Privacy Policy

1. Introduction

This Privacy and Personal Data Processing Policy explains how PRYZM collects, records, organizes, stores, updates, retrieves, uses, transfers, provides access to, restricts, deletes, destroys, and otherwise processes personal data.

This Policy applies to the PRYZM website, web application, mobile applications, software, communication features, public profiles, content feeds, location-based functions, support systems, and other related products and services collectively referred to as the “Service.”

This Policy is intended both to provide users with information about PRYZM’s privacy practices and to constitute the publicly available policy of the personal data controller concerning the processing of personal data.

This Policy does not itself constitute consent to personal data processing. Where processing requires consent, PRYZM will request that consent separately through an appropriate form, checkbox, application interface, verification procedure, or other legally permitted mechanism.

Separate consent may be requested for:

• processing special categories of personal data;
• processing biometric personal data;
• processing personal data that the user chooses to make available to an unrestricted number of persons;
• optional cookies and analytics technologies;
• marketing communications;
• cross-border transfers, where required;
• other processing activities requiring consent by law.

The Terms of Service, Community Guidelines, Cookie Policy, Recommendation Technologies Notice, and specific consent forms supplement this Policy.

2. Personal Data Controller

The personal data controller and operator of the Service is:

[Full legal name of the Controller]
Status: [individual / individual entrepreneur / legal entity]
Registration or tax number: [insert if applicable]
Address: [full postal address]
Russian Federation
Privacy email: support@pryzm.club

Roskomnadzor personal data operator registry number: [insert registry number].

References in this Policy to “PRYZM,” “we,” “us,” or “our” mean the Controller identified above.

3. Scope of This Policy

This Policy applies to personal data relating to:

• registered PRYZM users;
• persons creating or attempting to create an account;
• visitors to PRYZM websites;
• persons communicating with PRYZM support;
• persons submitting reports, complaints, or appeals;
• persons depicted, mentioned, or otherwise identified in user-generated content;
• representatives of service providers, contractors, community partners, and other persons interacting with PRYZM.

This Policy does not govern independent third-party services that PRYZM does not control. Such services process information according to their own privacy documentation.

4. Key Definitions

Personal data

Any information relating directly or indirectly to an identified or identifiable individual.

Processing

Any action or set of actions performed on personal data, whether by automated means or otherwise, including collection, recording, organization, accumulation, storage, updating, retrieval, use, transfer, provision, access, dissemination, restriction, deletion, and destruction.

Controller

The person that independently or jointly determines the purposes, content, and means of personal data processing.

Processor

A person that processes personal data on behalf of and under the instructions of the Controller.

Special categories of personal data

Personal data concerning race, nationality, political opinions, religious or philosophical beliefs, health, or intimate life, and other categories treated as special under applicable law.

Biometric personal data

Information characterizing physiological or biological features of a person and used by the Controller to establish that person’s identity.

Publicly available profile information

Information that a user chooses to publish or otherwise make visible to other users or an unrestricted number of persons through Service settings.

End-to-End Encryption

A method of protecting communication content so that, where correctly implemented and enabled, the relevant content can ordinarily be decrypted only on participating users’ devices.

5. Processing Principles

PRYZM processes personal data according to the following principles:

• lawfulness and fairness;
• transparency;
• limitation of processing to specific, predetermined, and lawful purposes;
• prevention of processing incompatible with the purposes for which data was collected;
• data minimization;
• accuracy and relevance;
• storage no longer than required by the applicable purposes or law;
• confidentiality and security;
• separation of databases processed for incompatible purposes where required;
• deletion, destruction, or anonymization when the processing purpose has been achieved or no longer applies, unless continued processing is legally permitted or required.

6. Sources of Personal Data

PRYZM may obtain personal data:

• directly from the user;
• automatically when the user accesses or interacts with the Service;
• from another PRYZM user, for example through a message, mention, tag, report, contact invitation, or uploaded content;
• from an authentication provider selected by the user;
• from payment providers where paid functionality is available;
• from security, anti-fraud, hosting, delivery, or technical service providers;
• from publicly available sources where processing is lawful and relevant to a legitimate Service purpose;
• from competent authorities where information is lawfully provided.

7. Categories of Personal Data

7.1. Account and Registration Data

PRYZM may process:

• username and account identifier;
• email address;
• telephone number, where provided or required;
• date of birth or confirmed age range;
• account creation date;
• email or telephone verification status;
• password hash and technical parameters required to verify the password;
• account status and account settings;
• language, time zone, and interface preferences;
• authentication and recovery information.

PRYZM does not store a user’s password in readable form. Passwords managed directly by PRYZM are processed using one-way password hashing mechanisms.

