Privacy Policy

The Short Version

This Privacy Policy explains what information PRISM, Bangalore, India ("we", "us") collects when you use prismhld.com, how we use it, who we share it with, and your rights regarding it. By using PRISM, you agree to the practices described here. This policy forms part of our Terms of Service.

Information We Collect

Account data: When you register, we collect your email address, a username and a password, which we store only as a bcrypt hash. If you sign in with Google or GitHub, we receive your name, email address, profile picture and your account ID with that provider instead of a password.

Profile data: Anything you choose to add to your profile, such as your full name, phone number, company, college and job title. These fields are optional.

Onboarding answers: When you answer the onboarding questions (for example why you are using PRISM and your experience level), we store your answers to personalise missions and recommendations. Answering them is what starts your welcome trial.

Canvas designs & submissions: Architectures, component settings and simulation and stress test results you create are stored and linked to your account so you can return to them.

Evaluation and interview data: Your answers to MCQs and interview questions, trade-off responses, scores, and the AI-generated feedback.

Progress and rewards: Your hint points, XP, streaks, daily missions, unlocked hints, solved problems and any promo or referral code you redeem.

Content you share: Posts, replies and votes in problem discussions; designs you publish to the gallery and reviews you write; and stress test reports you create a share link for.

Support tickets and feedback: The category and message of tickets you raise, our replies, and ratings or comments you send us. If you raise a ticket while signed out, we also store the email address you give us so we can reply.

Live sessions: If you join a live interview or peer design session, your camera and/or microphone are used only with your browser's permission. Audio and video travel between participants' browsers, directly or through a relay server; we do not record them. We store the session's details, such as participants, times and the shared canvas.

Payment data: Payments are processed by Razorpay. We never see or store your card, UPI or bank details. Razorpay sends us the payment and order IDs, amount, currency and status, which we keep with your plan.

Usage data: Events as you use the product, such as opening modes, running simulations, submitting evaluations and completing missions, stored against your account or an anonymous session key.

Technical data: Your IP address, browser and device type, operating system, referring URL and request times, recorded in server logs. We also read the country of your connection, as reported by our CDN (Cloudflare), to show prices in your currency and charge the correct regional price.

How We Use Your Data

• Running the service: signing you in, saving your work, running simulations, delivering evaluations, granting your plan, trial and rewards, and answering support tickets.
• AI features: your designs, settings and answers are sent to OpenAI's API to generate questions, evaluations and feedback. See section 3.
• Personalisation: your onboarding answers and progress choose your missions, recommendations and reminders.
• Product improvement: analytics show which features are used and where people get stuck, so we can improve the product.
• Payments: charging the right price for your country, activating your plan, issuing refunds and keeping financial records.
• Security: IP addresses and usage patterns are used to detect abuse and fraud, rate-limit requests, and investigate incidents.
• Communications: account emails (verification, password resets, plan changes, receipts and plan expiry notices), which are always sent; and promotional emails about PRISM, such as reminders and plan offers. Every promotional email has a one-click unsubscribe link, and unsubscribing stops them for good. In-app notifications appear in your notification bell.
• Legal: complying with law, enforcing our Terms and responding to lawful requests.

Who We Share Data With

We share data with these service providers, only as far as needed to run PRISM:

• OpenAI: receives the designs, settings, answers and prompts needed for AI features. Under OpenAI's API terms, API data is not used to train their models by default, and may be kept by OpenAI for up to 30 days to monitor abuse. OpenAI's Privacy Policy applies.
• Razorpay: processes payments and refunds, and collects your payment details directly under its Privacy Policy.
• Google Analytics & Microsoft Clarity (loaded through Google Tag Manager): page analytics and session recordings, with typed text masked. They load only if you click "Accept" in our cookie banner, and you can change your choice at any time with the "Cookie settings" link in the footer.
• PostHog: product analytics, such as the pages and screens you open and the features you use or complete (for example onboarding, missions, trials and interviews). Nothing is sent to PostHog unless you click "Accept" in our cookie banner. Events go through our own servers, without query strings, and are linked to your user ID, plan and onboarding answers when you are signed in. PostHog does not record your screen, keystrokes or mouse movements.
• SendGrid: delivers our emails. It receives your email address and the content of the emails we send you.
• Cloudflare: our CDN and security layer. All traffic to prismhld.com passes through Cloudflare, which processes your IP address and request details to deliver pages, block attacks and tell us your country.
• Google and GitHub: if you choose to sign in with them.
• Live session relays: live interview and peer session audio and video may pass through STUN/TURN relay servers to connect participants.
• Hosting: our servers and database run on cloud providers (such as Render and AWS) in the United States. By using PRISM you understand that your data is transferred to and processed there, under those providers' data processing terms.

