Privacy Policy

Last updated: October 1, 2026

1. Introduction

1.1 What This Privacy Policy Covers

This Privacy Policy explains how Fuerte vision, MB ("we," "us," or "PrismaScribe") collects, uses, stores, and protects your personal data when you use the PrismaScribe AI transcription platform (the "Service"). It applies to all users of our website, web application, mobile applications (including the iOS and Apple Watch apps), and related services.

This Privacy Policy should be read together with our Terms of Service, which govern your use of the Service.

1.2 GDPR Compliance Statement

We are committed to protecting your privacy and complying with the General Data Protection Regulation (GDPR) and all applicable European Union and Lithuanian data protection laws. As an EU-based company, we adhere to the highest standards of data protection.

We process your personal data lawfully, fairly, and transparently. This Privacy Policy is designed to help you understand:

• What personal data we collect and why
• How we use and protect your data
• Your rights under GDPR and how to exercise them
• How to contact us with privacy questions or concerns

1.3 Your Rights Under GDPR

As a data subject under GDPR, you have the following rights:

We will respond to all rights requests within one month (extendable by two further months for complex requests, with explanation).

1.4 Contact Information for Privacy Questions

If you have any questions about this Privacy Policy, how we handle your personal data, or wish to exercise your GDPR rights, please contact us:

Email: hello@prismascribe.ai

Postal Address:

Fuerte vision, MB
Ašmenėlės g. 102C, LT-11330 Vilnius, Lithuania

We aim to respond to privacy inquiries promptly, and formally respond to all GDPR rights requests within one month.

2. Data Controller Information

2.1 Who We Are

The data controller responsible for your personal data is:

Legal Name: Fuerte vision, MB

Registration Number: 307414067

Registered Address: Ašmenėlės g. 102C, LT-11330 Vilnius, Lithuania

Country of Registration: Republic of Lithuania (European Union)

Contact Email: hello@prismascribe.ai

As the data controller, we determine the purposes and means of processing your personal data and are responsible for its protection under GDPR.

2.2 Data Protection Officer (DPO)

Under GDPR Article 37, we are not required to appoint a formal Data Protection Officer because we:

• Are not a public authority
• Do not engage in large-scale processing of special categories of personal data
• Do not engage in large-scale systematic monitoring of individuals

However, we are fully committed to data protection compliance. All privacy inquiries and data subject rights requests should be directed to hello@prismascribe.ai, and will be handled by our privacy-responsible team members.

2.3 Supervisory Authority

As an EU-based company operating in Lithuania, our lead supervisory authority is:

State Data Protection Inspectorate of Lithuania

Address: L. Sapiegos g. 17, LT-10312 Vilnius, Lithuania

Website: https://vdai.lrv.lt/

Email: ada@ada.lt

Phone: +370 5 271 2804

You have the right to lodge a complaint with the State Data Protection Inspectorate if you believe we have violated your data protection rights. However, we encourage you to contact us first at hello@prismascribe.ai so we can attempt to resolve any concerns.

2.4 EU Representative

As we are an EU-based company (Lithuania), we are not required to appoint an EU representative under GDPR Article 27. We operate directly within the European Union and are subject to EU data protection law.

2.5 International Data Transfers

While we are based in the EU, some of our service providers operate servers outside the European Economic Area (EEA). We have implemented appropriate safeguards for all international transfers, as detailed in Section 5 (International Data Transfers) of this Privacy Policy.

3. What Personal Data We Collect

We collect only the personal data necessary to provide, improve, and secure our Service. This section explains what data we collect, organized by category.

3.1 Account Information

When you create an account with PrismaScribe, we collect:

Processing by: Our authentication service provider - see Section 5 for data transfer details.

3.2 Usage Data

When you use our Service, we collect and process:

Processing by:

• Speech and voice providers - audio/video content, live microphone audio, text you ask to have read aloud, file metadata
• AI language model providers (translation, summarization, other AI content) - transcript text and any images or documents you attach to an AI request; audio and video are never sent to them
• Meeting recording provider - meeting link, meeting audio and video, participant display names
• Cloud storage provider - all uploaded files and generated content

3.3 Payment Information

For paid subscriptions and one-off purchases (such as extra transcription hours), we collect:

Processing by: Our payment processor - see Section 5 for data transfer details.

Important: We never receive your full card number. Our payment processor collects your payment method directly. We store only your plan, subscription status, billing dates and transaction references, and can see limited details (such as card brand, last four digits and country) in the processor's systems when we need to handle a billing question.

3.4 Technical Data

We automatically collect certain technical information when you use our Service:

3.5 Communications Data

When you contact us, we collect:

• Support Correspondence: Your messages, attachments, and our responses when you contact customer support
• In-App Feedback: Your message, plus the app version, platform, language and plan it was sent from
• Email Communications: Records of the service emails we send you (type, date and delivery status)
• Internal Support Notes: Notes and labels our support staff add to your account while helping you

Data About Other People

If you invite someone to a workspace or share content with them, we process their email address to send the invitation or notice. If you record a conversation or send the meeting assistant to a meeting, we process the voices of the other participants and, for meetings, their display names as speaker labels, on your instructions. You are responsible for having the right to record them (see our Terms of Service).

3.6 Data We Do NOT Collect

We are committed to data minimization. We do not intentionally collect:

3.7 Data Retention Summary

We retain personal data only as long as necessary:

• Account data: Until you delete your account
• Usage data (files, transcriptions): Until you delete them, or account deletion
• Payment records: kept by our payment processor, and purchase records kept by us, for as long as tax and accounting law requires
• Technical logs: about 30 days
• Support correspondence: 3 years

See Section 7 (Data Retention) for complete retention details.

4. How We Use Your Personal Data

We use your personal data only for specific, explicit, and legitimate purposes. For each purpose, we identify the lawful basis under GDPR Article 6(1).

4.1 To Provide the Service (Legal Basis: Contract Performance - Article 6(1)(b))

What we do:

• Process uploaded, recorded and imported files through our speech-to-text provider to convert audio/video to text
• Record and transcribe online meetings through our meeting recording provider when you send the meeting assistant to a meeting
• Transcribe and interpret live speech by streaming microphone audio to our speech provider during a live session (the audio itself is not stored by us)
• Import media from links you provide
• Generate translations of transcripts using AI language model providers (when you request translation)
• Generate summaries and other AI content (meeting minutes, notes, quizzes, flashcards, to-do lists, answers to your questions) using AI language model providers, when you request them
• Store your files securely with our cloud storage provider
• Manage your account including authentication, access control, and profile management
• Deliver transcriptions, translations, and other content to you via our website, mobile and watch apps, and email notifications
• Enable sharing and workspaces so you can share content with the people you choose
• Enable file organization through folders, tags, and project management features
• Provide download functionality for your transcripts and processed content

Legal basis: Processing is necessary to perform our contract with you (the Terms of Service). Without this processing, we cannot provide the Service.

