Prisma Privacy Policy

Last updated: September 30, 2026 · Versión en español

This policy explains what personal data Prisma processes, why, who we share it with and what rights you have, wherever you are. Prisma is offered in several countries; when your country's law gives you more rights or sets additional rules, we apply that law. At the end there are specific sections for the European Union, European Economic Area, Switzerland and United Kingdom; the United States; Brazil; and Latin America.

1. Who is responsible for your data

Jhon Sebastian Jaramillo, an individual with ID number 1088349265, domiciled in Colombia ("Prisma", "we", "us"), is responsible (under the GDPR, the "controller"; under other laws, the "business") for the personal data collected through the Prisma app, its website and related services.

Privacy contact: brokenwatchceo@gmail.com.

2. What Prisma does

Prisma is a synthetic research tool: it shows ads, prices, pages, messages or ideas to fictional "citizens" generated by software and measures how they would react. Prisma's citizens are not real people and their answers are not surveys of people. We don't make decisions about you based on those results.

3. What data we process

• Account: email address, user ID and, if you use Sign in with Apple, the identifier Apple gives us (which may be a private Apple relay email).
• Content you submit for your studies: text, images, scripts, prices, funnel stages, custom questions, change instructions and ad links you choose to import.
• Populations, test subjects and contacts: markets, territories, zones, test-subject profiles (created by hand, with AI or from templates), the fixed panel and the contacts you edit. They must be fictional.
• Imported audiences: CSV or GeoJSON files with aggregated targeting attributes. Names, emails, phone numbers, addresses, ID numbers, advertising identifiers and sensitive data are not allowed; the app rejects such columns.
• Results: reactions, metrics, objections, segments, zones, curves, insights and interviews generated for your studies, plus technical model usage (number of questions, requests and tokens).
• Prismas and purchases: balance, transactions (bonuses, reservations, refunds, purchases, rewards and AI uses) and App Store transaction identifiers. We don't receive or store card data: Apple processes payments.
• Security and abuse prevention: usage limits per minute, hour and day and, when enabled, an Apple DeviceCheck token to limit the welcome bonus to one device. DeviceCheck doesn't give us a device identifier.
• Voice (optional): if you dictate a search, Apple's speech recognition turns it into text, on the device when possible. Prisma doesn't record or keep the audio; it only uses the resulting text.
• Language and preferences: the app's language, so we can answer you in it, and preferences such as appearance or chosen market.
• Minimal technical data: error and service usage logs needed to run and protect the service.

Your device also stores your session (in the Keychain), preferences, study drafts, insights and a local copy of your populations.

Sensitive data. We don't ask for or want sensitive data (health, ethnic origin, religion, sexual orientation, political opinions, biometric data or data about children). Don't include it in your content.

4. Why we use it and on what legal basis

We don't use your content to train our own models, we don't sell your data and we don't profile you for third-party advertising.

5. Who we share it with

Only with providers that deliver the service for us (processors), under contract and with the information needed for each task:

When you create a public link to a result, anyone with the link sees the aggregated summary (metrics, reactions, zones and segments), but not your account, your image or the full content you submitted. You can revoke it at any time.

We may also disclose information if a competent authority requires it under the law, to protect people's rights or safety, or as part of a merger or sale of the business, in which case we'll notify you and this policy will keep applying.

6. International transfers

Prisma and its providers operate in several countries, including the United States, the European Union and Colombia. Your data may be processed outside the country where you live. Where the law requires it, we use appropriate safeguards such as the European Commission's Standard Contractual Clauses (and the UK Addendum), adequacy decisions or equivalent mechanisms, and we only work with providers that apply appropriate security measures. You can ask us for more information about these safeguards.

7. How long we keep it

• While your account is active.
• Working data for a running study (the list of citizens sent to the model) is deleted when the study ends.
• When you delete your account we delete your profile, studies, content, results, synced populations, public links, achievements and transactions, except purchase records the law requires us to keep, for as long as the law requires.
• Backups are overwritten in short cycles; deleted data disappears from them as they rotate.

