Privacy Policy

Last updated: 2026-10-07

Draft — not yet effective. Prism Portal is pre-launch and the operating legal entity has not been formed. Items marked to be completed require counsel review before these pages are relied on commercially. Draft for legal review — adapt to your jurisdiction (GDPR / UK GDPR / CCPA-CPRA / PIPEDA, etc.) and confirm your role (controller vs processor) and lawful bases with counsel before publishing. Fill bracketed items.

1. Who We Are

RC4 Company Day ("we", "us") provides an operations-management platform. This Policy explains how we handle personal data when you use the Service. For Customer Data you upload about your own customers/employees, you are typically the controller and we act as your processor. Contact: hello@prismportal.cloud.

2. Data We Collect

Account data — name, email, role, hashed credentials, and authentication metadata.
Customer Data — the operational records you enter (inventory, orders, shipments, financials, contacts). May include personal data about your contacts/employees.
Usage & log data — IP address, device/browser info, actions taken, timestamps, and audit-trail entries, used to operate and secure the Service.
Cookies — a session cookie for authentication and a preference cookie (e.g. theme). We do not use third-party advertising cookies.

3. How & Why We Use Data (Lawful Bases)

To provide the Service (performance of contract) — authentication, delivering features, support.
To secure the Service (legitimate interests) — abuse prevention, logging, audit trails.
To communicate (contract / legitimate interests) — account, security, and (if opted in) digest emails.
To comply with law (legal obligation) — record-keeping, responding to lawful requests.

We do not sell personal data and do not use it for cross-context behavioral advertising.

4. Subprocessors

Third-party services used by the deployment may process data to provide the Service: Amazon Web Services (AWS) (hosting and database backups), Microsoft 365 (transactional email where configured), Geoapify (map tiles where enabled), the AI provider you configure for Ask Prism, and channel integrations you enable (e.g. Shopify, Walmart, Amazon). Ask Prism sends relevant permission-filtered operational context to the configured AI provider; map requests may expose connection information to the tile provider. Available providers and deployment-specific configuration should be confirmed before onboarding. This draft does not establish a reviewed contractual subprocessor list.

5. Data Storage, Location & Security

Data is stored on our hosted infrastructure in the United States (AWS us-east-1, N. Virginia). Sensitive secrets (e.g. integration credentials) are encrypted at rest; traffic is served over TLS; access is restricted by role-based permissions. See our Security page.

6. International Transfers

If data is transferred across borders, we rely on appropriate safeguards (e.g. Standard Contractual Clauses) where required by applicable law.

7. Retention

We retain Customer Data while your account is active and for a reasonable period afterward to allow export, then delete or anonymize it upon request or per our retention schedule. Audit and security logs are retained for 90 days.

8. Your Rights

Access & portability — export your data as CSV/Excel at any time.
Correction & deletion — request correction or deletion of your personal data.
Restriction / objection — where provided by applicable law.
Withdraw consent — e.g. unsubscribe from the digest.

To exercise rights, contact hello@prismportal.cloud. You may also lodge a complaint with your local data-protection authority. For end-user data you process as a controller, direct such requests to your own privacy contact.

9. Children

The Service is not directed to children and is intended for business use only.

10. Changes

We may update this Policy; material changes will be communicated and the "last updated" date revised.

11. Contact

hello@prismportal.cloud · RC4 Company Day · [to be completed — pending legal entity formation & counsel review].