Data involved:

• Account information (email, name and, if you use one, a password hash)
• Uploaded files (audio, video)
• Generated content (transcriptions, translations, summaries)
• File metadata and organization data

Processor categories involved:

• Authentication and account management
• Speech-to-text transcription
• Meeting recording
• AI language model providers (translation, summarization, other AI content)
• Cloud file storage

4.2 Payment Processing (Legal Basis: Contract Performance - Article 6(1)(b))

What we do:

• Process subscription payments through our PCI DSS Level 1 compliant payment processor
• Manage billing cycles and automatic renewals
• Generate invoices and payment receipts
• Handle refunds and disputes in accordance with our Terms of Service
• Enforce payment terms including suspension for non-payment
• Maintain transaction records for accounting and tax purposes

Legal basis: Processing is necessary to perform our contract with you. We cannot provide paid subscription services without payment processing.

Additional legal basis for long-term retention: Legal obligation (Article 6(1)(c)) - Lithuanian law requires us to retain accounting and tax records for 7 years.

Data involved:

• Payment information (processed by our payment processor)
• Billing address
• Transaction history
• Subscription status

Processor categories involved:

• PCI DSS Level 1 compliant payment processor

4.3 Customer Support (Legal Basis: Legitimate Interest - Article 6(1)(f))

What we do:

• Respond to inquiries sent to hello@prismascribe.ai
• Troubleshoot technical issues you experience with the Service
• Provide guidance on using features and capabilities
• Investigate and resolve service disruptions or errors
• Follow up on support tickets to ensure resolution

Legal basis: Legitimate interest - we have a legitimate interest in providing excellent customer support to maintain service quality and customer satisfaction. This interest is not overridden by your rights and freedoms.

Your rights: You can object to this processing under GDPR Article 21. However, this may limit our ability to provide support.

Data involved:

• Contact information (email, name)
• Support correspondence
• Technical data related to your issue
• Account information (to identify your account)

4.4 Service Improvement and Development (Legal Basis: Legitimate Interest - Article 6(1)(f))

What we do:

• Analyze usage patterns to understand how users interact with the Service
• Improve AI accuracy by analyzing transcription quality (without using your data for training)
• Develop new features based on user needs and behavior
• Optimize performance of the platform (speed, reliability, scalability)
• Identify and fix bugs to improve service stability

Legal basis: Legitimate interest - we have a legitimate interest in improving our Service to remain competitive and meet user needs. This interest is not overridden by your rights and freedoms.

Your rights: You can object to this processing under GDPR Article 21, which will exclude your data from analytics and improvement activities.

Data involved:

• Usage patterns and feature interactions
• Technical data (browser, device, IP address)
• File metadata (NOT file content)
• Performance metrics

Important limitations:

• We DO NOT use your uploaded audio/video content for service improvement
• We DO NOT use your transcript content for AI training
• We analyze only metadata and usage patterns

4.5 Legal Compliance and Safety (Legal Basis: Legal Obligation - Article 6(1)(c) and Legitimate Interest - Article 6(1)(f))

What we do:

• Comply with Lithuanian and EU law including data protection, tax, and commercial regulations
• Respond to legal requests from law enforcement, courts, or regulatory authorities (when legally required)
• Prevent fraud and abuse including payment fraud, account sharing, and terms violations
• Enforce our Terms of Service including investigating violations
• Protect our legal rights in disputes or legal proceedings
• Conduct security monitoring to detect and prevent unauthorized access
• Investigate security incidents and data breaches

Legal basis:

• Legal obligation (Article 6(1)(c)) for compliance with laws, regulations, and valid legal orders
• Legitimate interest (Article 6(1)(f)) for fraud prevention, security, and enforcement of our rights

Data involved:

• Any personal data relevant to the legal obligation or security concern
• Account information
• Usage logs and technical data
• Payment information (for fraud prevention)
• Communications data (for abuse investigation)

Your rights: You cannot object to processing based on legal obligation. For processing based on legitimate interest (fraud prevention, security), you can object under Article 21, but we may refuse if we demonstrate compelling legitimate grounds.

4.6 Marketing and Communications (Legal Basis: Legitimate Interest - Article 6(1)(f))

What we do:

Service Communications (Legitimate Interest):

• Transactional emails: Welcome, transcription finished or failed, subscription and payment status, workspace invitations and sharing notices (necessary for the service)
• Important service updates: Changes to Terms of Service, Privacy Policy, or critical service announcements
• Sign-in and security emails: Sent by our authentication provider (for example sign-in codes and password changes); receipts are sent by our payment processor

Product Updates and Reminders (Legitimate Interest, with opt-out):

• Product updates: New features, tips and offers for our own services, sent to account holders
• Checkout reminders: A reminder if you start a purchase and do not finish it
• Surveys and feedback requests: Invitations to provide feedback or participate in research

Legal basis:

• Legitimate interest (Article 6(1)(f)) for service communications necessary to maintain the service relationship
• Legitimate interest (Article 6(1)(f)) for product updates and reminders about our own similar services, sent to existing account holders, with an easy way to opt out at any time

Your rights:

• Opt-out: You can switch off product updates and reminders at any time in your account's email preferences (linked from every such email) or by emailing hello@prismascribe.ai, without affecting your ability to use the Service
• Cannot opt-out of service communications: Transactional and security emails are necessary to provide the Service safely

Data involved:

• Email address
• Name (for personalization)
• Service usage data (for targeted, relevant communications)

5. International Data Transfers

5.1 Overview

Your files and generated content are stored with our cloud storage provider in a European location, and our application and database are hosted in the European Union. However, to provide our transcription, AI, meeting recording and payment services, we work with certain trusted service providers that process data outside the European Economic Area (EEA).

We understand that international data transfers require special protection under GDPR, and we have implemented appropriate safeguards for all transfers to ensure your data receives the same level of protection as it would within the EU.

Each third-party provider that receives your audio, transcripts, or other personal data is contractually required, through a Data Processing Agreement and Standard Contractual Clauses, to provide a level of data protection equal to that required under this Privacy Policy and applicable law, and to use your data solely to perform the service on our behalf, not to train their own models.

