Privacy Policy

1. Who we are and what this covers

Prizm Marketing Technologies, LLC ("PRIZM", "we", "us") runs the PRIZM media plan application at app.prizmmarketing.io (the "Service") and this website, prizmmarketing.io. This policy explains what personal information we collect through both, how we use it, who we share it with, and the choices you have.

The Service is sold to businesses. The organization that holds the subscription (the "Customer") decides who gets an account and what is entered about its clients. For information a Customer enters about its own clients, we act on the Customer's behalf as its service provider or processor, and the Customer's own privacy notice applies to those people. For account, billing, security and website data, we decide how it is used and this policy applies directly.

2. Information we collect in the Service

Account information: your first and last name, work email address, role, the organization you belong to, your password (stored only as a one-way hash), when you verified your email, and which version of our Terms and this policy you accepted and when.

Organization and billing information: legal and display name, billing email, phone number, business address, tax ID, branding colors, tagline and website, and the subscription plan. Card details are entered directly into Stripe's payment form and go to Stripe, not to us. We receive from Stripe only the customer and subscription identifiers, payment status, amounts and tax charged.

Customer Data: the questionnaires, media plans, budgets, templates, rate and vendor settings, and proposal copy your users create, and the clients you add, including a client's name, description, and point-of-contact name, email and phone number.

Security information: if you turn on two-factor authentication, an encrypted authenticator secret and hashed recovery codes. If you choose "remember this device", a signed cookie on that device. When an admin sends a password reset link, a record of who sent it, to whom and when.

Support requests: what you write in the Contact form or bug report, the page you were on, and your browser's user-agent string, plus your name, email and organization. The request is stored in the Service and emailed to our support inbox. If you email us directly, we have whatever you send.

Technical information: like any web service, our hosting provider records server logs that include IP addresses, request URLs and timestamps. We use IP addresses briefly to rate-limit sign-in and signup attempts.

3. Analytics and advertising

This website and the Service load Google Tag Manager, which runs Google Analytics and Google Ads tags. We use them to understand which pages and ads bring people to PRIZM, how the Service is used, how many visitors go on to create an account, and to show PRIZM ads to people who have visited this website or the Service (remarketing).

Each site asks for your choice the first time you visit. Until you choose, and if you decline, analytics and advertising are set to denied: no Google Analytics or Google Ads cookies are written and no advertising identifiers are used. Google may still receive limited signals without cookies, such as that a page was viewed, your browser type and the approximate location derived from your IP address, which it uses to produce aggregate, modeled statistics.

If you accept, Google sets cookies and records the pages you view, the ads you came from and events such as starting or completing signup. Inside the Service this includes the pages and features you use, but not the content of your plans, clients or other Customer Data. This data goes to Google under Google's own terms and privacy policy, and Google may use it to show you PRIZM ads on other sites and apps.

If your browser sends a Global Privacy Control signal, we treat it as an opt-out of advertising and remarketing on that browser, even if you accept: analytics may run, but advertising cookies and remarketing stay off.

Your choice is stored in your browser's local storage, not in a cookie, and is never sent to our servers. It is kept separately for this website and for the Service, so you are asked once on each. You can change it at any time with the Cookie settings link at the bottom of this website, or the Cookies link next to Terms and Privacy in the Service.

There is no contact form, newsletter signup or chat widget on this website. We do not upload email addresses or any other identifier to Google.

4. Cookies and local storage

The Service needs these cookies to work: a session cookie that keeps you signed in, a CSRF cookie that protects form submissions, and, if you choose it, a "remember this device" cookie that skips the two-factor prompt for 30 days. Your browser's local storage keeps your light or dark theme, a cached copy of your signed-in profile and your analytics choice.

When you enter a card, Stripe's payment form may set its own cookies to prevent fraud, under Stripe's privacy policy.

Google Analytics and Google Ads cookies are set on this website and in the Service only if you accept, as described in section 3.

5. How we use information

We use personal information to: create and run accounts; provide the Service, including generating and exporting plans; process payments and calculate sales tax; send transactional emails such as email verification, invitations and password resets; keep the Service secure, including two-factor authentication, rate-limiting and investigating misuse; answer support requests and fix bugs; meet legal, tax and accounting obligations; and enforce our Terms.

We also create aggregated or de-identified data, such as typical tactic mixes and budget splits by industry, from which you, your users and your clients cannot be identified, and use it to improve the Service and our planning models.

We use analytics and advertising data, if you accept, to measure and improve our marketing and the Service and to show PRIZM ads to past visitors, as described in section 3.