Other users: your username and anything you post or publish (discussions, gallery designs, reviews) are visible to other PRISM users. Anyone with a stress test report's share link can view that report until you delete it.

Legal and business transfers: we may disclose data when required by law or a valid legal request, or to protect the rights, safety and property of PRISM, our users or others. If PRISM is sold or merged, your data may be transferred to the new owner, who will remain bound by this policy.

We do not sell, rent, or trade your personal data to advertisers or data brokers.

Data Retention

We keep your account data, work and history for as long as your account exists. When we delete an account at your request, we delete or anonymise your personal data within 30 days, except what we must keep longer by law, such as payment and tax records, and what we need to prevent fraud or abuse (for example a record that the welcome trial or refund guarantee was used). Discussion posts and reviews may remain visible without your username.

Server logs are kept for no more than 90 days. Analytics data held by our analytics providers is kept under their retention settings.

Security

We take reasonable technical and organisational measures to protect your data, including:

• Passwords hashed with bcrypt (no plain-text storage)
• HTTPS enforced on all pages and APIs
• Login tokens that expire (after 2 hours, or 30 days if you choose to stay signed in)
• HTTP security headers (HSTS, CSP, X-Frame-Options and others)
• Rate limiting on our APIs
• Database access restricted to the application

No system is perfectly secure, and we cannot guarantee the security of your data. If we learn of a breach that affects your personal data, we will notify you and the authorities as the law requires. If you discover a security vulnerability, please report it to [email protected] before disclosing it publicly.

Your Rights

Depending on where you live, including under India's Digital Personal Data Protection Act, 2023 and the GDPR, you may have the right to:

• Access a summary or copy of your personal data
• Correct inaccurate data, most of which you can edit in your profile
• Delete your account and personal data
• Withdraw consent to analytics cookies at any time through "Cookie settings", and to promotional emails through the unsubscribe link
• Portability: receive your data in a machine-readable format
• Object to or restrict certain processing
• Nominate someone to exercise your rights if you die or become incapacitated
• Complain to a data protection authority

To exercise these rights, including deleting your account, email [email protected] from the address on your account or raise a ticket on our Support page. We may need to confirm your identity first, and we will respond within 30 days. Withdrawing consent does not affect processing that already happened.

Cookies & Local Storage

• Essential: a session cookie used while you sign in with Google or GitHub (HttpOnly, SameSite=Lax, Secure); a prism_consent cookie that remembers your cookie-banner choice so our servers can respect it; and browser local storage holding your login token, theme and canvas state. These are needed for PRISM to work.
• Analytics: Google Analytics, Microsoft Clarity and PostHog, which run only after you click "Accept" in the cookie banner. Rejecting, or withdrawing consent later through "Cookie settings", stops them and removes the analytics cookies already set.

We do not use advertising cookies. Our fonts are hosted on our own servers, so loading PRISM does not send your IP address to Google Fonts.

Children

PRISM is not meant for anyone under 16, and we do not knowingly collect their data. Users aged 16 or 17 may use PRISM only with the consent of a parent or guardian. If you believe a child has created an account, or that a minor is using PRISM without that consent, contact [email protected] and we will delete the account.

Policy Changes

We may update this policy to reflect product changes or legal requirements. When we make material changes, we will update the "Last updated" date at the top and, where appropriate, notify registered users by email or in the app. Continued use of PRISM after changes take effect means you accept the updated policy.

Contact & Grievances

For privacy questions, to exercise your rights, or to raise a grievance about how we handle your data, contact our Grievance Officer:

Grievance Officer: Prajwal Ahluwalia
Email: [email protected] (subject "Privacy")
Support: prismhld.com/support
Address: PRISM, Bangalore, India

We acknowledge grievances within 72 hours and aim to resolve them within 30 days.