1. Who is responsible
The controller is Mohamad AL-KHATIB, sole trader trading as MK-Web, 4 Mail des Petits Clos, 28000 Chartres, France (SIRET 931 791 529 00015). For any question about your data, or to exercise your rights, write to contact@prism-draft.com. No data protection officer has been appointed.
For personal data contained in the content that customers put into PrismDraft (for example a name in an article or a source document), the customer is the controller and the Publisher processes it on the customer's behalf, only to provide the service.
2. The data processed
- Account: name, email address, password (stored only as a hash), your Google account identifier if you sign in with Google, preferred language, and two-factor settings if you enable them.
- Sign-in and security: sessions, IP address and browser (user agent) of each session, and an audit trail of significant actions in a workspace, with their date, author, IP address and user agent.
- Workspaces and content: projects, briefs, articles and their versions, comments and reviews, brand voices, knowledge files and URLs you add, generated and uploaded images, and settings.
- Usage and billing: AI operations and the credits they used, credit purchases and balance history, subscription status and invoices. Card details are collected by Stripe and never reach PrismDraft.
- Integrations: credentials of the publishing destinations you connect and webhook secrets, stored encrypted; API keys, stored only as a hash.
- Emails sent to you by the service: address, type of message and its data.
- Waitlist: email address, optional name, language, and the date you joined, collected only if you join the waitlist. If you tick the product news box on the waitlist form, that choice is stored too.
- Product news preference: whether you asked for product news, and when, if you tick the box at sign-up or turn it on in your account.
PrismDraft does not use advertising, analytics or tracking tools, does not sell personal data, and sends product news only to people who asked for it, with a box that is never ticked by default. Apart from that, the only email sent to someone who has not created an account is the waitlist confirmation and one message when PrismDraft opens, plus invitations sent by a workspace member.
3. Purposes and legal bases
- Providing the service you subscribed to (account, workspaces, generation, publishing, service emails such as verification, invitations and billing notices): performance of the contract.
- Billing, invoicing and accounting: performance of the contract and legal obligations.
- Securing the service, preventing fraud and abuse, and keeping an audit trail: legitimate interest in protecting the service and its users.
- Granting the free sign-up credits only once per email address: legitimate interest in preventing abuse of the offer.
- Answering your messages and support requests: legitimate interest, or pre-contractual steps.
- Telling you once when PrismDraft opens to new accounts, if you joined the waitlist: your consent, which you can withdraw at any time with the link in each message.
- Sending you product news, only if you ticked the box at sign-up or turned it on in your account: your consent, which you can withdraw at any time from your account page or, if you only joined the waitlist, with the link in the waitlist emails or by writing to the contact address.
4. Who receives the data
Data is accessible to the Publisher and, within a workspace, to its members according to their roles. It is passed to the following providers, acting as processors, only as far as each needs for its task:
- Hetzner Online GmbH (Germany): hosting of the website, application, database and files.
- Stripe Payments Europe, Ltd. (Ireland): payments, subscriptions and invoices.
- OpenRouter, Inc. (United States) and the AI model providers it routes requests to (such as DeepSeek or OpenAI): generation of outlines, articles, images and embeddings from your instructions and content.
- Google Ireland Limited: sign-in, only if you choose to sign in with Google.
- An email delivery provider (SMTP relay): sending the service's emails.
- When web research is enabled, a web search provider (Tavily): search queries derived from your brief.
When you connect a publishing destination (WordPress, Ghost, Webflow, Shopify) or a webhook, the content you publish is sent to it on your instruction. Data may also be disclosed to authorities where the law requires it.
5. Transfers outside the European Union
Some providers, OpenRouter and the AI model providers in particular, process data outside the European Union, including in the United States. Such transfers rely on the safeguards provided by the GDPR: an adequacy decision such as the EU–US Data Privacy Framework where the provider is certified, or the European Commission's standard contractual clauses. Avoid placing sensitive personal data in the content you submit for generation.
6. How long data is kept
- Account and workspace data: as long as the account and the workspace exist. Deleting your account deletes the workspaces of which you are the only Owner, with their content and files, and removes you from the others.
- Sessions: 7 days, renewed while you use the service.
- Emails sent by the service: 90 days, after which they are deleted from our records.
- A waitlist entry is kept until you remove yourself with the link in the email, or until 90 days after the opening email was sent, whichever comes first. If you already have an account when PrismDraft opens, your entry is deleted 90 days after you joined.
- Audit trail: as long as the workspace it belongs to exists. Entries not tied to a workspace, such as the record of an account deletion, are kept to secure the service and no longer refer to your account.
- A one-way hash of the email address of a deleted account: kept so that the free sign-up credits are not granted to the same address twice. It cannot be turned back into the address.
- Content you wrote in a workspace you shared with other Owners: kept in that workspace, no longer attributed to you.
- Invoices and accounting records: 10 years, as required by article L. 123-22 of the French Commercial Code.
- Backups: the service's data is backed up daily and each backup is kept for 2 days, so data you delete disappears from the backups within 2 days.
7. Cookies and local storage
PrismDraft only uses cookies and browser storage that are strictly necessary for the service or that store a choice you made. They do not require consent, and none is used for analytics or advertising.
- Session cookies (names beginning with better-auth.), set by api.prism-draft.com: keep you signed in and protect sign-in, including two-factor verification. 7 days.
- prism-draft_locale: remembers the language you chose. 1 year.
- prism-draft_theme: remembers a light or dark theme, if you chose one. 1 year.
- Browser local and session storage (keys beginning with prism-draft:): whether you are signed in, your last workspace, your last options for a new article, and unsaved drafts in the editor. They stay on your device.
Stripe sets its own cookies on its payment pages, under its own policy.
8. Security
Traffic is encrypted (HTTPS). Passwords and API keys are stored only as hashes, and the credentials of your publishing destinations are encrypted. Access to the platform administration requires two-factor authentication and is recorded. Images stored in PrismDraft are served from addresses that are not listed but can be opened by anyone holding the exact link, so that published articles can display them.
9. Your rights
You have the right to access your data, to have it corrected or erased, to restrict or object to its processing, and to receive the data you provided in a portable format. You may also give instructions on what happens to your data after your death. Most of your data can be edited in the application, each article can be exported, and your account can be deleted from your account settings.
To exercise these rights, write to contact@prism-draft.com. An answer is given within one month; proof of identity may be requested if there is reasonable doubt. If you consider that your rights are not respected, you may lodge a complaint with the CNIL (Commission nationale de l'informatique et des libertés), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, www.cnil.fr.
10. Changes
This policy may change, in particular when the service or its providers change. The date at the top of the page shows the latest version; substantial changes are announced by email or in the application.