Privacy Policy

Information pursuant to Art. 13 GDPR

1. Controller

The controller responsible for data processing within the meaning of the GDPR is:

2. What data we process

When you use Prismar, we process the following categories of personal data:

• Account data — email address, display name and username.
• Authentication data — managed by Supabase Auth. Sign-in is passwordless: your email address is used to send one-time sign-in codes and, if you sign in with Google, we process the identifier of your Google account.
• User-generated content — workspaces, projects, tasks, bugs, comments and uploaded attachments. Uploaded attachments (images, documents, video) may themselves contain personal data you choose to include, which we process as user-generated content on your behalf.
• Usage and log data — technically necessary server and connection data generated when the application is accessed (e.g. IP address, time of access).

3. Purposes and legal bases

• Providing the service — processing to perform the usage agreement and to provide the features you request, Art. 6(1)(b) GDPR.
• Operation, security and stability — where necessary, on the basis of our legitimate interest in the secure and reliable operation of the service, Art. 6(1)(f) GDPR.

4. Processors and recipients

To provide the service we use carefully selected providers who process on our behalf under data processing agreements (Art. 28 GDPR):

• Supabase — database, authentication and file storage. Privacy policy
• Vercel — hosting and delivery of the application. Privacy policy
• Google— “Sign in with Google” (OAuth), only when you actively use this sign-in option. Privacy policy
• Resend — delivery of transactional emails (sign-in codes, workspace invitations). Privacy policy
• Zoho — hosting of our contact mailboxes (email you send to contact@ or legal@). Privacy policy
• Scaleway— document conversion for PDF import (a self-hosted extraction service we operate on Scaleway Serverless Containers). When you import a PDF into a Sheet, the file’s contents are transmitted to this service for one-time text extraction and are not stored there. Privacy policy

5. Processing within the EU / third-country transfers

Your data is processed within the EU/EEA. The Supabase database and file storage run in Ireland (region eu-west-1); hosting on Vercel runs in Ireland (Dublin); email delivery via Resend runs in Ireland (region eu-west-1); the contact mailboxes hosted by Zoho run in Zoho’s EU data center; the PDF-import extraction service runs on Scaleway Serverless Containers in France (Paris, region fr-par).

Supabase, Vercel, Resend and Zoho are companies with a US- or otherwise non-EU-domiciled parent. For the residual case of potential access by the parent company, appropriate safeguards are in place via the EU-US Data Privacy Framework (DPF) and/or EU Standard Contractual Clauses (SCC), together with the data processing agreements (DPA) referenced above.

6. Cookies and local storage

Prismar uses only strictly necessary cookies and similar browser storage — for signing you in and keeping you signed in, for security during sign-in, for your saved preferences (theme and interface state), and to remember your cookie choice. We use no analytics, advertising, or cross-site tracking. The legal basis is § 25(2) TDDDG (strictly necessary storage, no consent required) and, where personal data is processed, Art. 6(1)(b) and (f) GDPR. The full list of entries and how to manage them is in our Cookie Policy.

7. Retention period

Your account data and user-generated content are stored for as long as your account exists. When the account is deleted, the associated personal data is deleted or anonymized, unless statutory retention obligations require otherwise.

8. Your rights

Under the GDPR you have the following rights:

• Access (Art. 15 GDPR)
• Rectification (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing (Art. 21 GDPR)

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). To exercise your rights, a message to legal@prismar.app is sufficient.

Last updated: 16.07.2026