Prism Cyber Core Privacy Policy

The Privacy Policy explains what Prism Cyber Core processes to provide the web service, what stays local during current file-content scanning, and how account, billing, support, security, and operational records are handled.

Policy date

Last updated October 12, 2026

Scope of Services

When you register an account, we process the account and session information needed to authenticate you and provide the Service.

The Prism Cyber Core website and dashboard at https://prismcybercore.com (the "Site").
The current browser-based scanner, account features, support tools, and checkout flows linked to this Policy (the "Service").
Desktop and native mobile packages are not currently released and are outside the scope of this Policy.

Summary of This Policy

We process account and authentication details, subscription and payment status, support messages you choose to send, and aggregate operational metrics needed to provide and secure the web service.
Selected file contents are analyzed locally in your browser. The scanner does not upload selected original files, original image pixels, OCR text, or matched sensitive values.
We do not use files selected for the current web scanner or their scan results to train AI models.
We use reasonable technical and organizational safeguards, including authenticated sessions and secure hosting. No internet-facing service is completely secure.
Depending on your jurisdiction, you may request access, correction, deletion, portability, or limits on processing of personal data we maintain.

Personal Data We Collect & Local Isolation Boundaries

Account Information: When you create an account, we collect the email address you provide to set up, authenticate, and maintain your session. A corporate email address is not required.

Your Selected Files: Selected file contents are analyzed locally in your browser. The scanner does not upload selected original files, original image pixels, OCR text, or matched sensitive values. If you explicitly choose a web Vault action, file metadata and generated thumbnail data may be transmitted to Prism's backend. A generated thumbnail is an image preview and may contain sensitive information from the selected image; it is not the original file.

Vault records are stored in Prism's backend database. Filenames, categories, and generated thumbnails are encrypted at rest using server-side keys, not end-to-end encryption. Operational fields—including record and account identifiers, file size and type, archive and detection timestamps, and an optional source-record reference—remain plaintext so the Service can associate and manage the record.

Interaction & Utility Inputs: We process the inputs you voluntarily send through support or other Service features to return the requested response.

Support Communications & Feedback: This includes the message and contact details you choose to share when contacting support.

Core Usage Metrics: We process aggregate operational metrics to analyze system health and improve reliability. Security systems may process transient browser, network, and IP information for fraud prevention and service protection.

Merchant Verification & Payment Status: Lemon Squeezy processes checkout and provides us payment status, subscription tier, and account identifiers needed to activate access. We do not receive raw card numbers.

We will NOT use your workspace data for AI model training.
The browser scanner reads only files you select or drop into it. Vault metadata and thumbnails are sent only when you choose a separate Vault action.
The scanner can identify possible sensitive signals in files you select locally. Do not save generated thumbnails or metadata to the optional Vault unless you are authorized to process that information and accept the Vault storage described in this Policy. Do not provide personal data belonging to minors under the age of 16.

How We Use Your Data and Valid Legal Bases

Contractual Performance: Necessary to provide account access, verify subscription entitlements, and process user-requested Vault storage, retrieval, and deletion.
Explicit User Consent: Where you have granted explicit authorization for specific diagnostic outputs.
Legitimate Business Interests: Including maintaining operational platform security, detecting and isolating malicious system abuses, enforcing our Terms of Use, and defending our legal rights.
Statutory Legal Obligations: Meeting governmental, tax compliance, and institutional data retention regulations under international law.

Cookies and Ambient Tracking Technologies

The current web app stores signed session tokens (JWTs) in browser local storage and sends them to the API in the Authorization header. This sign-in flow does not use authentication cookies. Browser local storage also retains supported preferences, separately from session tokens; these preferences are not used to authenticate you.

Blocking cookies alone does not clear local storage or disable this sign-in flow. Clearing the stored session token signs this browser out, and restricting local storage may prevent sign-in or preferences from persisting. Sign out through the app to revoke the server session. Local scan results do not automatically synchronize across devices; reading, saving, and deleting backend Vault records require internet access.

