Privacy Policy

PrismBI is a conversational analytics platform that lets teams ask questions of their own business data in plain language. The party responsible for your personal data is PrismBI. For any privacy questions or to exercise your rights, contact us at privacy@prismbi.ai.

Where you use the Platform through an organization (your employer or another account holder), that organization is the controller of the business data and user accounts within its workspace, and we act as a processor on its behalf. This Policy describes our own processing and the processing we carry out for organizations.

We collect the following categories of information:

a. Information you provide on the Website

• Pre-registration and contact details — when you register interest or contact us, we collect your email address (required) and, optionally, your name and company.
• Communications — the content of messages you send us and our correspondence with you.

b. Account and platform information

• Account data — name, email address, organization/tenant membership, role and permissions, and authentication identifiers managed through our identity provider (AWS Cognito), including optional Google sign-in.
• Usage and billing data — subscription plan, credit allowances and consumption, transaction history, and audit logs of actions taken in the Platform.
• Query and conversation content — the questions you ask, follow-up prompts, generated answers, and associated metadata (e.g. token usage). These may include personal data if you include it in your prompts.
• Uploaded content — files you upload for analysis and documents you add to knowledge bases (e.g. text, Markdown, or PDF), together with any artifacts generated from them.
• Connection metadata — schema and structural metadata about the data sources you connect (such as table and column names). See Section 4 regarding the data inside your databases.

c. Information collected automatically

• Technical data — IP address, browser type, device information, and similar data generated when you interact with the Services, used for security and to operate the Services.
• Local storage — we store limited preferences (such as your theme setting) in your browser. The Website does not currently use advertising or third-party tracking cookies.
• Fonts — the Website loads web fonts from Google Fonts, which may receive your IP address as part of serving those fonts.

We use personal data to:

• Provide, operate, maintain, and secure the Services;
• Create and manage accounts, organizations, and access permissions;
• Process queries and deliver analytics results, including through AI processing (see Section 5);
• Respond to your enquiries and send service and transactional communications;
• Administer subscriptions, credits, and billing;
• Monitor, audit, and improve performance, reliability, and quality;
• Detect, prevent, and address security incidents, fraud, and misuse; and
• Comply with legal obligations and enforce our agreements.

Depending on the applicable law, our legal bases for processing include performance of a contract, our legitimate interests in operating and improving the Services, your consent (where required, e.g. for certain communications), and compliance with legal obligations.

PrismBI is designed so that your underlying business data and database credentials remain inside your own environment. The Edge Agent runs within your network and:

• Connects outbound only to our cloud service — we do not open inbound connections into your network;
• Executes read-only (SELECT-only) queries against your data sources;
• Resolves and uses database credentials locally; those credentials are not transmitted to or stored by our cloud service.

Query results, conversation history, uploaded files, and generated artifacts that you choose to surface in the Platform are transmitted to and stored by our cloud service to deliver the Services. To the extent results contain personal data, they are processed as described in this Policy.

To generate answers, PrismBI sends prompts, relevant query context, and related content to third-party artificial intelligence providers (for example, large language model and embedding providers) through our BI Core service. Optional features such as web search may transmit query terms to a search provider. These providers process this content to return results to us and may do so outside your or our primary location.

We engage the following categories of sub-processors to provide the Services. The specific providers may change; we will keep this list current:

• Cloud hosting & infrastructure — for running our application servers, database, and storage.
• Authentication — identity and sign-in management.
• AI / LLM and embedding providers — to process prompts and generate answers and embeddings.
• Object storage & content delivery — to store uploads and artifacts and serve the Website.
• Email delivery — to send transactional and notification emails.

We require sub-processors to provide appropriate safeguards for personal data and to process it only on our instructions. A current list of named sub-processors is available on request at privacy@prismbi.ai.

We share personal data only as described in this Policy, including:

• With sub-processors and service providers acting on our behalf (Section 5);
• Within your organization's workspace, with other authorized members and administrators of that organization;
• When required by law, legal process, or to protect rights, safety, and the integrity of the Services; and
• In connection with a merger, acquisition, financing, or sale of assets, subject to appropriate confidentiality protections.

We do not sell personal data.

We and our sub-processors may process personal data in countries other than your own. Where personal data is transferred across borders, we rely on appropriate safeguards recognized under applicable data protection law (such as standard contractual clauses or an equivalent mechanism) to protect that data.

We retain personal data for as long as necessary to provide the Services, comply with our legal obligations, resolve disputes, and enforce our agreements. Account and workspace data are generally retained for the duration of the relevant account and then deleted or anonymized within a reasonable period, subject to legal requirements and backups. Organizations may control much of their own content directly within the Platform.

We implement technical and organizational measures appropriate to the risk, including encryption in transit, isolated per-organization workspaces, role-based access controls, audit logging, read-only data access, and the principle of keeping database credentials within your own network. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Depending on your location, you may have rights regarding your personal data, including the rights to access, correct, delete, restrict or object to processing, and data portability, as well as the right to withdraw consent and to lodge a complaint with a supervisory authority.

To exercise these rights, contact us at privacy@prismbi.ai. If your personal data is processed by us on behalf of an organization, we will refer your request to that organization and support them in responding.

The Services are intended for business use and are not directed to children. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us so we can take appropriate action.

We may update this Policy from time to time. We will post the updated version on this page and revise the “Last updated” date above. Where required, we will provide additional notice of material changes.

If you have questions about this Policy or our privacy practices, contact us at privacy@prismbi.ai.