8. Your rights

Depending on where you live, you may have the right to:

• Access your data and get a copy, including in a portable format.
• Correct inaccurate or incomplete data.
• Delete your data.
• Object to or restrict processing.
• Withdraw your consent at any time, without affecting what was done before.
• Not be discriminated against for exercising your rights.
• Lodge a complaint with your country's data protection authority.

How to exercise them:

• Delete your account and all your data in the app: Profile → Danger zone → Delete account and all my data. The website also explains how at /delete-account.
• Withdraw consent to third-party AI in Profile → Third-party AI.
• Email us at brokenwatchceo@gmail.com for any other request. We may ask you to confirm you own the account. You can act through an authorized agent where your law allows it.

We answer within the deadline your law sets; generally within 30 days at most.

9. Security

We use encryption in transit, per-user authentication, row-level access rules in the database, service keys kept only on the server (never in the app) and session storage in the device Keychain. No system is perfectly secure; if an incident affects your data, we'll notify you and the authorities where the law requires it.

10. Children

Prisma is not directed to anyone under 18 and we don't knowingly collect their data. If you believe a minor has given us data, email us and we'll delete it.

11. Regional information

European Union, European Economic Area, Switzerland and United Kingdom

The General Data Protection Regulation (GDPR), the UK GDPR and the Swiss Federal Act on Data Protection apply. The legal bases are in section 4. You also have the right to data portability and to object to processing based on legitimate interest. We don't make decisions based solely on automated processing that produce legal effects on you or similarly significantly affect you. You can complain to the supervisory authority of the country where you live or work. If the law requires it, we'll appoint a representative in the European Union and in the United Kingdom and publish their details on this page.

United States

If you live in California or another state with a comprehensive privacy law (for example Colorado, Connecticut, Virginia, Utah, Texas, Oregon or New Jersey):

• Categories of data in the last 12 months: identifiers (email, account ID), commercial information (purchases and Prisma transactions), activity on the service, content you submit, audio processed by Apple only for dictation (we don't keep it) and inferences about your studies. Sources, purposes and recipients are in sections 3 to 5.
• We don't sell your personal information. We don't share them for cross-context behavioral advertising, and the app doesn't track you across other companies' apps or websites. We honor legally recognized opt-out signals, such as Global Privacy Control, where they apply.
• Sensitive personal information: we don't collect it or use it to infer characteristics about you.
• You have the right to know, access, correct, delete and opt out, and not to be discriminated against for exercising those rights. If we deny your request, you can appeal by emailing brokenwatchceo@gmail.com.

Brazil

The General Data Protection Law (LGPD) applies. You have the right to confirmation of processing, access, correction, anonymization, blocking or deletion, portability, information about who we share your data with and withdrawal of consent, and you can complain to the ANPD. Data protection officer contact: brokenwatchceo@gmail.com.

Latin America

• Colombia: Law 1581 of 2012 and Decree 1377 of 2013. We answer inquiries within 10 business days and claims within 15 business days at most. You can go to the Superintendence of Industry and Commerce (SIC).
• Mexico: Federal Law on the Protection of Personal Data Held by Private Parties. You can exercise your ARCO rights (access, rectification, cancellation and opposition) and withdraw your consent by emailing brokenwatchceo@gmail.com.
• Argentina: Law 25,326. The Agency for Access to Public Information is the supervisory authority.
• Chile, Peru and other countries: we apply their data protection laws and handle the rights they give you through the same channels.

12. Changes to this policy

If we make significant changes, we'll let you know in the app before they take effect. The date at the top shows the latest version.

13. Language

This policy is available in Spanish and English. If they differ, the version in the language your law requires prevails; otherwise, the Spanish version prevails.

14. Contact

Jhon Sebastian Jaramillo · Colombia · brokenwatchceo@gmail.com