Effective as of12/4/2025
This Privacy Policy explains how Prism AI, Inc. ("Prism AI," "we," "us," or "our") collects, uses, discloses, and safeguards information in connection with the Bigspin website, dashboard, APIs, and related services that reference or link to this Policy (collectively, the "Services"). We recognize privacy is an ongoing responsibility and will update this Policy as our practices evolve.
For most customers, access to and use of the Services is governed by a separate written agreement between Prism AI and your organization (e.g., a Master Subscription Agreement and/or Order Form, and where applicable a Data Processing Addendum, together the "Enterprise Agreement"). If there is any conflict between this Privacy Policy and an Enterprise Agreement, the Enterprise Agreement governs with respect to the Services provided to that organization. This Privacy Policy also applies to visitors of our public website and to account-level information we process to operate the Services.
Regulated data: Unless expressly agreed in writing, the Services are not designed for protected health information (HIPAA), payment card data (PCI DSS), or similarly regulated data categories. If your use cases involve such data, you must have an Enterprise Agreement that expressly permits it and sets applicable controls.
We access, process, and use Customer Data only to provide and improve the Services in accordance with this Policy and the applicable Enterprise Agreement/DPA. We do not use Customer Data to train foundation models. Any exceptions require explicit written consent documented in your Enterprise Agreement.
We use Personal Data and Customer Data for the following purposes:
GDPR legal bases: contract performance (Art. 6(1)(b)) for account/Services operations; legitimate interests (Art. 6(1)(f)) for security, service improvement, and basic analytics; consent (Art. 6(1)(a)) for optional marketing or non-essential cookies; and legal obligations (Art. 6(1)(c)) where applicable.
We use cookies and similar technologies to operate the website/Services, remember preferences, authenticate users, analyze usage, and improve performance. You can manage cookies via your browser settings. Blocking essential cookies may impair functionality. Where required, we will obtain consent for non-essential cookies. See our Cookies notice (if published) for details.
We do not sell Personal Data. We share Personal Data and Customer Data with third-party vendors acting as our subprocessors to support delivery of the Services (e.g., cloud hosting, data storage, authentication, analytics, email/service communications, and—if enabled by you—LLM providers). We conduct vendor diligence and maintain contractual obligations requiring appropriate confidentiality, security, and data protection.
Categories of subprocessors include: cloud infrastructure (e.g., AWS), managed databases (e.g., Supabase), authentication providers (e.g., Clerk), analytics/telemetry, email delivery and customer support tools, and optional LLM or model providers (e.g., OpenAI, Anthropic, Together AI) when explicitly enabled by you. A current list of subprocessors is available upon request to privacy@bigspin.ai.
We may disclose information if required by law, to protect rights and safety, to enforce our agreements, or in connection with a corporate transaction (e.g., merger, acquisition, financing). We may publish de-identified/aggregated insights that do not identify any individual or customer organization.
Prism AI maintains an information security program designed to protect the confidentiality, integrity, and availability of Personal Data and Customer Data and to align with SOC-2 requirements. Controls include risk management, access control, encryption in transit (TLS 1.2+) and at rest (AES-256 or equivalent), vulnerability and patch management, secure software development practices, logging/monitoring, regular backups, disaster recovery procedures, employee training, and incident response.
Upon execution of an NDA, we provide summary security documentation and our SOC-2 Type II report to Enterprise customers. Requests may be submitted to security@bigspin.ai.
Breach notification. In the event of a security incident that materially impacts Personal Data or Customer Data, we will notify affected customers within 72 hours of confirming the incident, in accordance with applicable law and the Enterprise Agreement/DPA.
Prism AI is headquartered in the United States. If you access the Services from outside the U.S., we may transfer and process information in the U.S. and other countries that may not provide the same level of data protection as your jurisdiction. Where required, we use appropriate safeguards such as the EU/UK Standard Contractual Clauses and additional measures as needed.
We retain Personal Data for as long as necessary to fulfill the purposes described in this Policy, to comply with legal obligations, resolve disputes, and enforce agreements. Retention of Customer Data is governed by the Enterprise Agreement/DPA and your organization's configuration. Upon contract termination or at your organization's instruction, we will delete or return Customer Data in accordance with the Enterprise Agreement/DPA and our retention schedules, subject to any legally required retention.
Depending on your location, you may have rights under applicable laws (e.g., GDPR, UK GDPR, CCPA/CPRA) including the right to request access, correction, deletion, portability, restriction or objection to certain processing, and to withdraw consent where processing is based on consent. You also may have the right to opt out of certain uses or disclosures (e.g., targeted advertising) where applicable.
If your account is provisioned by your employer, please direct requests to your organization's administrator where appropriate. Otherwise, you (or your authorized agent) can submit a request by emailing privacy@bigspin.ai. We will verify and respond in accordance with applicable law. You also have the right to lodge a complaint with a supervisory authority.
The Services are not directed to individuals under the age of 18, and we do not knowingly collect Personal Data from children.
We may update this Policy from time to time. The "Effective" date at the top indicates when the current version took effect. Material changes will be communicated as required by law or by reasonable notice through the Services.
Questions about this Policy, our privacy practices, or requests to obtain a copy of our DPA or security reports (under NDA) can be sent to:
Prism AI, Inc.
Privacy Team
United States
privacy@bigspin.ai
This Privacy Policy may be updated periodically. Last updated: 12/4/2025
