Privacy Policy

Account and identity data. When you sign in through Fanvue, we receive the account identifiers Fanvue shares with us (for example your Fanvue user ID and the details needed to link your account and, where you choose, your connected creator profile). We do not receive or store your Fanvue password.

Content you create. The AI characters you build, the prompts you write, the images and other media you generate, captions, and any images or files you upload as inputs (for example reference images or training images for a character model).

Connected integrations. If you connect a third-party channel (for example Telegram, Discord, or Google Drive), we store the tokens and identifiers needed to deliver the feature you asked for (for example sending you a notification, or importing a file you selected). We access only what the connected feature requires.

Usage and device data. How you use the Service (features used, generations run, credits spent), plus technical data such as IP address, device and browser information, and event logs. We use this to run, secure, and improve the Service.

Billing data. Records of how credits are spent. Payments are handled by Fanvue: Prism does not collect or store your card or payment details, and only calls the Fanvue API to confirm whether a payment or subscription is active.

Preferences and memory. Settings and derived "memory" notes the Service keeps to personalise how the assistant works for you. You can view and delete these in the Memory tab.

We use personal data to:

• generate, store, and display the content you ask for, and operate your account;
• provide features you enable (publishing to Explore, sharing links, connected channels, notifications);
• process credit purchases and account for how credits are spent;
• keep the Service secure, prevent abuse and fraud, and enforce our Terms and Acceptable Use Policy;
• provide support and respond to your requests;
• understand and improve how the Service works; and
• comply with legal obligations.

Legal bases (UK/EU GDPR). We rely on: performance of our contract with you (to provide the Service); our legitimate interests (to secure, maintain, and improve the Service and prevent abuse); your consent (where required, for example certain optional integrations or cookies); and compliance with legal obligations. Where we use de-identified prompts and images to improve the Service (see Section 3), we rely on our legitimate interests and remove physical and identifying attributes first.

Generating content requires sending prompt text and, where relevant, input images to third-party AI providers that run the models on our behalf (our "sub-processors"). These providers process the input to return a result and act on our instructions.

The categories of providers we use include AI model and inference providers, cloud hosting and storage, and product analytics. Our current sub-processors are: OpenAI, Anthropic, xAI (Grok), fal, WaveSpeed, RunPod, Amazon Web Services, PostHog, and Fanvue. We keep this list current and give notice of material changes.

We aim to minimise what we send: prompt and memory text is filtered to remove direct identifiers (such as emails, phone numbers, and links) before it is sent for embedding or generation, and adult-content routing is gated. We do not sell your personal data.

Improving the Service. We use some prompts and images to train and improve the Service (for example, adding to our retrieval/vector store so results improve over time). Before any such use, physical and identifying attributes are removed, so the data used for improvement is de-identified.

Some features make content visible beyond your account:

• Explore shows content to other signed-in Prism users when you choose to publish it. Publishing is opt-in and you can unpublish at any time.
• Share links create a public URL for a specific piece of content that anyone with the link can view.

When your content is shown to others, we attribute it to the AI character that produced it (its name and avatar). We do not display your Fanvue identity, email, or other personal identifiers on public surfaces.

We share personal data only with: our sub-processors (Section 3), under contract and on our instructions; Fanvue, as needed to operate the linked account and any features you use; authorities or third parties where required by law or to protect rights, safety, and the integrity of the Service; and a successor in the event of a merger, acquisition, or asset sale, subject to this policy.

Some of our providers are located outside the UK and EEA, including in the United States. Where personal data is transferred internationally, we rely on appropriate safeguards, such as Standard Contractual Clauses and the UK International Data Transfer Agreement (IDTA), as applicable.

We keep personal data for as long as your account is active. When you delete your account, your personal data is deleted within 30 days, except for limited records we are legally required to keep (for example, for tax and accounting).

You can delete individual media instantly from the Media tab, and memory items from the Memory tab, at any time. To delete your account and remaining personal data, contact us at team@prism-builder.com.

We use technical and organisational measures to protect personal data, including encryption in transit, access controls, least-privilege access, and monitoring. We work to protect your data and the Fanvue access you grant us, and we maintain processes to respond to incidents.

Depending on where you live, you may have the right to access, correct, delete, export (portability), restrict or object to processing, and withdraw consent, as well as to lodge a complaint with your data protection authority (in the UK, the Information Commissioner's Office, the ICO). To exercise these rights, contact team@prism-builder.com. We will respond within the timeframes required by law.

The Service is for adults only (18+) and is not directed to anyone under 18. Access requires signing in through Fanvue, which requires identity verification (KYC) — you must complete Fanvue's KYC to use Prism, and this is how age is assured. We do not knowingly collect personal data from anyone under 18.

We use strictly necessary cookies to run the Service, and analytics cookies (via PostHog) to understand usage. Because we use non-essential (analytics) cookies, we show a cookie consent banner and use those cookies only with your consent where required. A separate Cookie Notice lists the specific cookies we set.

• Essential cookies are needed to run Prism — for example to keep you signed in and to remember your cookie choice. These are always set.
• Analytics cookies are non-essential cookies used by PostHog to recognise your browser across visits. They are set only if you accept analytics in the consent banner. Until you choose, Prism runs cookie-free and stores nothing non-essential on your device.

On your first visit we ask you to Accept or Reject analytics. You can decide either way, and opting out is as easy as opting in.

• If you Accept: we set analytics cookies and link your activity to your account, including attaching your email address to your analytics profile, so we can analyse usage at the level of an individual account.
• If you Reject: we set no analytics cookies and do not link analytics to your account. We still collect anonymised, aggregated usage data to measure the overall performance of the product. That data is not used to identify you, but it may include your IP address and approximate location.

You can change your choice at any time by clearing Prism's cookies in your browser. Billing and account records are kept regardless of this choice, as they are necessary to provide the Service.

We may update this policy from time to time. We will post the updated version here and update the "Last updated" date, and we will provide additional notice where required.

Email: team@prism-builder.com.