At Prisma AI, protecting your personal data is a priority. This policy explains how we collect, use, and safeguard your data in accordance with the General Data Protection Regulation (GDPR) and applicable data protection law.
1. Data Controller
The personal data you provide is processed by the individual operator of the Prisma AI platform ("Data Controller").
Contact: You may submit GDPR-related requests via the Contact Form.
2. Data We Collect
- Identity data: First name, last name, email address
- CV data: Professional information and work experience contained in uploaded résumé files
- Interview data: Audio recordings, interview transcripts, AI evaluation reports and scores
- Company data (HR users): Company name, tax ID, billing address (optional)
- Technical data: IP address, browser information, device type
- Payment data: Transaction amount, payment method type (card details are never stored on Prisma AI servers)
3. Purposes and Legal Bases for Processing
Your data is processed for the following purposes under the legal bases set out in Article 6 GDPR:
- Contract performance: Account creation, sending interview invitations, conducting AI interviews, delivering reports, processing payments
- Legitimate interests: Platform security, service quality improvement, technical troubleshooting
- Legal obligation: Retention of payment records as required by applicable tax law
- Consent: Recording interview audio (you are notified before each session begins)
4. Interview Recordings and Artificial Intelligence
- Audio recording: Interview sessions are recorded with prior notice to the candidate. Recordings are used solely for evaluation and dispute resolution.
- Transcript: Conversations are transcribed in real time and included in the interview report.
- AI evaluation: Audio and transcript data are processed to generate AI-powered scoring and feedback reports.
- Retention periods: Audio recordings are retained for 90 days; transcripts and AI reports for 1 year. Data is automatically deleted after the retention period.
- Access: Only the relevant company's authorised HR users and platform administrators can access recordings.
- AI training: User data is never used to train AI models. Our agreements with service providers include this guarantee.
5. Third-Party Processors and International Transfers
Payment processing:
- Creem — Web payment processor (Merchant of Record). Data processed: email address, payment details, IP address, billing information.
AI services:
- OpenAI, L.L.C. (USA) — AI voice assistant for interviews and CV analysis. Data processed: audio and text content.
- Anthropic PBC (USA) — Interview report and evaluation text generation. Data processed: transcript and context data.
Real-time communication:
- LiveKit (open source, self-hosted) — Real-time voice interview infrastructure and audio recording. Audio data is not sent to third-party cloud services; it is processed on our own server hosted by Contabo GmbH (Germany).
Storage:
- Backblaze Inc. (USA) — Encrypted storage of CV files, profile images, and interview audio recordings. Audio recordings are automatically deleted after 90 days.
Server infrastructure:
- Contabo GmbH (Germany) — Hosting for the application server and LiveKit infrastructure.
Where personal data is transferred outside the European Economic Area, such transfers are subject to appropriate safeguards under Chapter V GDPR (e.g. Standard Contractual Clauses).
6. Payment Card Security
Credit card details are never stored on Prisma AI systems. All card data is processed directly within Creem's PCI-DSS-compliant infrastructure.
7. Security Measures
Your data is protected by SSL/TLS encryption, firewalls, and access controls. Audio recordings and files are stored in encrypted storage. Your data is not shared with third parties for marketing purposes without your explicit consent.
8. Retention Periods
- Account information: For the duration of the account + 1 year after deletion
- Payment transaction records: 10 years (as required by applicable accounting and tax law)
- CV and résumé files: For the duration of the account
- Interview audio recordings: 90 days
- Transcripts and AI reports: 1 year
- Technical logs: 90 days
9. Your Rights (GDPR Article 15–22)
Under the GDPR you have the right to:
- Access your personal data
- Rectify inaccurate or incomplete data
- Request erasure ("right to be forgotten")
- Restrict or object to processing
- Data portability
- Withdraw consent at any time (without affecting prior processing)
- Lodge a complaint with your supervisory authority
Requests can be submitted via the Contact Form and will be responded to within 30 days.