5.2 EU-US Data Transfers

For transfers to the United States, we rely on service providers that participate in recognized data protection frameworks:

EU-US Data Privacy Framework (DPF)

• Our authentication service provider is certified under the EU-US Data Privacy Framework, which provides a legally recognized mechanism for transferring personal data from the EU to the United States
• The DPF requires participating companies to adhere to strict data protection principles and is subject to enforcement by the US Federal Trade Commission

Standard Contractual Clauses (SCCs)

• In addition to DPF certification, we use Standard Contractual Clauses (approved by the European Commission under GDPR Article 46(2)(c)) with US-based processors
• SCCs are legally binding contracts that impose EU data protection obligations on data processors outside the EEA

5.3 Other International Transfers

Speech-to-Text Transcription Processing

• Processing locations: United States and other countries where our speech providers operate
• Data transferred: Audio/video files uploaded, recorded or imported for transcription, live microphone audio, text you ask to have read aloud, file metadata
• Safeguards: Data Processing Agreement, Standard Contractual Clauses

AI Language Model Providers (Translation, Summarization, AI Content)

• Processing locations: United States and other countries where our AI providers operate
• Data transferred: Transcript text, and any images or documents you attach to an AI request (audio/video files are NOT sent to these providers)
• Safeguards: Data Processing Addenda, Standard Contractual Clauses
• Data retention: Providers may keep content for a limited time for abuse monitoring under their data processing terms, then delete it
• Training: Your data is not used to train AI models (business service terms)

5.4 Legal Safeguards for International Transfers

All international data transfers are protected by one or more of the following legally recognized safeguards:

Additional Transfer Impact Assessments

• We assess the laws and practices of the destination country before engaging a provider outside the EEA, so that the protections provided by SCCs are not undermined
• We continuously monitor legal developments (such as court decisions and regulatory guidance) that may affect the validity of our transfer mechanisms
• If a transfer mechanism becomes invalid, we will implement alternative safeguards or suspend transfers until adequate protection can be ensured

5.5 Your Rights Regarding International Transfers

You have the right to:

• Be informed about which of your data is transferred outside the EEA and to which countries
• Request copies of the safeguards we use (such as SCCs) by emailing hello@prismascribe.ai
• Object to transfers to specific countries if you have compelling legitimate grounds

5.6 Categories of Third-Party Processors

We work with carefully selected third-party providers across the following categories to deliver our service. Each is bound by a Data Processing Agreement and Standard Contractual Clauses (or equivalent safeguards) for any international transfers.

Your files are stored in Europe. Uploaded files and generated content are stored with our cloud storage provider in a European location, and our application and database are hosted in the European Union.

The categories in the table above, together with those described in Section 10.2, cover every third-party provider that processes personal data on our behalf. Information about the specific recipients of your personal data is available to users of the Service on request via hello@prismascribe.ai.

6. Data Security

6.1 Security Measures Overview

Protecting your personal data is our highest priority. We implement industry-standard technical and organizational security measures to protect your data against unauthorized access, accidental loss, destruction, or damage.

Important Disclaimer: While we employ robust security measures, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security, but we continuously work to protect your data using best practices and industry standards.

6.2 Technical Security Measures

Encryption in Transit

• All data transmitted between your browser and our servers is encrypted in transit using industry-standard protocols
• API communications with third-party processors use encrypted channels
• Secure protocols help protect data against interception in transit

Encryption at Rest

• All uploaded files are encrypted at rest using industry-standard encryption
• Encryption keys are managed by our storage and hosting providers, separately from the data
• Database backups are encrypted using industry-standard encryption algorithms

Password Security

• Passwords are never stored in plain text
• Authentication uses industry-standard password hashing
• We support and encourage the use of strong, unique passwords and multi-factor authentication (MFA)

Secure Authentication

• Session tokens are cryptographically signed and expire after periods of inactivity
• Industry-standard protocols for sign-in through third-party identity providers
• Rate limiting and anomaly detection to prevent brute-force attacks

Infrastructure Security

• Regular security patching and updates to all systems
• Network segmentation and firewall protection
• Managed cloud hosting with network protection provided by our hosting and edge providers
• Distributed Denial of Service (DDoS) protection at the network edge

6.3 Organizational Security Measures

Access Controls

• Role-based access control (RBAC) ensuring employees have access only to data necessary for their roles
• Principle of least privilege applied across all systems
• Administrative access is limited by role, confirmed with our authentication provider on every request, and recorded in an audit log
• Regular access reviews and immediate revocation upon employee departure

Employee Training and Awareness

• Team members with access to personal data are bound by confidentiality obligations
• Data protection guidance for everyone who handles personal data
• Clear incident response procedures

Vendor Due Diligence

• Security and data protection review before engaging third-party processors
• Regular reviews of processor security practices and compliance certifications
• Preference for processors with SOC 2, ISO 27001, or equivalent certifications
• Ongoing monitoring of security incidents and breach notifications from processors

Data Processing Agreements

• Legally binding Data Processing Agreements (DPAs) with all processors
• DPAs include security obligations, breach notification requirements, and audit rights
• Sub-processor approval and notification procedures
• Contractual liability for processor security failures

6.4 Data Breach Notification

We have established procedures to detect, respond to, and notify you of data breaches in compliance with GDPR Articles 33 and 34:

Notification to Supervisory Authority (Article 33)

• If we discover a personal data breach, we will notify the Lithuanian Data Protection Inspectorate within 72 hours of becoming aware of the breach (unless the breach is unlikely to result in a risk to your rights and freedoms)
• Notification includes: nature of the breach, categories and approximate number of affected individuals, likely consequences, and measures taken or proposed

Notification to Affected Individuals (Article 34)

• If a breach is likely to result in a high risk to your rights and freedoms, we will notify you directly without undue delay
• Notification will be clear and plain language, explaining: the nature of the breach, contact point for more information, likely consequences, and measures you can take to mitigate potential harm
• We will provide recommendations (such as password changes or fraud monitoring) where applicable

Breach Response Process

1. Detection: Continuous monitoring for security incidents
2. Containment: Immediate action to stop the breach and prevent further data loss
3. Assessment: Evaluation of scope, affected data, and risk level
4. Notification: Compliance with 72-hour notification deadline
5. Remediation: Fixing vulnerabilities and implementing preventive measures
6. Documentation: Comprehensive records of all breaches, responses, and lessons learned

6.5 Your Responsibilities for Account Security

While we implement strong security measures, account security is a shared responsibility:

Your Obligations

• Use strong, unique passwords: Avoid reusing passwords from other services
• Enable multi-factor authentication (MFA): Add an extra layer of security to your account
• Keep credentials confidential: Never share your password or session tokens
• Use secure devices: Ensure your devices have up-to-date security software
• Log out on shared devices: Always log out when using public or shared computers
• Report suspicious activity: Contact us immediately at hello@prismascribe.ai if you notice unauthorized access

What to Do If You Suspect Unauthorized Access

1. Change your password immediately
2. Review your account activity and recent transcriptions
3. Contact us at hello@prismascribe.ai with details
4. Consider enabling MFA if not already enabled
5. Review devices with active sessions and revoke unfamiliar sessions

6.6 Third-Party Processor Security

We rely on the security measures implemented by our trusted processors:

We continuously monitor our processors' security practices and incident reports. If a processor experiences a breach affecting your data, we will fulfill our notification obligations and work with the processor to mitigate harm.

7. Data Retention

7.1 Retention Principles

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, comply with legal obligations, resolve disputes, and enforce our agreements.

