Privacy Policy

Last updated: October 20, 2026 · Effective: October 20, 2026

1. Introduction

Prismojo ("we", "us", "our") operates the website and services at prismojo.com. This Privacy Policy explains how we collect, use, disclose, and otherwise process your personal information.

We are committed to protecting your privacy and being transparent. We comply with:

• GDPR: General Data Protection Regulation (EU/UK)
• CCPA: California Consumer Privacy Act
• LGPD: Lei Geral de Proteção de Dados (Brazil)
• Other regional privacy laws: As applicable

2. What Information We Collect

2.1 Account Registration

When you sign up, we collect:

• Email address
• Password (hashed with bcrypt, never stored in plain text)
• Date you created the account
• Confirmation that you are 18+ and agree to our Terms of Service
• If using OAuth: Your provider (Google) and provider ID

2.2 Payment Information

We do not store credit card details. Payment processing is handled entirely by Waffo Pancake, a PCI-DSS compliant payment processor. We receive and store only transaction records:

• Transaction ID and order number
• Amount and currency
• Payment status (pending / completed / failed)
• Timestamp of purchase
• Credits received

2.3 Uploaded Photos

Photos do not upload until you log in. When you do:

• Photos are stored securely in private cloud storage (AWS S3 or Cloudflare R2)
• We calculate a SHA-256 hash of each image for deduplication
• Photos are encrypted at rest with AES-256
• You can delete photos at any time (permanent removal)
• Deleted photos are unrecoverable

2.4 Generated Videos

• Generated videos are stored with a unique share ID
• Videos are encrypted at rest
• Videos are accessible via your Dashboard for download
• Share link: `/u/[shareId]` is private (noindex) unless you share it
• Unused videos auto-delete after 30 days (cost optimization)
• You can manually delete anytime

2.5 Device & Usage Data

We collect usage analytics from every visitor; your cookie preferences decide whether cookies are used for it:

• Page visits and clicks (no fingerprinting)
• Device type, browser, operating system
• Generation events (submitted, completed, failed)
• Heatmaps and session replays (Microsoft Clarity), with form inputs, email addresses, photos and videos masked
• Session duration and returning visits (only with analytics cookies)

ℹ️ We use Google Analytics 4 and Microsoft Clarity with no advertising features and no cross-site tracking. Without analytics cookies (declined or not yet chosen) both run cookieless and cannot link your page views or visits together. Legal basis: cookieless measurement relies on our legitimate interest in running and improving the service (GDPR Art. 6(1)(f)); analytics cookies rely on your consent (Art. 6(1)(a)). We do not allow either provider to use our analytics data for advertising or to share it across other customers' properties.

2.6 Moderation Data

To protect users and comply with child safety laws, we automatically check every uploaded photo before a video is generated and keep:

• Content filtering results (estimated age range, nudity scores, number of faces)
• Moderation decision (approved / rejected)
• Timestamp and reason for rejection

2.7 Communications

We only send transactional emails (no marketing):

• Account verification
• Password reset links
• Purchase receipts (from Waffo Pancake, our merchant of record)
• Account deletion confirmation

3. How We Use Your Information

We use your data for:

• Service provision: Creating accounts, managing sessions, generating videos
• Payment processing: Processing credits purchases and preventing fraud
• Legal compliance: Tax obligations (7-year retention), GDPR/CCPA requests, child safety reporting
• Security: Fraud detection, abuse prevention, account protection
• Product improvement: Analyzing usage patterns, identifying errors, optimizing performance

4. Data Retention

5. Your Data Rights

Under GDPR, CCPA, and similar laws, you have the right to:

5.1 Right to Access

Get a copy of all your personal data: sign in and use Export my data under Account → Privacy and data. It downloads right away. You can also ask us through the contact form and we will reply within 30 days.

5.2 Right to Export (Data Portability)

The export is a machine-readable JSON file with your account, sign-ins, credits, purchases, generation history, consents and referrals, plus 24-hour download links to your photos and videos.

5.3 Right to Delete (Right to Be Forgotten)

Delete your account with Delete all my data under Account → Privacy and data. It happens immediately. We:

• Delete all account data, photos, and videos
• Anonymize transaction records (retain only for tax purposes, unlinked to you)
• Keep legal consents (such as the EU withdrawal waiver) unlinked to you, as evidence for legal claims
• Keep photo safety-check logs unlinked to you for 7 years, as child safety rules require (they never contain the photos themselves)
• Email you a confirmation once it is done

5.4 Right to Correct (Rectification)

Update inaccurate or incomplete information. You can edit your email or account settings in the dashboard.

5.5 Right to Opt-Out of Analytics

Turn off analytics and marketing cookies under Cookie Settings in the site footer. Analytics then continues only in cookieless, anonymous form; to object to that as well, see 5.6.

5.6 Right to Object (DPA)

Object to processing of your personal data for certain purposes. We will evaluate and respond within 30 days.

6. Content Moderation & Child Safety

Prismojo is for adults (18+) and is not directed at children, in line with COPPA (Children's Online Privacy Protection Act). Photos of minors and sexual content are not allowed. Apparent child sexual abuse material that we become aware of is reported to the NCMEC (National Center for Missing & Exploited Children) as required by U.S. law (18 U.S.C. § 2258A).

6.1 Automated Content Filtering

All uploaded photos are scanned using Amazon Rekognition (third-party AI moderation) before any video is generated:

• Age Estimation: Rejects the photo if any face may be under 18 years old
• NSFW Detection: Rejects the photo if explicit nudity or sexual content is detected (confidence 0.8 or higher)

Rejected photos are not stored. Our video generation provider also screens the videos it produces.

6.2 Moderation Failure = Account Lock

If we become aware of child sexual abuse material or child exploitation on an account (for example through a user report), the account is permanently suspended and the material is reported to NCMEC and, where required, to law enforcement.

6.3 Moderation Transparency

When a generation is rejected, you see a reason (e.g., "Content does not meet our standards"). You can appeal through our Contact form.

7. Cookies & Tracking

See our Cookie Policy for detailed information about:

• Essential cookies (always on)
• Analytics cookies (on by default; cookieless measurement when off)
• Your cookie preferences

8. Third-Party Sharing

We share your data with the following service providers only as necessary:

Note: All third-party processors are GDPR-compliant and bound by data processing agreements.

9. Data Security

We implement industry-standard security measures:

• HTTPS / TLS 1.3: All data in transit is encrypted
• AES-256: Files encrypted at rest
• bcrypt: Passwords hashed with salt
• CSRF protection: Prevents cross-site attacks
• Rate limiting: Prevents brute force attacks
• Regular audits: Annual penetration testing
• No plaintext secrets: API keys stored securely, never in logs

10. Contact & Data Subject Requests

For privacy concerns or to exercise your rights:

• General inquiries: Contact form
• Data Subject Requests (GDPR): Use dashboard "Privacy & Data" or email support@prismojo.com
• California Residents (CCPA): Request access, deletion, or opt-out in dashboard settings
• Response timeframe: 30 days (GDPR), 45 days (CCPA)

11. Changes to This Policy

We may update this policy occasionally. Material changes will be announced by email or dashboard notification. Continued use after changes constitutes acceptance.