in provenance is opaque rather than an email address.
Do not submit private, confidential, sensitive, or identifying information. Treat the subject field as public.
Service providers
Information is shared only as needed to operate the service:
- OpenAI, Anthropic, Google Gemini, Perplexity, xAI, DeepSeek, Mistral AI, and Meta receive the subject or related measurement prompts to produce new eight-system observations.
- Resend delivers passwordless access emails.
- Google Identity Services provides optional Google account authentication. Prismatory requests only basic identity information needed to sign you in and does not request access to Gmail, Google Drive, or other Google content.
- Lemon Squeezy provides checkout, payment, tax, refund, and chargeback services as merchant of record.
- Cloudflare provides domain, network-delivery, and security infrastructure.
These providers may process information in other countries under their own privacy and security terms.
Cookies and local storage
Prismatory uses an essential, secure session cookie for account access. Optional Google sign-in loads Google Identity Services when it is enabled; Google may receive ordinary connection information under its own privacy terms. Prismatory does not use advertising cookies. Limited first-party analytics may use an ephemeral identifier in session storage and is disabled when the browser signals “Do Not Track.”
Retention
- An access code is valid for ten minutes. A login session lasts no more than thirty days unless revoked sooner.
- Account, security, billing, subscription, allowance, and payment-audit records are retained as reasonably necessary to operate the account and meet fraud, accounting, legal, and security obligations.
- Public observation artifacts may be retained for reproducibility and archive integrity.
- Operational and analytics logs are retained only as reasonably needed for reliability, security, and audit purposes.
Your choices and rights
You may ask to access, correct, or delete account information, or object to or restrict certain processing, by contacting [email protected]. Applicable rights vary by location.
Deletion may not remove information that must remain in immutable billing or security records, or a public research artifact retained for archive integrity. Where feasible, Prismatory can disconnect an account’s attribution from such an artifact.
Security, children, and changes
Prismatory uses access controls and protected identifiers designed to reduce risk, but no internet service can guarantee absolute security. The service is not directed to children, and purchases must be made by an adult able to enter a contract.
This notice may change as the beta evolves. The date above identifies the current version.