Our Retention Philosophy

• Purpose limitation: When data is no longer needed for its original purpose, it is deleted
• Storage minimization: We don't keep data "just in case" – retention periods are based on legitimate needs
• Transparent deletion: You can request deletion at any time (subject to legal exceptions)
• You are in control: Your content stays until you delete it or your account. Some technical data expires on its own, for example expired share links and meeting recordings held by our meeting recording provider, which it deletes after 30 days

7.2 Retention Periods by Data Category

The following table specifies how long we retain different categories of personal data:

Third-Party Processor Retention

• Speech-to-text transcription: Provider-side retention per their data retention policy
• AI language model providers: May keep content for a limited time for abuse monitoring under their data processing terms, then delete it (not used for training)
• Meeting recording provider: Deletes recordings after 30 days, or immediately when you delete the recording
• Authentication service: Your account there is deleted when you delete your PrismaScribe account
• Payment processor: Retains payment records for the period required by financial and tax regulations

7.3 Deletion Process

User-Initiated Deletion

• You can delete individual files, transcripts, or translations at any time from your dashboard
• Deletion is immediate from our cloud storage
• For meeting recordings, we also instruct our meeting recording provider to delete its copy immediately
• Deleted data cannot be recovered – deletion is permanent. Copies may remain in encrypted database backups for up to 7 days before they are overwritten

Account Deletion Process

When you delete your account:

1. Immediate: Your account is deleted at our authentication provider and you can no longer log in
2. Within minutes: Your files, transcripts, generated content, settings and account records are deleted from our database and storage; your customer record and saved payment methods are deleted at our payment processor; recordings held by our meeting recording provider are deleted
3. Payment data exception: Invoices and payment records are kept by our payment processor, and one-off purchase records by us, for the period required by tax and accounting law
4. Staff action records: The append-only log of what our staff did on your account is kept for security and accountability; it contains no content

How to Request Deletion

• Individual files: Use the delete button in your dashboard
• Account deletion: On the web, open Account → Danger Zone → Delete My Account; in the mobile app, open Settings → Delete account. You can also email hello@prismascribe.ai with subject "Account Deletion Request"
• Specific data categories: Email hello@prismascribe.ai specifying what you want deleted

7.4 Retention After Account Deletion

No Grace Period

• Account deletion is immediate and permanent on every plan. There is no grace period and no way to reactivate a deleted account
• Download anything you want to keep before deleting (see Section 8.5 on data portability)

Subscription Users

• Deleting your account cancels a subscription bought on our website with immediate effect (no refunds for unused time)
• A subscription bought through the Apple App Store or Google Play is not cancelled by account deletion; cancel it in your app store account

What Is Deleted vs. Retained

7.5 Legal Holds and Exceptions

When We Cannot Delete Data

We may be unable to delete certain data if:

• Legal obligation: We are required by law to retain data (e.g., tax records for 7 years)
• Legal claims: Data is necessary for the establishment, exercise, or defense of legal claims
• Pending litigation: A court order or legal hold prevents deletion
• Fraud prevention: Data is needed to prevent fraudulent account recreation or abuse

Notification

If we cannot fulfill a deletion request due to a legal exception, we will:

1. Notify you within 30 days of your request
2. Explain the specific legal basis preventing deletion
3. Specify when the data will be deleted (if a retention period applies)
4. Restrict processing to the minimum necessary for the legal purpose

Anonymization Alternative: Where full deletion is not legally possible, we will anonymize your data by removing all personal identifiers, rendering it no longer "personal data" under GDPR.

8. Your GDPR Rights (Detailed)

Under the General Data Protection Regulation (GDPR), you have comprehensive rights regarding your personal data. This section explains each right in detail and how to exercise them.

8.1 Right of Access (Article 15)

What This Right Gives You

You have the right to obtain confirmation as to whether we are processing your personal data and, if so, to access that data along with specific information about the processing.

What We Will Provide

Upon request, we will provide:

• Confirmation of whether we process your personal data
• A copy of your personal data in a commonly used electronic format
• Information about: processing purposes, data categories, recipients, retention periods, your rights, the right to lodge a complaint, data sources (if not collected from you), and existence of automated decision-making

What Data You Can Access

• Account information (name, email, registration date)
• Uploaded files and generated content (transcripts, translations, summaries)
• Payment history and subscription details
• Technical logs related to your account (about the last 30 days)
• Communication history with our support team

How to Request Access

• Email hello@prismascribe.ai with subject line: "GDPR Access Request"
• Specify what data you want to access (or request "all personal data")
• We will respond within one month with your data package

Format of Data Provided

• Structured data (account info, metadata): JSON or CSV format
• Files and content: Original formats (e.g., MP3, TXT, PDF)
• Delivered via secure download link with 7-day expiration

8.2 Right to Rectification (Article 16)

What This Right Gives You

You have the right to have inaccurate personal data corrected and to have incomplete personal data completed.

What You Can Correct

• Account profile information (name, email address)
• Billing information (address, company name)
• Communication preferences
• Generated content (transcripts, translations) that you have edited

How to Update Your Data

• Self-service: Most data can be corrected directly in your account settings
• Email request: For data you cannot edit yourself, email hello@prismascribe.ai
• We will make corrections within one month and notify any third parties who received the incorrect data (if applicable)

Third-Party Data: If we have shared inaccurate data with processors (e.g., an incorrect email forwarded to our authentication provider), we will notify them of the correction.

8.3 Right to Erasure / "Right to be Forgotten" (Article 17)

What This Right Gives You

You have the right to have your personal data deleted without undue delay under certain circumstances.

When You Can Request Erasure

• The data is no longer necessary for the purposes for which it was collected
• You withdraw consent (where consent was the legal basis for processing)
• You object to processing and there are no overriding legitimate grounds
• Your data has been unlawfully processed
• Erasure is necessary to comply with a legal obligation
• The data was collected in relation to the offer of information society services to a child

Exceptions – When We Cannot Delete

• Legal obligation: Payment and purchase records must be kept for the period required by tax and accounting law
• Legal claims: Data is necessary for defending or establishing legal claims
• Public interest: Processing is necessary for public health, archiving, scientific/historical research
• Ongoing contract: Data is necessary to fulfill our contract with you (e.g., active subscription)

How to Request Erasure

• Self-service: delete individual files from your library, or delete your whole account from Account → Danger Zone (web) or Settings → Delete account (mobile app)
• Or email hello@prismascribe.ai with subject: "Right to Erasure Request" and specify what data you want deleted (or request "complete account deletion")
• We will process emailed requests within one month and confirm deletion

What Happens After Deletion

• Immediate access revocation
• Deletion from our database and storage within minutes (copies may remain in encrypted backups for up to 7 days)
• Your account is deleted at our authentication provider, your customer record at our payment processor, and any recordings held by our meeting recording provider
• Payment and purchase records are kept only for as long as tax and accounting law requires

8.4 Right to Restrict Processing (Article 18)

What This Right Gives You

You have the right to restrict (limit) how we process your data in certain circumstances, rather than requesting full deletion.

