Prism Privacy Notice
Last updated: Oct 1, 2026
About this notice
Prism is a multi-model AI companion: you can ask once and compare answers across several AI models, hand-pick the models you prefer, or let Auto choose one for you. Around that core, Prism offers first-party AI agents, answer modes that shape response style, photo attachments, and image and video generation, with conversations and projects to keep your work organized, temporary chats that are not saved, and partner vouchers you can redeem. Prism is built for Philippine consumers, with pricing and payments in Philippine pesos (PHP).
This notice explains how Prism collects, uses, shares, and protects your personal data. Prism is a multi-model AI companion mobile app operated by Multisys Technologies Corporation (“Multisys,” “we,” “us”), registered at #14 Mt. Olives, Multinational Village, Parañaque City, Philippines.
Processing follows the Data Privacy Act of 2012 (Republic Act No. 10173) and its implementing rules. This notice is published at prismai.ph/privacy and applies to Philippine consumers using the Prism mobile app (iOS and Android), the only customer-facing surface of Prism in this release.
It also covers how our admin portal and backend services handle your data, for example when authorized staff assist you or action a request you make. By creating a Prism account, you confirm you have read this notice and our Terms of Service, and you consent to the processing it describes.
Personal data we collect
We collect only the categories below.
| Category | What we collect | Why we hold it |
|---|---|---|
| Identity and contact | Email address, display name, and (only via hosted checkout) mobile number | Create and identify your account; process payments |
| Account and plan | Email verification time, account state/plan, entitlements, last login, timestamps | Manage your plan and feature access |
| Consent | Record of accepting our published Terms and Privacy Notice, and which version | Demonstrate and honor your consent |
| Authentication | A one-time sign-in code (held briefly as a cryptographic hash); if you use Google sign-in, your Google account ID and the email Google provides | Verify your identity at sign-in |
| Session | Hashed session token, IP address, device/browser user agent, last-active time | Keep you signed in securely; detect misuse |
| Chat content | Prompts, messages, and conversation/project history | Provide chat and agent features |
| Files and media | Attached photos/files, file details, AI-generated parse summaries, and image/video generation prompts and outputs | Respond to attachments; generate images or video you request |
| Web search queries | A search query derived from your message, and the results returned | Add live web results, on plans that include this |
| Usage and credits | Chat usage, credit transactions, and balance | Meter usage against your plan and credits |
| Payments | Payment reference, amount, and status, if you use hosted checkout | Process and record your payment (we do not store your card number) |
| Coupon redemptions | The voucher code you redeem, and your IP address at redemption | Apply partner or campaign benefits |
| Communications | Email logs: recipient, subject line, delivery status | Send sign-in codes and account emails; troubleshoot delivery |
| Account lifecycle | A marker that your account is pending deletion | Carry out your deletion request |
| Mobile product analytics | App usage events linked to an internal customer ID, not your name or email | Understand app usage and improve it |
| On-device data | Local app preferences (e.g., notification toggle); media you choose to save to your photo library | Remember your settings; save content you choose to keep |
We do not collect GPS or precise location, contacts, calendar data, SMS messages, an advertising ID, or a device push token, and Prism has no customer password - sign-in is passwordless. Free-text prompts, photos, and files may contain whatever you choose to share; please avoid including sensitive information (health, religion, government IDs) unless necessary.
How and why we use your information
We use your personal data to:
- Create, verify, and keep your Prism account secure.
- Deliver the features you use: multi-model chat, AI agents, attachments, image/video generation, and web search where your plan allows it.
- Apply your plan, entitlements, credits, and any coupons; process hosted payments.
- Send service emails, such as your one-time sign-in code and account notices.
- Operate, secure, and troubleshoot the platform, including through audit and email-delivery logs.
- Respond to your support requests and privacy-rights requests.
- Improve the app using aggregated, pseudonymous mobile analytics.
- Comply with legal obligations, including the Data Privacy Act and payment-related tax and accounting rules.
Our legal bases under the Data Privacy Act are: your consent (for example, accepting this notice at registration, or choosing Google sign-in); performance of our contract with you (providing the app and features you request); compliance with a legal obligation (such as retaining payment records); and our legitimate interests, pursued without overriding your rights (such as platform security, fraud prevention, and audit logging). Where we rely on consent, you may withdraw it at any time (Section 6), though this may limit your ability to use Prism.
Who we share your information with
We do not sell your personal data. We share it only as described below.