We do not sell personal information for money and we do not use Customer Data to train third-party AI models. Remarketing through Google Ads, which happens only if you accept, may count as "sharing" personal information for cross-context behavioral advertising, or as "targeted advertising", under some US state laws. Section 9 explains how to opt out. We send only transactional email. We do not send marketing email from the Service.

Where the GDPR or UK GDPR applies, our legal bases are: performance of our contract with you or your organization (running the Service and billing); legal obligation (tax and accounting records); our legitimate interests in securing and improving the Service and answering support requests; and consent, for analytics and advertising cookies on this website and in the Service. For Customer Data about your clients, we process it on the Customer's instructions.

6. Who we share information with

We use these service providers, who process personal information for us under contract and only to provide their service: DigitalOcean (application hosting, database and file storage, United States); Stripe (payment processing and sales-tax calculation); SendGrid, a Twilio company (transactional email delivery); and Google (Tag Manager, Analytics and Ads on this website and in the Service, with cookies and advertising only with your consent, as described in section 3).

Within a Customer, Organization Admins can see and manage the users, plans and clients in their organization. PRIZM staff can access accounts to provide support, fix problems, and handle billing and data requests.

We may also disclose information when required by law or legal process, to protect the rights, safety or property of PRIZM, our customers or others, or to a buyer or successor as part of a merger, acquisition or sale of assets, subject to this policy.

7. How long we keep information

We keep account and Customer Data while the Customer's subscription is active. When a subscription ends, the account becomes read-only for 90 days so the Customer can renew or export. After that, we may delete or de-identify user names and contact details, client names and contacts, free text such as plan names, descriptions and proposal copy, and the organization's identifying details. De-identified plan data may be kept.

Billing and tax records, such as invoices, payment and tax amounts, the organization's legal name and billing address, and the payment events Stripe sends us, are kept for as long as tax and accounting law requires, generally seven years.

Support requests and password-reset records are kept with the account. Deleted data can remain in encrypted database backups until those backups expire on their normal rolling schedule. Server logs are kept by our hosting provider for a limited period under its own retention settings.

8. Security

All traffic is encrypted with HTTPS, and browsers are told to use it every time. Passwords are hashed, two-factor secrets are encrypted, and recovery codes are hashed. Sessions expire after 24 hours of inactivity. Sign-in, signup, invitation and password-reset requests are rate-limited, and organizations can require two-factor authentication for all their users. Access to production systems is limited to PRIZM staff who need it.

No system is perfectly secure. If we learn of a breach affecting your personal information, we will notify the affected Customer and, where the law requires, you and the authorities.

9. Your rights and choices

Depending on where you live, you may have the right to know what personal information we hold about you and get a copy, to correct it, to delete it, to object to or restrict certain processing, to withdraw consent, and to appeal our decision on your request. You can update your name and password yourself in Account Settings.

To opt out of sharing for cross-context behavioral advertising, or of targeted advertising: choose Decline in the Cookie settings on this website and the Cookies link in the Service, or turn on Global Privacy Control in your browser, which we honor automatically. Because the choice is stored in your browser, make it on each browser and device you use. You can also email us and we will help.

To make a request, email [email protected] from the address on your account. We may need to verify your identity, and we will respond within the time the law requires, generally 30 days under the GDPR and 45 days under US state laws. Exercising a right will not change the price or quality of the Service you receive.

A copy of your own data includes your profile, your terms acceptances, your support requests and the password-reset links you received. Plans and clients belong to your organization, so ask your Organization Admin for those. If you are a client contact whose details a Customer entered, contact that Customer first. We will help them respond.

Deleting a user removes their name, email and password and deactivates the account, but the plans they built stay with their organization. We cannot delete information we must keep by law, such as billing records.

If you are in the EEA or UK and are not satisfied with our response, you may complain to your local data protection authority. If we deny a request under a US state law, you may appeal by replying to our decision, and if we deny the appeal you may contact your state attorney general.

10. Where information is processed

PRIZM is based in the United States and the Service is hosted in the United States. If you use it from another country, your information is transferred to and processed in the United States, where data protection laws may differ from those in your country. Customers that need a data processing agreement for these transfers can request one at [email protected].

11. Children

The Service and this website are for businesses and are not directed to children. Every user must be at least 18, and we do not knowingly collect personal information from children under 13. If you believe a child has given us information, contact us and we will delete it.

12. Changes to this policy

We may update this policy. For material changes, we will notify Customers by email or in the Service, and users will be asked to accept the updated policy the next time they sign in. The date at the top shows when it last changed.

13. Contact

Prizm Marketing Technologies, LLC, 5900 Balcones Drive, STE 100, Austin, TX 78731. Questions about this policy and privacy requests: [email protected].