--- title: "Privacy — Prism" description: "How prism.tm handles personal data: what is collected, why, by whom and for how long." url: https://prism.tm/privacy/ --- PRIVACY | UPDATED 3 OCTOBER 2026 # Privacy. This policy covers the website prism.tm. It does not cover the Prism software you run yourself: a self-hosted Prism gateway processes its data on your own machine, and we do not receive it. ## Who is responsible AEGIS ALPHA SA, c/o Fidraco SA, Baarerstrasse 25, 6300 Zug, Switzerland. Company number CHE-236.808.880. For any question about your personal data, or to exercise your rights, write to [privacy@prism.tm](mailto:privacy@prism.tm). ## No cookies prism.tm does not set cookies and does not store anything in your browser's local or session storage. This is why there is no cookie banner. ## What we process and why ### Visiting the website The site is delivered by Cloudflare, Inc. When you load a page, Cloudflare processes your IP address and request details (address requested, browser and device information) to deliver the page and protect the site against abuse. Requests to our analytics endpoint (prism.tm/p/) are logged by Cloudflare (time, status, address requested and technical metadata) and deleted after 3 days; we use these logs only to operate and debug the site. Legal basis: our legitimate interest in running a secure website (Art. 6(1)(f) GDPR). ### Usage statistics We use PostHog to understand how the site is used: which pages are viewed and for how long, where visitors come from (referring site and campaign parameters), which links and buttons are clicked, how the mouse moves and how far pages are scrolled (to draw heatmaps), how fast pages and their requests load, how far people get with the request-access form, and which technical errors occur (error message and where in the code it happened). Each event includes the page address, your browser, operating system, device type and screen size, and an approximate location (country and city) derived from your IP address. We do not record what you type into the form. PostHog runs in a cookieless mode. Instead of identifying you, it counts visits with a hash calculated on PostHog's servers from your IP address, browser user agent and a salt that changes every day, so the same visitor cannot be recognised across days. We do not build profiles and cannot tell who you are from these statistics. Usage statistics are kept in PostHog for 1 year and then deleted. Legal basis: our legitimate interest in measuring and improving the website (Art. 6(1)(f) GDPR). ### Request-access form When you send the form at [prism.tm/request-access](https://prism.tm/request-access/), your browser sends your name, email address, the topic you chose and your message directly to Formspree, Inc. (United States). Formspree stores the submission in our account, checks it for spam and forwards it to us by email; it also receives your IP address and browser information. We use the data only to reply to you and to handle your request. You are not obliged by law or contract to give us this data. Name, email address, topic and message are needed to send the form; without them we cannot answer your request. When you open the request-access page, it loads Cloudflare Turnstile to keep automated spam out. Turnstile processes your IP address, browser user agent and signals about your browser and device to check that the visitor is a person, whether or not you send the form. If the check cannot be completed, the form cannot be sent; you can write to us at [privacy@prism.tm](mailto:privacy@prism.tm) instead. Cloudflare does not use this data for advertising. Legal basis: steps taken at your request before a possible contract, and our legitimate interest in answering enquiries and preventing spam (Art. 6(1)(b) and (f) GDPR). We keep form submissions, including the copy stored at Formspree, for up to 3 years, unless they lead to an ongoing business relationship, in which case they are kept for as long as that relationship requires. ### Email Emails you send to addresses at prism.tm are received by Cloudflare Email Routing and forwarded to our mailbox in Google Workspace. We use them only to answer you and keep them as long as needed for that conversation and any business relationship that follows. Legal basis: our legitimate interest in answering messages sent to us, or steps taken at your request before a possible contract (Art. 6(1)(f) and (b) GDPR). ### Blog Blog posts are written in Ghost, which runs on a server we rent from Hetzner Online GmbH (Germany). Images in blog posts are loaded from that server (cms.prism.tm), which processes your IP address to deliver them. Legal basis: our legitimate interest in showing images in our blog posts (Art. 6(1)(f) GDPR). ## Who receives data - Cloudflare, Inc. (United States): website delivery, security, Turnstile and receiving email for prism.tm. - PostHog, Inc. (United States): usage statistics, stored in the European Union (Frankfurt, Germany); PostHog may access the data from the United States to provide and support the service. - Formspree, Inc. (United States): receipt, spam filtering and storage of form submissions. - Hetzner Online GmbH (Germany): hosting of blog images. - Google (Google Workspace): our mailbox for email sent to prism.tm addresses; Google may process the data in the United States. These providers process data on our behalf and under our instructions. For Turnstile, Cloudflare also uses the signals for its own purpose of improving bot detection, as an independent controller under its [Turnstile Privacy Addendum](https://www.cloudflare.com/turnstile-privacy-policy/). Data reaches the United States through Cloudflare, PostHog, Formspree and Google. For each of them the transfer relies on the EU–US and Swiss–US Data Privacy Framework where the provider is certified, and otherwise on the European Commission's standard contractual clauses, adapted for Swiss law. You can ask us for a copy of the safeguards that apply. We do not sell personal data and do not use it for advertising. ## Your rights You can ask us for access to your personal data, for its correction or deletion, for restriction of processing or for a copy in a portable format, and you can object to processing based on our legitimate interests. Write to [privacy@prism.tm](mailto:privacy@prism.tm). **Right to object.** Where we process your data on the basis of our legitimate interests, you can object at any time on grounds relating to your particular situation (Art. 21 GDPR). We will then stop, unless we have compelling legitimate grounds or need the data to establish, exercise or defend legal claims. Write to [privacy@prism.tm](mailto:privacy@prism.tm). We do not make decisions about you based solely on automated processing. You can also complain to a data protection authority: in Switzerland, the Federal Data Protection and Information Commissioner (FDPIC); in the European Union, the authority in the country where you live or work. This policy is written to meet the Swiss Federal Act on Data Protection (FADP) and, for visitors in the European Union, the General Data Protection Regulation (GDPR). ## Changes We update this policy when the website changes how it handles personal data. The date at the top shows the latest version.