When You Can Request Restriction

• You contest the accuracy of your data (restriction applies while we verify accuracy)
• Processing is unlawful, but you prefer restriction over deletion
• We no longer need the data, but you need it for legal claims
• You have objected to processing based on legitimate interests (restriction applies while we verify whether our legitimate grounds override yours)

What "Restriction" Means

• We store your data but do not actively process it (except with your consent)
• We can process restricted data for: storage, legal claims, protection of another person's rights, or important public interest reasons
• You will be informed before restriction is lifted

How to Request Restriction

• Email hello@prismascribe.ai with subject: "Right to Restrict Processing"
• Explain the reason for your request
• We will respond within one month and confirm restriction measures

Impact on Service: Restricting processing may limit or prevent your use of PrismaScribe services during the restriction period.

8.5 Right to Data Portability (Article 20)

What This Right Gives You

You have the right to receive your personal data in a structured, commonly used, and machine-readable format and to transmit that data to another controller.

What Data Is Portable

• Data you provided to us (not data we generated or derived)
• Data processed based on consent or contract (not legal obligation or legitimate interest)

Specifically Includes

• Account information (name, email, registration date)
• Uploaded files (audio/video files in original format)
• Transcripts you generated (TXT, JSON, or SRT format)
• Translation and summary outputs
• File metadata (upload dates, durations, language settings)

Format Options

• JSON: Structured data (account info, metadata)
• CSV: Tabular data (file lists, usage history)
• Original formats: Audio/video files, transcripts in TXT/SRT
• ZIP archive: All data packaged together for easy download

How to Request Data Portability

• Self-service: download any original file and export any transcript (TXT, SRT, VTT, PDF, Word, and Markdown) from your library at any time
• For a full copy of all your data, email hello@prismascribe.ai with subject: "Data Portability Request" and specify format preferences (or we will use default formats)
• We will provide a secure download link within one month
• Link expires after 7 days for security reasons

Direct Transmission: If technically feasible, we can transmit your data directly to another service provider you specify (requires compatible API).

8.6 Right to Object (Article 21)

What This Right Gives You

You have the right to object to processing of your personal data in certain situations.

When You Can Object

1. Processing Based on Legitimate Interests

• You can object to processing based on our legitimate interests (see Section 4.3)
• We will stop processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms

2. Direct Marketing

• You have an absolute right to object to processing for direct marketing purposes
• We will stop all marketing processing immediately upon objection
• Switch off product-update emails in Account → Email preferences, or email hello@prismascribe.ai

3. Profiling

• You can object to profiling related to direct marketing (we do not profile you beyond the standard advertising measurement described in Section 9)

How to Object

• Marketing: Turn off product-update emails in Account → Email preferences (immediate effect)
• Other processing: Email hello@prismascribe.ai with subject: "Right to Object"
• Explain your specific situation and grounds for objection
• We will respond within one month

Impact on Service: Objecting to certain processing may affect our ability to provide services (e.g., objecting to transcription processing means we cannot generate transcripts).

8.7 Rights Related to Automated Decision-Making and Profiling (Article 22)

What This Right Gives You

You have the right not to be subject to decisions based solely on automated processing (including profiling) that produce legal effects or similarly significantly affect you.

Our Current Practices

• We do NOT make automated decisions with legal or similarly significant effects
• AI transcription, translation, and summarization are tools you control, not automated decisions about you
• Subscription upgrades/downgrades require your explicit action
• We do not use automated creditworthiness assessments or algorithmic pricing

Transparency About AI Processing

• Our speech-to-text provider transcribes audio (you review and edit output)
• Our AI language model providers translate/summarize transcripts (you control when and whether to use these features)
• These are processing tools, not decision-making systems that affect your rights

If We Introduce Automated Decision-Making

Should we introduce automated decision-making in the future, we will:

1. Notify you and update this Privacy Policy
2. Obtain your explicit consent (where required)
3. Provide information about the logic involved
4. Give you the right to human intervention and to contest decisions

8.8 How to Exercise Your Rights

General Request Process

1. Submit Request

• Email: hello@prismascribe.ai
• Subject line: Specify the right you're exercising (e.g., "Right to Access Request")
• Include: Your registered email address, description of your request, any specific details

2. Identity Verification

• To protect your data, we must verify your identity before fulfilling requests
• We will ask you to confirm information from your account or send a verification email to your registered address
• For sensitive requests (e.g., full account deletion), we may require additional verification

3. Response Timeline

• One month: Standard response time from receipt of your request
• Extension: We may extend by two further months for complex requests (we will notify you within the first month with reasons for the delay)
• No undue delay: We aim to respond as quickly as possible

4. Response Format

• Electronic format by default (email or secure download link)
• Paper format available upon request

Request Template

8.9 Right to Lodge a Complaint with Supervisory Authority

Your Right to Complain

If you believe we have violated your data protection rights, you have the right to lodge a complaint with a supervisory authority, particularly in the EU Member State of:

• Your habitual residence
• Your place of work
• The place of the alleged infringement

Lithuanian Data Protection Inspectorate (Our Lead Supervisory Authority)

Since PrismaScribe is established in Lithuania, our lead supervisory authority is:

Valstybinė duomenų apsaugos inspekcija (State Data Protection Inspectorate)

• Address: L. Sapiegos g. 17, LT-10312 Vilnius, Lithuania
• Phone: +370 5 271 2804
• Email: ada@ada.lt
• Website: https://vdai.lrv.lt/
• Online complaint form: Available on website

How to File a Complaint

1. Try to resolve with us first: Contact hello@prismascribe.ai (not required, but often faster)
2. Prepare complaint: Document the issue, dates, communications, and your concerns
3. Submit to authority: Use online form or email/postal mail
4. Cooperate with investigation: Respond to any follow-up questions from the authority

Other EU Supervisory Authorities: You can also complain to the supervisory authority in your own EU country. Find your local authority at: https://edpb.europa.eu/about-edpb/about-edpb/members_en

Your Right Is Not Affected: Lodging a complaint does not affect your right to seek judicial remedies or compensation through civil courts.

8.10 No Fee for Exercising Your Rights

Free Exercise of Rights

You can exercise all of your GDPR rights free of charge. We will not charge fees for:

• Access requests
• Rectification requests
• Erasure requests
• Restriction requests
• Data portability requests
• Objection requests

Exception: Manifestly Unfounded or Excessive Requests

We may charge a reasonable fee or refuse to act on requests that are:

• Manifestly unfounded: Clearly made in bad faith or for harassing purposes
• Excessive: Repetitive requests for the same information within a short period without valid reason

If we determine a request is manifestly unfounded or excessive:

1. We will explain why we consider it so
2. We will give you an opportunity to justify the request
3. If we charge a fee, it will be reasonable and based on administrative costs
4. If we refuse the request, we will explain your right to complain to a supervisory authority

Reasonable Requests Are Always Free: Even if you make multiple requests over time for legitimate reasons (e.g., updating information, verifying compliance), these will always be free.