Service providers
Depending on which features you use and how our systems are configured, these categories of providers may process personal data for us:
| Provider | What they do | What they may receive |
|---|---|---|
| AI model providers (our Prism AI Gateway and/or OpenRouter) | Generate chat responses; process attachments; create generated images/video | Prompts, conversation history, attachment bytes, generation prompts |
| Firebase Authentication (Google) | Verifies your identity for Google sign-in | Google ID token, provider ID, and the email Google provides |
| Tavily | Performs web searches, on plans that include this feature | A search query derived from your message, and the results |
| Our payment gateway (Aqwire) | Processes hosted payments, when enabled | Display name, email, mobile number, payment reference/amount/status (never your card number) |
| Our email provider | Delivers sign-in codes and account emails | Your email address and message content |
| Our cloud storage provider | Stores photos, files, and generated media | File, image, or video bytes |
| PostHog | Mobile app product analytics | App usage events linked to an internal customer ID only |
Not every provider above is necessarily active at a given time; some are enabled or disabled by our operational configuration. Each is contractually required to protect your data and use it only to provide services to us. Some may process data outside the Philippines; where that happens, we take reasonable steps to require a comparable standard of protection.
Our own staff
Authorized Multisys staff can access customer information through our admin portal, under role-based access control, to provide support and operate the privacy workflows in Section 6. Their access is logged.
Legal and safety
We may disclose personal data where required by law, regulation, a court order, or a lawful government request, or to protect the rights, property, or safety of Multisys, our customers, or the public.
Business transfers
If Multisys undergoes a merger, acquisition, or asset sale, personal data may transfer as part of that transaction, under this notice or one offering comparable protection.
How we store, retain, and delete your information
We store personal data in secured databases and cloud storage used by the Prism platform, including our primary database, our object storage for files and media, and a short-lived cache (for example, your one-time sign-in code is held there as a hash for about five minutes). Your in-app notification preference and media you choose to save stay only on your device.
Deleting your account
You can request deletion any time in the app. Once confirmed, we revoke your active sessions and email you a confirmation. Your account then enters a 30-day grace period, after which an automated job permanently anonymizes your content. We keep your payment records and credit ledger after this purge, for accounting, tax, and dispute-resolution purposes. Authorized staff can also schedule deletion on your behalf, for example at your request to our support team.
Inactive accounts and archiving
If your account has no activity for more than 1 year, we move your data to archive. If your account remains archived for more than 1 year, your data is permanently deleted. One month before that deletion, we email the account owner to notify them which data will be deleted from the archive. If your account is archived, you can request restoration by writing to [email protected] / +639296949028.
Other retention
We run automated cleanups that regularly clear data we no longer need, including expired session tokens, old sign-in attempt records, email delivery logs, soft-deleted files, and data export bundles (kept only for a limited time after we generate them). Otherwise, we retain personal data only as long as reasonably necessary for the purposes in this notice, or as required by law.
Your rights under the Data Privacy Act
As a data subject under the Data Privacy Act of 2012 (Republic Act No. 10173), you have the right to:
- Be informed that your personal data will be, are being, or have been processed, as this notice does.
- Access the personal data we hold about you.
- Object to processing, including for direct marketing, automated decision-making, or profiling, and to withdraw consent you previously gave.
- Correct or rectify inaccurate or outdated personal data.
- Erase or block your personal data where it is incomplete, outdated, unlawfully obtained, or no longer needed for the purpose collected.
- Data portability, to receive a copy of your data in electronic format, where feasible.
- Damages, for harm from inaccurate, unlawfully obtained, or unauthorized use of your data.
- Lodge a complaint with the National Privacy Commission (NPC) if you believe your rights were violated.
Exercising these rights
You can view your plan, usage, and coupons, and delete your account, directly in the app. For access, correction, export, or other requests, contact us using Section 10; our support team logs your request and an authorized staff member actions it through our Privacy and Data Center. Internal notes our staff make about your account are excluded from a data export, as they form part of our own operational records.
You may also contact the National Privacy Commission directly at privacy.gov.ph.
How we protect your information
We apply technical and organizational safeguards appropriate to the personal data we hold, including:
- Separate, authenticated connections for customer and staff (admin) traffic.
- AI provider credentials kept on our servers at all times, never exposed to your device.
- Server-side control over which AI models, agents, and features you can reach.
- Role-based access control for staff, with multi-factor authentication and passkey support for admin accounts.
- One-time sign-in codes and session tokens stored as cryptographic hashes, not plain text.
- Encryption of certain session and email-queue data at rest.
- An audit trail of security- and operations-relevant actions.
- Guardrails applied to our AI agents at the point they run.
No method of transmission or storage is completely secure, but we work to protect your data and improve these safeguards over time. If a breach is likely to pose a real risk of harm to you, we will notify you and, where required, the National Privacy Commission, as the Data Privacy Act requires.
Children’s privacy
Prism is intended for adult users in the Philippines and is not directed at children. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us using Section 10 so we can address it.
Changes to this notice
We may update this notice as Prism’s features change or as the law requires. We publish the current version at prismai.ph/privacy and update the “last updated” date above. A newly published version reflects any material change, and your continued use of Prism after it takes effect confirms your acceptance; where the Data Privacy Act requires fresh consent, we will ask for it.
How to contact us
Multisys Technologies Corporation
#14 Mt. Olives, Multinational Village, Parañaque City, Philippines
For any question about this notice, or to exercise your data privacy rights, contact our Data Protection Officer at [email protected].
This notice takes effect from the date shown at the top of this page.