Optional education affiliate attribution

On our Education page (/education), Masterclass sales page (/masterclass/), and Masterclass checkout-start page (/masterclass/checkout/start) only, we offer optional affiliate tracking through Lemon Squeezy. We use this tracking to identify the affiliate who referred a visitor and support attribution of eligible educational-product purchases. The tracking script is not initialized unless you choose “Allow affiliate tracking” and a referral code or previously captured referral cookie is present. It is not initialized in software dashboards, account/security pages, course-library pages, or payment-result and checkout-return pages.

When enabled, Lemon Squeezy’s script uses a first-party referral cookie named ls_aff_ref and derives a browser identifier using browser fingerprinting. It sends Lemon Squeezy the page URL, referring URL, affiliate code or existing click reference, our store identifier, and the derived browser identifier. We remember your tracking choice in first-party browser local storage; if that storage is unavailable, the choice is retained only for the current page session. The referral cookie’s expiration is supplied by Lemon Squeezy.

When you proceed to an educational-product purchase with tracking enabled, your browser sends the provider-issued click reference to Prism’s authenticated checkout API. Prism validates the reference and adds it to the generated Lemon Squeezy checkout URL as aff_ref. This reference is used for referral attribution only; it does not determine product selection, price, account ownership, or entitlement to purchased materials. The affiliate tracker does not receive files selected for scanning.

You can decline tracking and still browse or buy. To change your choice, use “Affiliate privacy” on the Education or Masterclass sales/checkout-start pages. Withdrawing consent clears the referral cookie in this browser and reloads the page to stop the tracking script. Withdrawal stops future tracking through this integration but does not automatically erase referral or transaction records already received by Lemon Squeezy. Declining tracking or clearing its cookie may prevent referral credit. Lemon Squeezy’s processing and hosted checkout are also subject to its own privacy and cookie policies.

How We Share Your Personal Data

We do not sell your personal data. We disclose personal data to service providers to operate and secure the Service, process payments, and, only with your consent, support the optional education affiliate attribution described above.

Hosting & Infrastructure Vendors: We utilize secure cloud infrastructure providers (such as Amazon Web Services or Replit infrastructure arrays) to host our core databases and platform backends.
Customer Support & Ticketing Pipelines: We pass support requests to specialized help desk suites to manage tracking, ticket diagnostics, and developer responses.
Merchant of Record Pipelines: Payment processing and billing lifecycles are executed via Lemon Squeezy. When you enable optional education affiliate tracking, Lemon Squeezy also receives the referral information described in Section 3 to support affiliate attribution.
Law Enforcement & Judicial Demands: We will disclose personal data if legally compelled by a binding court order, valid statutory regulation, or a good faith belief that disclosure is strictly required to address systemic security threats, platform fraud, or immediate physical safety risks.

Data Security, Encryption, and Retention Process

In the signed-in web Vault, use a record's Delete control and confirm the prompt to delete its stored metadata and thumbnail, not the original file on your device. Wait for the stored-record deletion confirmation; failed requests leave the record visible for retry. You can also request deletion at support@prismcybercore.com from your account email address. Clearing browser storage or cancelling a subscription does not automatically delete backend Vault records. The retention exceptions in this Policy still apply.

We implement robust technical isolation layers, network perimeters, and client-side access tokens designed to defend your workspace data against unauthorized disclosure, loss, or manipulation. Your account workspace uses signed session tokens and user-managed passwords. It is your absolute responsibility to restrict access to your hardware devices and sign off after active development sessions.

We retain your personal account metrics only as long as your workspace profile remains active. If you choose to deactivate your account or request data purging, your information is deleted or permanently anonymized from our live production tables, except where lingering data is required for financial auditing, active legal dispute resolution, or statutory compliance obligations.