Questions About Your Rights?

If you have any questions about your GDPR rights or how to exercise them, please contact our Data Protection Team at hello@prismascribe.ai. We are here to help you understand and exercise your rights.

9. Cookies and Tracking Technologies

9.1 What Are Cookies

Cookies are small text files stored on your device (computer, tablet, or mobile phone) when you visit our website. They help us recognize your device, remember your preferences, and analyze how you use our services. Cookies enable essential functionality like keeping you logged in and help us improve your experience.

Similar technologies include local storage, session storage, and other browser-based storage mechanisms that serve comparable purposes.

9.2 Types of Cookies We Use

We use the following categories of cookies on PrismaScribe:

Essential/Strictly Necessary Cookies

These cookies are required for the basic operation of our platform. They enable core functionality such as:

• Authentication and session management (via our authentication service provider)
• Security features and fraud prevention
• Load balancing and service delivery
• Cookie consent preferences

You cannot opt out of essential cookies as they are necessary for the platform to function. Without these cookies, services you have requested (such as accessing your account) cannot be provided.

Analytics Cookies

These cookies help us understand how visitors interact with our website using pseudonymous identifiers rather than your name or email:

• Google Analytics: Tracks page views, user behavior, traffic sources, and performance metrics
• Purpose: Improve user experience, identify technical issues, understand feature usage

Functional Cookies

These cookies enable enhanced functionality and personalization:

• User preferences: Your language and whether the dashboard sidebar is open
• Feature settings: Transcription, transcript display and export settings (kept in your browser's local storage)

You may disable functional cookies, but this may affect certain features and your overall experience.

Advertising and Measurement Tags

Our marketing website loads advertising measurement tags from advertising partners through a tag manager, so that we can see whether our ads lead to sign-ups and purchases and can show our ads to people who have visited our site. These partners may set cookies and combine this information with information they already hold about you. You can block them using your browser settings or the opt-outs in Section 9.4.

What we do not do

• No advertising inside the product: The dashboard and apps show no third-party advertising
• No sale of your data: We do not sell or rent your personal data to anyone
• Embedded videos: Use a privacy-enhanced player that stores data only after you press play

9.3 Cookie Details Table

Note: Cookie names and durations may be updated by third-party providers from time to time. The most current cookie list reflects our active service providers.

9.4 Your Cookie Choices

You have several options to control cookies on PrismaScribe:

Browser Settings

All modern browsers allow you to manage cookie preferences:

• Chrome: Settings > Privacy and Security > Cookies and other site data
• Firefox: Settings > Privacy & Security > Cookies and Site Data
• Safari: Preferences > Privacy > Cookies and website data
• Edge: Settings > Cookies and site permissions > Cookies and site data

You can:

• Block all cookies (may prevent login and essential features)
• Block third-party cookies only (this blocks advertising partner cookies but not Google Analytics, whose cookies are set on our own domain; use the opt-out add-on below for that)
• Delete existing cookies
• Set cookies to expire when you close your browser

Impact of Blocking Cookies:

• Essential cookies blocked: You will not be able to log in or use the platform
• Analytics cookies blocked: No impact on functionality; we simply cannot track usage patterns
• Functional cookies blocked: Some personalization features may not work; settings may not persist

Google Analytics Opt-Out

Google provides a browser add-on to opt out of Google Analytics tracking across all websites:

• Download: Google Analytics Opt-Out Browser Add-On
• Effect: Prevents Google Analytics JavaScript from sharing information about your visit
• Compatibility: Available for Chrome, Firefox, Safari and Edge

Advertising Partner Opt-Outs

• Your Online Choices: youronlinechoices.eu lets you opt out of interest-based advertising from participating partners
• Platform settings: Each advertising partner offers ad preference controls in your account with that platform

9.5 Do Not Track (DNT) Signals

Some browsers offer a "Do Not Track" (DNT) signal that can be sent to websites you visit. However:

• There is no universal standard for interpreting or responding to DNT signals
• Different browsers implement DNT differently
• Many websites do not recognize or honor DNT signals

Our Position: We currently do not respond to DNT signals due to the lack of industry consensus and technical standards. However, we respect your privacy choices through:

• Browser cookie controls (Section 9.4)
• Google Analytics opt-out (Section 9.4)

We monitor developments in DNT standards and will update our practices if universal standards are established.

9.6 Local Storage and Similar Technologies

In addition to cookies, we use browser local storage and session storage for:

• Cookie consent preferences: Stores your consent choices locally
• Temporary session data: Improves performance by caching non-sensitive data
• UI state: Remembers expanded/collapsed sections, active tabs, library view settings
• Recording safety copy: While you record in the browser, the audio is saved on your device so that a crash or closed tab does not lose it. It is removed once the recording uploads or you discard it

Data Stored:

• Local storage data remains until explicitly deleted
• Session storage data is cleared when you close your browser tab
• Local storage holds only your own settings and, during a browser recording, your own audio; nothing in it is sent to third parties

Managing Local Storage:

• Most browsers allow you to clear local storage via privacy settings
• Clearing local storage may reset your preferences and discard an unfinished recording that has not been uploaded
• Essential functionality does not depend on local storage

9.7 Mobile App

The mobile app does not use cookies. It uses:

• Product analytics: App usage events (for example "recording started") linked to your account ID, processed on EU servers. You can turn this off in the app's settings
• Crash reporting: Crash and error reports so we can fix problems
• Push notification token: So we can tell you when a transcription is ready; you can turn notifications off in your device settings
• On-device consent record: Your answer to the AI processing consent screen is stored on your device, not on our servers

10. Third-Party Services and Links

10.1 Third-Party Services Overview

PrismaScribe integrates with carefully selected third-party service providers to deliver our AI-powered transcription platform. These providers are data processors who process personal data on our behalf under strict contractual terms.

Important Distinction:

• We remain the data controller: We determine purposes and means of processing your personal data
• Third parties are data processors: They process data according to our instructions and contractual obligations
• Data Processing Agreements (DPAs): We have executed GDPR-compliant DPAs with all processors (see Section 5)

We do not sell, rent, or share your personal data with third parties for their own marketing purposes.

