This policy explains what personal data PrysM Tools collects, why, on what legal basis, how long we keep it, who else touches it, and what you can do about it. It is written to the General Data Protection Regulation (EU) 2016/679 and the French Data Protection Act.
We have two different roles
Which role we are in decides who is answerable for what, so it is worth being precise about it.
Controller | for your account
When we handle your own details to run your account, take payment, secure the Service and answer your emails, we decide why and how, so we are the controller.
Processor | for what you send the API
When you transmit a payload containing your clients’ names, addresses and amounts so we can render a document, you decide why and how. You are the controller; we are your processor and act only on your instructions. The terms of that relationship are in the Data Processing Agreement.
Who to contact
The controller for this site is the publisher identified in the legal notice. Privacy requests go to privacy@prysm.tools.
Data protection officer
Under Article 37 GDPR, no data protection officer is required for this processing. Data protection questions are handled directly at legal@prysm.tools.
What we collect about you
| Category | What it contains | Where it comes from |
|---|---|---|
| Account | Email address, display name, hashed password or federated identifier, interface language, plan. | You, at sign-up and in settings. |
| Billing | Plan history, subscription status, amounts, invoice records, the last four digits and brand of a card. | You and our payment processor. We never receive or store a full card number. |
| Technical | IP address, user agent, timestamps, API request metadata, rate-limit and quota counters, error logs. | Automatically, when you use the Service. |
| Content | Documents you save to PrysM Cloud, their folder structure and their editor state. | You, when you choose to save. |
| Support | The emails you send us and our replies. | You, when you write to us. |
Why we process it, and on what basis
Every processing operation needs a legal basis under Article 6 GDPR. Ours are:
| Purpose | Legal basis |
|---|---|
| Creating and running your account; rendering and storing the documents you ask for; providing support. | Performance of the contract (Art. 6(1)(b)). |
| Taking payment, managing subscriptions, keeping billing records. | Contract, and legal obligation for accounting retention (Art. 6(1)(b) and (c)). |
| Rate limiting, quota accounting, abuse and fraud prevention, keeping the Service secure. | Legitimate interests in protecting the Service and its users (Art. 6(1)(f)). |
| Diagnosing errors and improving reliability using aggregated, non-identifying measurements. | Legitimate interests (Art. 6(1)(f)). |
| Analytics and audience-measurement cookies that are not strictly necessary. | Your consent (Art. 6(1)(a)), which you can withdraw at any time, see the Cookie Policy. |
| Responding to a lawful request from an authority; enforcing our terms; establishing or defending a legal claim. | Legal obligation and legitimate interests (Art. 6(1)(c) and (f)). |
Where we rely on legitimate interests, we have weighed them against your rights and freedoms, and you may object at any time, see your rights.
Payment fraud prevention
Card payments attract stolen cards, so every payment attempt is scored by a risk engine before and after the card is entered. It uses only: your account’s age and payment history on PrysM (successful and declined payments, refunds, disputes); how many attempts and cards were used over short periods; a keyed hash (HMAC) of your IP address, never the address itself, which is pseudonymous rather than anonymous, and is therefore erased after 72 hours; the country and time zone your hosting provider associates with the address, and your device’s own time zone; whether the address belongs to a Tor exit, a known VPN or a datacenter, checked against public lists held on our servers (the address is never sent to anyone to be looked up); and what our payment processor Stripe reports about the card, an opaque card fingerprint, brand, country, funding type, last four digits, the results of the security-code, address and 3-D Secure checks, and Stripe’s own risk rating. We never receive or store a card number, a security code or any bank credential. A change of billing name is noticed through a keyed hash; names are not stored for this purpose.
On the payment form we also note how the form was filled, not what was typed: whether the receipt email was typed, pasted or filled in by the browser, whether a mouse or finger moved on the page, how many keys were pressed (a count only), and how long filling took. The card fields belong to Stripe and are never observed. Using a VPN, autofill or a password manager is ordinary and is not held against you; these signals weigh very little and never decide on their own.
Depending on the score, a payment goes through normally, asks your bank for 3-D Secure authentication, asks you to pass a short human check (Cloudflare Turnstile), or is paused for a limited time. Passing the human check lets you continue; it does not lower the score. No single signal, a new account, a second card, another billing name, a VPN, refuses a payment on its own, and neither does a high score: only a flood of attempts (a 15-minute pause on the account) or an unmistakable card-testing pattern does. A pause can be contested at support@prysm.tools and is reviewed by a person. Legal basis: our legitimate interest in preventing payment fraud (Art. 6(1)(f)), which also protects the cardholders whose cards are stolen.
