Privacy Policy

Data controller

The Prismatica team (Dylan, Vadim, Sergio, Daniel and Mostafa) is the data controller for Prismatica.

Privacy contact: dev.pro.photo@gmail.com.

Data we collect and why

• Account data: email address, username, password (stored only as a hash) and account timestamps. Used to create your account and sign you in. Legal basis: contract and legitimate interest in account security.
• Preferences: theme and notification settings, and newsletter consent if you give it. Used to apply your settings. Legal basis: contract for service preferences and consent for optional communications.
• Sessions and security logs: the IP address and browser user agent of each signed-in session, the IP address in the sign-in audit log, and timestamps. IP addresses are personal data. Used to keep you signed in and to secure your account. Legal basis: legitimate interest in security, fraud prevention and troubleshooting.
• Tokens: password-reset, email-verification and session tokens. Used for secure authentication. Legal basis: contract and legitimate interest in secure authentication.
• Workspace profile: display name, username and, if you add them, a bio, a headline and an avatar. A hash of your email address links the profile to your account. Your profile appears in the workspace people directory unless you opt out. Used to show who you are to the people you work with.
• Content you create: pages, comments, chat messages and their attachments, tasks, favourites, notifications, connection requests, blocks and reports, and whiteboard drawings. Used to provide the workspace.
• Push notifications: if you turn them on, your browser's push endpoint and its keys.
• Mail and Calendar: if you connect a mail or calendar account, its address and display name, a copy of message details (sender, recipients, subject, a short snippet, labels) and of calendar events (title, description, location, attendees). Used to show your mail and calendar inside the workspace.

Retention

Data is kept while your account exists. There is no scheduled job that deletes or anonymises accounts, content, sessions, tokens or logs automatically, so data stays until it is deleted from the database. Some items you delete, such as whiteboards and chat messages, are marked as deleted rather than erased.

When you request deletion of your account, it is deactivated straight away and erased or anonymised within one month, unless the law requires us to keep something. Your consent choices in this browser are asked again every 6 months and whenever this policy changes.

Where your data is stored and who receives it

Prismatica is self-hosted. All data is stored on the machine that runs the service, in its PostgreSQL, MongoDB and MinIO (file storage) databases. Emails the service sends are delivered to Mailpit, a mail catcher running on the same machine, and do not leave it. We do not sell personal data.

Personal data leaves that machine only in these cases:

• When Cloudflare Turnstile is enabled, the sign-up and sign-in pages load Cloudflare's script, and the sign-in service sends the Turnstile token and your IP address to Cloudflare to check that you are not a bot.
• When you connect a Gmail, Outlook or Google Calendar account, the service fetches your mail and events from that provider.

International transfers

The service is hosted on a single machine. Personal data reaches other countries only through the third parties listed above.

Your rights

You can exercise your rights of access, rectification, erasure, restriction, portability and objection under GDPR Articles 15 to 21. You can also withdraw consent at any time where processing is based on consent.

When signed in, you can download a machine-readable copy of your data, withdraw newsletter consent and request deletion of your account yourself on the Data Rights page. For any other request, use the form on that page or contact dev.pro.photo@gmail.com. We answer within one month; for complex requests this can be extended by two more months, and we will tell you why.

You also have the right to lodge a complaint with the CNIL: https://www.cnil.fr/fr/plaintes, or with the data protection authority of the EU country where you live or work.

Is providing data required?

An email address and a password are required to create an account, because the service cannot sign you in without them. Everything else, including newsletter consent and profile details, is optional, and refusing it does not limit your access to the service.

Automated decisions

Prismatica does not make decisions about you based solely on automated processing, including profiling, that produce legal or similarly significant effects. Anti-abuse checks such as rate limits and Cloudflare Turnstile only slow down or block suspicious sign-in attempts and can be retried.

Children

The service is not intended for children under 15, the age of digital consent in France. We do not knowingly collect their data; if you believe a child has created an account, contact us and we will delete it.

Changes to this policy

We may update this policy from time to time. We will notify you of any changes by posting the new policy on this page.

Data security

Prismatica employs technical and organizational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. All data is stored in self-hosted databases with access controls and encryption at rest.

Cookies and tracking

The service uses a sign-in cookie and stores your preferences, consent choices and a workspace cache in your browser's local storage. It has no analytics or marketing scripts: the consent banner records your choice, and nothing else loads. See the Cookie Policy for the full list.

Contact

For privacy questions, contact dev.pro.photo@gmail.com.