10.2 Our Data Processors

As detailed in Section 5 (International Data Transfers), we work with the following categories of processors:

Authentication and User Management

• Service: User authentication, session management, identity verification
• Data processed: Name, email, authentication credentials, session data
• Location: United States (EU-US DPF + Standard Contractual Clauses)

Payment Processing

• Service: PCI DSS Level 1 compliant payment processing, subscription management, billing
• Data processed: Payment information, billing address, transaction history
• Location: Global (Standard Contractual Clauses in place)

Speech and Voice Providers

• Service: Convert audio/video and live microphone audio to text; read text aloud; remove background noise
• Data processed: Audio/video files, live microphone audio, text to be read aloud, file metadata
• Location: United States and other countries (Standard Contractual Clauses in place)

AI Language Model Providers

• Service: Translation, summarization, study materials, and other AI content generation
• Data processed: Transcript text and attachments you add to an AI request (NOT audio files)
• Location: United States and other countries (Standard Contractual Clauses in place, no training on your content)

Meeting Recording

• Service: Join online meetings on your behalf, record them and transcribe them
• Data processed: Meeting link, meeting audio and (if you turn it on) video, participants' display names, transcript
• Location: European Union

Storage Infrastructure

• Service: Object storage for audio files and transcripts
• Data processed: Uploaded audio files, generated transcripts, user content
• Location: Europe (provider location); limited service data may be processed elsewhere (Standard Contractual Clauses in place)

Application Infrastructure

• Service: EU-based frontend and backend hosting, database, messaging
• Data processed: All application data, user data, transcript metadata, usage records, subscriptions
• Location: EU

Email Delivery

• Service: Transactional email delivery (notifications, account emails)
• Data processed: Email addresses, email content
• Location: United States (Standard Contractual Clauses in place)

Analytics & Error Monitoring

• Service: Website usage analytics, mobile app analytics and application stability monitoring
• Data processed: Website usage data (see Section 9), mobile app usage events linked to your account ID, crash reports and error diagnostics
• Location: EU (mobile app analytics); United States and EU (web analytics, crash reporting) (Standard Contractual Clauses in place)

Content Safety Screening

• Service: Automated screening of content you publish through share links
• Data processed: Text of shared content
• Location: United States (Standard Contractual Clauses in place)

App Stores

• Service: In-app purchases and subscriptions
• Data processed: Purchase receipts and transaction identifiers
• Location: Global

Processor Oversight: We conduct due diligence on all processors to ensure:

• GDPR compliance and appropriate technical/organizational measures
• Data Processing Agreements with GDPR-compliant terms
• Standard Contractual Clauses for international transfers
• Regular security assessments and compliance audits
• Commitment to data protection principles

10.3 Third-Party Terms and Policies

Each of our processors maintains its own terms of service, privacy policy, and Data Processing Agreement. The categories of processors we use are set out in Section 5.6 and Section 10.2 above. Information about the specific recipients of your personal data is available to users of the Service on request via hello@prismascribe.ai.

Our Obligations:

• We ensure all processors meet GDPR requirements before engagement
• We regularly review processor compliance and security practices
• We update this policy when processors change their terms materially
• We maintain copies of all executed DPAs (available upon request)

Your Rights: Your GDPR rights (Section 8) apply to data processed by our processors. We will facilitate the exercise of your rights, including coordinating with processors as necessary.

10.4 External Links

Our website and platform may contain links to third-party websites, resources, or services that are not operated by PrismaScribe. For example:

• Links to third-party tools referenced in this policy (such as browser opt-out tools)
• Links to industry resources or educational content
• Links to user-submitted content hosted elsewhere
• Links to regulatory authorities

We Are Not Responsible For:

• Privacy practices of third-party websites
• Content, accuracy, or availability of external sites
• Terms of service or policies of linked websites
• Security of data you provide to third-party sites

Recommendation: Before providing personal data to any third-party website, review their privacy policy and terms of service. We cannot control or be held responsible for third-party privacy practices.

Click Awareness: When you click an external link, you are leaving the PrismaScribe platform and are subject to the privacy and security policies of the destination website.

10.5 No Endorsement

The inclusion of third-party processors in this policy, or links to third-party websites, does not constitute:

• Endorsement of their other products or services
• Warranty or guarantee of their performance
• Liability for their actions or data practices
• Partnership or affiliation beyond the specific services described

We select processors based solely on their ability to meet our technical requirements and GDPR compliance standards for the specific services we use.

10.6 Changes to Processors

Adding or Changing Processors:

• We may add new processors or change existing ones as business needs evolve
• Before engaging a new processor, we conduct full due diligence and execute appropriate DPAs
• We will update this Privacy Policy (Section 11) when the categories of processors change

Notification of Material Changes:

• If we change a core processor (authentication, payment, AI transcription), we will notify you via email
• You will have the right to object (see Section 8.6)
• If you object and we cannot accommodate your objection, you may delete your account

Sub-Processors: Some processors may use their own sub-processors (e.g., a payment processor may use banking partners). We ensure:

• Processors impose the same data protection obligations on sub-processors
• Appropriate DPAs exist throughout the processing chain
• We maintain a list of material sub-processors (available upon request)

Current Sub-Processor List: The categories of processors we use are set out in Section 5.6 and Section 10.2 above. Information about the specific recipients of your personal data is available to users of the Service on request via hello@prismascribe.ai. Business customers receive our current sub-processor list as part of their data processing agreement.

11. Changes to This Privacy Policy

11.1 Right to Modify

We reserve the right to update, modify, or replace this Privacy Policy at any time to reflect:

• Changes to our data processing practices
• New features or services we offer
• Changes in legal or regulatory requirements
• Updates to third-party processors or technologies
• Improved clarity or transparency in our explanations
• User feedback or privacy best practices

All changes will be made in compliance with GDPR transparency requirements and your rights as a data subject.

11.2 Notification of Changes

We categorize changes as either material or non-material and notify you accordingly:

Material Changes (Significant Impact on Your Rights)

For material changes that significantly affect your privacy rights or how we process your data:

1. Email notification to your registered email address
2. Prominent notice on our website and platform dashboard
3. 30-day advance notice before the changes take effect
4. Highlight of specific changes in the notification
5. Right to review old and new policy versions side-by-side

You will be notified at least 30 days before material changes take effect.

Non-Material Changes (Clarifications and Minor Updates)

For non-material changes that do not affect your rights:

1. Updated "Last Updated" date at the top and bottom of this policy
2. No email notification required
3. Immediate effect (no waiting period)
4. Changelog available upon request

Non-material changes take effect immediately upon posting.

11.3 Material vs. Non-Material Changes

To help you understand what constitutes a material change:

Material Changes Include:

• New data collection: Collecting new categories of personal data
• New processors: Adding third-party processors who handle your personal data
• Changes to international transfers: Transferring data to new countries or regions
• Changes to legal bases: Changing the legal basis for processing (e.g., consent to legitimate interest)
• Longer retention periods: Keeping data for longer than previously stated
• New data uses: Using your data for purposes not previously disclosed
• Changes to your rights: Any reduction or limitation of your GDPR rights
• Security incidents: Significant changes to security practices following an incident

Non-Material Changes Include:

• Contact information updates: Changes to email addresses or postal addresses
• Clarifications: Rewording for clarity without changing meaning
• Formatting improvements: Better organization or readability
• Typo corrections: Fixing grammatical or spelling errors
• Link updates: Updating URLs to third-party policies (if content remains similar)
• Legal citations: Adding references to specific GDPR articles for clarity
• Example additions: Adding examples to clarify existing practices

Uncertain? If you're unsure whether a change is material, we will err on the side of treating it as material and providing full notice.