Payloads and generated documents
When you call the API or use the editor, you transmit raw data that we turn into a PDF. That data frequently contains personal data about third parties: your client’s name, their address, a tenant, an amount owed.
- Strict purpose. We process a payload to render the requested document and, if you asked for it, to store the result for your retrieval. Nothing else.
- Transient by default. If you do not ask us to store the document, the payload and the rendered file are held only for the duration of the request and are not written to durable storage. Only request metadata, never payload content, is retained in logs.
- You inform the data subjects. Those people did not give their data to us; they gave it to you. Informing them under Articles 13 and 14 GDPR is your obligation as controller, not ours.
- Keep out what does not belong. Do not send special categories of data, card numbers or identity document numbers. The Service is not designed to protect them at the level those categories require.
We do not train anything on your data
No model training, no profiling, no resale
We do not read, mine, sell, rent or share your payloads or your generated documents. We do not use them, or your account data, to train, fine-tune or evaluate machine learning or artificial intelligence models, our own or anyone else’s. We do not use them for advertising, and we do not build profiles from them.
Gmail, Outlook and the accounts you connect
Two optional apps connect PrysM Tools to a mailbox you hold elsewhere, so the documents you issue leave from your own address: Gmail (Google) and Outlook (Microsoft). This section says exactly what we receive when you connect one, what we do with it, and what we never do.
What the Gmail app asks Google for
Three permissions, nothing more: openid and email, to know which address you connected, and https://www.googleapis.com/auth/gmail.send, to send email from that address. We do not ask for any permission that reads, lists, searches, labels or deletes your emails, and none for your contacts, calendar or files, so we cannot read your mailbox.
What we do with it
We send the documents you issue, an invoice, a credit note, a quote, to the customer address written on that document, with the subject and message you set, when you press Send or when you turn on automatic sending. Nothing else is ever sent from your address.
What we keep
The address you connected; the access and refresh tokens Google gives, encrypted with AES-256-GCM before they reach our database; and, for each document sent, its number, the recipient’s address, the date and the outcome, so a document is never sent twice and you can see what left. A message that could not leave keeps its content and attachments in that record so you can resend it; they are erased as soon as it is sent. See also the Google API disclosure.
What we never do
We do not read your mailbox. We do not use Google user data, or any data received through Google APIs, for advertising, to build profiles, to train, fine-tune or improve artificial intelligence or machine learning models, or to generate images or any other content with artificial intelligence. We do not sell it and do not transfer it to anyone, except to Google itself to send the email you asked for, or where the law requires. Nobody at PrysM reads it, unless you ask us to for support, for security reasons, or where the law requires.
Google API Services User Data Policy
PrysM Tools’ use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Disconnecting
Disconnect the mailbox, or remove the Gmail app, and we revoke the refresh token at Google and delete both tokens at once. You can also withdraw the access at any time from your Google Account (Security → Third-party apps with account access). The sending record stays with the workspace’s documents until they are deleted.
Outlook
The Outlook app works the same way with Microsoft: it asks only for Mail.Send, User.Read (the address) and offline_access, and every commitment above applies to it.
How long we keep it
| Data | Retention |
|---|---|
| Account data | For as long as the account exists, then deleted within 30 days of account deletion. |
| Documents in PrysM Cloud | Until you delete them, or until the plan ceiling or the post-subscription window purges them. Trashed documents are purged after 24 hours; data after a subscription ends is destroyed after 30 days, and the account owner is emailed a week before. |
| Editor drafts not saved to the cloud | Held in your own browser. Never sent to us unless you export or save. |
| Billing and accounting records | Ten years from the end of the financial year, as required by the French Commercial Code. This survives account deletion. |
| API request metadata, rate-limit and quota counters | Up to 12 months, then deleted or aggregated beyond identification. |
| Connection logs (IP address, timestamp) | Up to 12 months, as required for security and by French law on the retention of connection data. |
| Idempotency records | 24 hours from the request, then purged. |
| Single-document unlocks (after a €0.99 payment) | Usable for 24 hours; the secret that authorises them is destroyed a day later. The record of the purchase is kept 13 months, like the rest of the payment trail. |
| Payment risk assessments and their events | 13 months, then deleted. The keyed hash of the IP address is erased after 72 hours. Disputes and the invoices themselves follow the billing retention above. |
| Support correspondence | Three years from the last exchange. |
| Backups | Encrypted, rotated, and overwritten within 30 days. A deletion is applied to live systems immediately and reaches backups as they cycle. |
Transfers outside the EEA
Some of our providers are established in the United States and data is processed there. Those transfers rely on the European Commission’s Standard Contractual Clauses, supplemented, where the provider is certified, by the EU–US Data Privacy Framework, along with technical measures including encryption in transit and at rest.