International Cross-Border Transfers

As a global digital service, Prism Cyber Core stores data primarily across highly secure server infrastructure situated within the United States and the European Economic Area (EEA). If you access our platform internationally, your transaction records and account data may be securely routed to these regions. To guarantee an unyielding layer of data defense during cross-border transfers, we execute Standard Contractual Clauses (SCCs) and data transfer agreements that align rigorously with international regulatory frameworks including the EU GDPR and UK Data Protection Act 2018.

Children's Privacy Constraints

Our security services and platform utilities are built strictly for independent software professionals, developers, and corporate enterprises. We do not knowingly solicit, market to, or collect data from minors under the age of 16. If we discover that an account has been registered by an individual under 16, the account will be immediately deactivated and all matching records permanently purged from our storage arrays.

Your Global Privacy Rights

Subject to regional jurisdictions (such as the European Union GDPR, UK Data Protection Act, and global regulations), you may possess the following statutory rights over your personal data.

Right of Access & Portability: Request a machine-readable copy of all personal account logs currently retained on our servers.
Right of Rectification: Request immediate correction of faulty or outdated registration records.
Right of Erasure (The Right to be Forgotten): Completely wipe your workspace registration records and deactivate your platform license keys.
Right to Restrict Processing & Object: Object to processing activities built upon legitimate interest baselines or halt transactional data parsing.
Right to Lodge a Complaint: Submit a formal grievance to your localized data protection supervisory authority.
To execute any of the above data protections, contact our compliance team directly via email or through the Support Portal at prismcybercore.com.

Additional U.S. State Disclosures (CCPA/CPRA)

Under specific state privacy frameworks (including California, Virginia, Colorado, Connecticut, and Utah), residents are entitled to supplementary disclosures regarding data tracking over the preceding 12-month period.

We collect and disclose Account Identifiers and Usage Data to infrastructure hosting providers for verified business operations.
We do not sell your personal data for monetary gain or share your usage data for cross-context behavioral advertising.
You have the right to request access to or deletion of your collected metrics without facing discriminatory pricing or service throttling. You can opt out of any automated tracking settings via your profile interface or by contacting support.

External Service Providers

Lemon Squeezy provides checkout and payment processing under its own privacy policy. Desktop and native mobile packages are not currently released, so no app-store processing is part of the current Service.

Current Web Service Scope

The current Service is browser-based. Native desktop and mobile packages are not currently released and are outside the scope of this Policy.

Browser scanner: Selected file contents are analyzed locally in your browser and are not uploaded by the scanner.
Account service: Account, billing, support, security, and aggregate operational metadata may be processed to provide and protect the Service.

Updates to This Privacy Policy

Prism Cyber Core reserves the right to modify this Privacy Policy as our software landscape, features, and international regulatory environments evolve. We recommend regularly auditing this layout. In the event of material structural shifts to our processing patterns, we will notify your workspace in advance via prominent platform pop-ups, dashboard notices, or direct email notifications.

Contact

For general questions, support, privacy inquiries, or requests to access, correct, or delete personal data, contact Prism Cyber Core at support@prismcybercore.com. For account-related requests, use your account email address. Do not send passwords, session tokens, or sensitive file contents.

Prism Cyber Core Support — support@prismcybercore.com — prismcybercore.com/support

Software release status

Prism Cyber Core software is pre-release: final testing and release preparation are in progress. No public launch or access date has been announced. Native desktop and mobile packages are not publicly released.

Education is a separate product line; purchase availability is shown for each course.

Local scanner and optional web Vault

Selected file contents are analyzed locally in your browser. The scanner does not upload selected original files, original image pixels, OCR text, or matched sensitive values. If you explicitly choose a web Vault action, file metadata and generated thumbnail data may be transmitted to Prism's backend. A generated thumbnail is an image preview and may contain sensitive information from the selected image; it is not the original file.

Try the sample-based Prism Cyber Core demo. Software launch coming soon — currently in final pre-release testing and release preparation.