11.4 Acceptance of Changes

How Acceptance Works:

For Material Changes:

1. You will receive notification 30 days before changes take effect
2. During this 30-day period, the current policy remains in effect
3. After 30 days, continued use of PrismaScribe constitutes acceptance of the new policy
4. If you do not accept the changes, you may:
   • Stop using the service before changes take effect
   • Delete your account (see Section 8.4)
   • Exercise your right to object (see Section 8.6)

For Non-Material Changes:

• Changes take effect immediately upon posting
• Continued use constitutes acceptance

Your Options if You Disagree:

If you do not agree with material changes to this Privacy Policy:

1. Contact us (Section 12) within 30 days to discuss your concerns
2. Object to the changes (we will evaluate if we can accommodate your objection)
3. Export your data (see Section 8.5) before the changes take effect
4. Delete your account (see Section 8.3) to prevent processing under the new terms

Important: If you delete your account:

• We will process the deletion under the current policy (not the new one)
• You may lose access to paid subscription benefits without refund
• Deletion is permanent and cannot be reversed

We respect your right to withdraw consent and will make the process as clear and straightforward as possible.

11.5 Version History

Maintaining Policy Archives:

• We keep every previous version of this Privacy Policy with the date it was published
• Previous versions are available upon request

Requesting Previous Versions:

• Email hello@prismascribe.ai with "Privacy Policy Version History Request"
• Specify the date range or version you're interested in
• We will provide previous versions within 7 business days

Changelog Documentation:

• We keep a record of the changes between versions
• A summary of material changes is available upon request

Why Version History Matters:

• Allows you to understand how our practices have evolved
• Supports accountability and regulatory compliance
• Enables you to verify what policy was in effect at a specific time
• Useful for auditing or legal purposes

11.6 Effective Date of Changes

Timing of Effect:

Material Changes:

• Effective date is 30 days after notification is sent
• Example: Notification sent January 1st → Effective February 1st
• During the 30-day period, the current policy governs all processing
• After 30 days, new policy applies to all processing (past and future)

Non-Material Changes:

• Effective immediately upon posting
• "Last Updated" date at bottom of policy reflects posting date

Notification Date:

• For email notifications, the "notification date" is when we send the email
• Considered delivered within 24 hours of sending
• We will not change effective dates without additional notice

Retroactive Application:

• New policies apply to all data we hold, not just newly collected data
• Exception: If a change would violate your original consent, we will seek new consent
• You may object to processing under new terms (see Section 8.6)

Special Circumstances:

• Urgent security changes: May take effect immediately with post-implementation notice
• Legal requirement changes: May take effect when required by law, with immediate notice
• Processor changes: Take effect when new processor is engaged, with advance notice if possible

12. Contact Us

We are committed to addressing your privacy questions, concerns, and data subject rights requests promptly and transparently. Please use the following contact information:

12.1 General Privacy Inquiries

For questions about this Privacy Policy, our data practices, or privacy concerns:

Email: hello@prismascribe.ai

Subject Line: "Privacy Inquiry"

Appropriate for:

• Questions about how we collect or use your data
• Clarification on any section of this Privacy Policy
• General privacy or security questions
• Feedback on our privacy practices

12.2 Data Subject Rights Requests

To exercise your GDPR rights (see Section 8), including access, rectification, deletion, portability, restriction, or objection:

Email: hello@prismascribe.ai

Subject Line: "GDPR Rights Request - [Specific Right]"

Required Information (see Section 8.8 for detailed instructions):

• Your full name and registered email address
• Specific right(s) you wish to exercise
• Account details to verify your identity
• Any additional information relevant to your request

12.3 Data Protection Concerns or Complaints

If you have concerns about how we handle your personal data or wish to file a privacy complaint:

Email: hello@prismascribe.ai

Subject Line: "Data Protection Concern"

We take all complaints seriously and will:

1. Acknowledge receipt promptly
2. Investigate the matter thoroughly
3. Respond with our findings and any remedial action within one month
4. Escalate to senior management if necessary

Informal Resolution: We encourage you to contact us first so we can attempt to resolve your concern directly.

12.4 Postal Address

For formal written correspondence, legal notices, or if you prefer postal communication:

Fuerte vision, MB

Data Protection Team

Ašmenėlės g. 102C, LT-11330 Vilnius, Lithuania

When to Use Postal Mail:

• Formal legal notices or demands
• Situations requiring certified mail or proof of delivery
• If you prefer written correspondence to email
• Submitting supporting documentation for rights requests

Note: Postal mail responses may take longer than email responses (up to 14 additional days for processing and reply delivery).

12.5 Response Time Commitments

We are committed to timely responses:

Acknowledgment:

• We acknowledge receipt promptly, normally within a few business days
• The acknowledgment confirms we received your inquiry and are reviewing it

Substantive Response:

• One month for substantive response to GDPR rights requests (as required by GDPR Article 12)
• 14 business days for general privacy inquiries
• 7 business days for urgent security concerns

Extensions:

• For complex requests, we may extend response time by two further months (GDPR Article 12)
• We will inform you of any extension within the first month
• We will explain the reason for the delay

Business Days: Monday through Friday, excluding Lithuanian public holidays.

12.6 Supervisory Authority

If you are not satisfied with our response to your privacy concern or GDPR rights request, you have the right to lodge a complaint with the relevant supervisory authority.

For Lithuanian Residents or EEA Data Subjects:

State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija)

• Website: https://vdai.lrv.lt/
• Email: ada@ada.lt
• Phone: +370 5 271 2804
• Address: L. Sapiegos g. 17, LT-10312 Vilnius, Lithuania

For Other Jurisdictions:

• UK residents: Information Commissioner's Office (ICO) - https://ico.org.uk/
• Other EEA residents: Your local data protection authority - https://edpb.europa.eu/about-edpb/board/members_en

Your Right to Complain:

• You may lodge a complaint at any time, even while we are addressing your concern
• We encourage you to contact us first for faster resolution
• Lodging a complaint does not affect your legal rights or remedies

See Section 8.9 for additional information about supervisory authorities and complaint procedures.

12.7 Last Updated

This Privacy Policy was last updated on: October 1, 2026

Document Version: 1.2

12.8 Policy Review Schedule

We review this Privacy Policy:

• Annually as part of our compliance audit cycle
• Quarterly for processor and technology changes
• Immediately when legal requirements change
• As needed based on user feedback or privacy incidents