You may request a copy of the transfer safeguards applicable to your data by writing to privacy@prysm.tools.
How we protect it
- Encryption in transit. HTTPS/TLS is enforced everywhere; the site is served over HTTPS only.
- Row-level security. Every table holding customer data is protected by database-level access rules, so one account cannot read another’s rows even if an application bug tried to.
- API keys are never stored. We keep only a SHA-256 digest. A lost key cannot be recovered by us or by anyone who obtains our database, it can only be revoked and replaced.
- Signed, expiring links. Stored documents are served through time-limited signed URLs rather than public paths.
- Least privilege. Administrative credentials are held server-side only and are never exposed to the browser.
- Rendering isolation. The renderer refuses requests to private, loopback and link-local addresses, and only loads images from our own origin or from allow-listed HTTPS sources.
No system is perfectly secure, and we do not claim otherwise. Report anything you find to security@prysm.tools.
If there is a breach
Where a personal data breach is likely to result in a risk to your rights and freedoms, we notify the CNIL within 72 hours of becoming aware of it. Where the risk is high, we also notify you directly and without undue delay, describing what happened, what data was affected, what we have done and what you can do.
For breaches affecting payloads you sent us as a controller, we notify you rather than the authority, so that you can meet your own obligation, see the DPA.
Your rights
If you are in the European Economic Area, you have the following rights over your personal data. They are free to exercise, and we answer within one month.
- Access , obtain confirmation that we process your data and a copy of it.
- Rectification , have inaccurate data corrected or incomplete data completed.
- Erasure , have your data deleted. You can delete your account and its data yourself from your dashboard. Records we must keep by law, such as accounting entries, survive.
- Restriction , have processing frozen while a dispute about accuracy or lawfulness is resolved.
- Portability , receive the data you provided in a structured, machine-readable format, or have it sent to another provider where technically feasible.
- Objection , object at any time to processing based on our legitimate interests, on grounds relating to your situation.
- Withdraw consent , where processing rests on consent, withdraw it at any time, without affecting what was lawful before.
- Post-mortem instructions , set directives on what becomes of your data after your death, under Article 85 of the French Data Protection Act.
- Complain , lodge a complaint with a supervisory authority. In France that is the CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, cnil.fr. You may also complain to the authority where you live or work.
Write to privacy@prysm.tools. We may ask for information to confirm it is really you, and we will not use that information for anything else.
If your request concerns data inside a document generated by one of our customers, we are the processor and cannot act on it directly. Tell us and we will point you to the customer responsible, or forward it to them.
Children
The Service is intended for businesses and adults. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with data, write to privacy@prysm.tools and we will delete it.
Automated decision-making
We do not make decisions producing legal or similarly significant effects about you by automated means alone, and we do not profile you. Automated rules do enforce rate limits, quotas, abuse detection and payment fraud prevention (a payment may be asked for 3-D Secure or a human check, or paused for a limited time); a measure taken against your account on that basis can be contested and is reviewed by a person, see contesting a decision.
If you are in the United States
For residents of California and other states with comparable laws: the categories of personal information we collect, the purposes, and the categories of recipients are described above. We do not sell personal information and do not share it for cross-context behavioural advertising, as those terms are defined in the California Consumer Privacy Act. We do not use sensitive personal information for purposes requiring a right to limit.
You have the right to know, to delete, to correct, and not to be discriminated against for exercising those rights. Use the same address: privacy@prysm.tools. We honour Global Privacy Control signals as an opt-out where applicable.
Changes to this policy
We may update this policy. Material changes are announced by email to the address on your account and by updating the date at the top of this page, at least 30 days before they take effect where the change concerns processing you can object to. Where a change requires your consent, we will ask for it rather than assume it.
A question about any of this?
Write to legal@prysm.tools and a person will answer.
Published in English. Any translation is provided for convenience only; where they differ, the English text prevails, except where mandatory local consumer law provides otherwise.