7.2. Profile and Identity Data

Depending on the information voluntarily provided, PRYZM may process:

• display name;
• profile photograph and other profile media;
• biographical description;
• age or date of birth;
• gender and gender identity;
• pronouns;
• sexual orientation;
• relationship status;
• relationship or communication preferences;
• interests and hobbies;
• languages;
• city, region, or approximate location;
• height, body type, appearance information, or other attributes;
• social links or external usernames;
• verification badges and related status information;
• other information that the user chooses to add to the profile.

Some profile information may reveal or relate to special categories of personal data. Such information should be provided only where the user understands the relevant visibility settings and has provided any consent required by law.

7.3. Health and Sexual-Health Information

Where the relevant profile or safety functionality is available and the user voluntarily chooses to use it, PRYZM may process information such as:

• HIV status;
• STI testing information;
• testing dates or reminders;
• sexual-health preferences;
• vaccination or prevention information;
• other health information voluntarily disclosed by the user.

Health and intimate-life information constitutes sensitive or special category data. PRYZM will process it only where a valid legal basis applies and, where required, after obtaining separate written or otherwise legally compliant consent.

Profile health information is generally self-reported unless PRYZM expressly states that a particular item has been independently verified.

7.4. User-Generated Content

PRYZM may process:

• posts;
• stories and temporary publications;
• photographs, videos, audio, and files;
• captions and descriptions;
• comments and replies;
• likes, reactions, saves, follows, and other interactions;
• hashtags, mentions, and tags;
• public and restricted-access albums;
• drafts, where the relevant feature stores them;
• publication date, audience, and visibility settings;
• content-editing and deletion history where retained;
• content reports and moderation status.

7.5. Communications

Depending on the communication feature and its technical design, PRYZM may process:

• message sender and recipient identifiers;
• conversation and message identifiers;
• encrypted message content;
• message attachments;
• message date and time;
• delivery, read, deletion, and synchronization status;
• public cryptographic keys;
• encrypted key material or protocol-related information;
• message-reporting information;
• other metadata required to provide communication functionality.

The extent to which PRYZM can access communication content depends on whether the relevant feature is protected by End-to-End Encryption and on how that feature is implemented.

7.6. Location Data

PRYZM may process:

• city or region selected by the user;
• approximate location derived from an IP address;
• precise or approximate device location where the user grants the relevant operating-system or browser permission;
• distance between users;
• location-update date and time;
• location visibility and privacy settings.

PRYZM should not publicly display a user’s exact device coordinates unless this is necessary for a clearly explained feature and the user has deliberately enabled that disclosure.

A user may normally disable device location access through the device, browser, or application settings. Certain nearby-user or location-dependent functionality may then become unavailable.

7.7. Age, Identity, and Profile Verification Data

Where PRYZM offers or requires age, identity, or profile verification, it may process:

• verification photographs or video;
• liveness-check results;
• estimated age or age-range result;
• identity-document information;
• document validity and verification results;
• verification provider transaction identifiers;
• date, status, and outcome of verification;
• fraud and duplicate-account indicators.

PRYZM will provide a separate verification notice before collecting identity-document or biometric information. That notice must identify the data collected, provider used, processing purpose, storage period, transfer arrangements, and whether the original image or document is retained.

A photograph is not automatically treated as biometric personal data merely because it depicts a person. It may become biometric personal data where PRYZM uses it to establish or verify identity through physiological or biological characteristics.

7.8. Technical and Device Data

PRYZM may automatically process:

• IP address;
• date and time of access;
• browser type and version;
• operating system;
• device type and model;
• application version;
• language and time-zone settings;
• screen and interface characteristics;
• cookie and session identifiers;
• device or installation identifiers;
• push-notification token;
• referring and requested URLs;
• server, application, security, and error logs;
• connection and network information;
• login, logout, and session history;
• security and anti-abuse signals;
• crash and performance information.

7.9. Usage and Recommendation Data

PRYZM may process information about:

• profiles and content viewed;
• searches and filters;
• follows, likes, reactions, comments, saves, and shares;
• content hidden, muted, or marked as irrelevant;
• accounts blocked or restricted;
• content and profile preferences;
• time and frequency of feature usage;
• interaction patterns;
• recommendation impressions and selections;
• other events used to provide, secure, measure, or personalize the Service.

7.10. Safety, Moderation, and Enforcement Data

PRYZM may process:

• reports and complaints;
• reported content and account information;
• supporting screenshots or files;
• statements submitted by users;
• moderator notes and decisions;
• warnings, restrictions, and suspensions;
• appeals and appeal outcomes;
• block and restriction relationships;
• suspected fraud or abuse indicators;
• account-evasion indicators;
• information concerning credible threats, unlawful conduct, or off-platform safety incidents;
• records necessary to protect users, investigate violations, and defend legal claims.

7.11. Support and Correspondence Data

When a person contacts PRYZM, PRYZM may process:

• name, username, and contact details;
• support ticket content;
• email and message correspondence;
• attachments and screenshots;
• technical diagnostic information;
• support agent notes;
• ticket status and resolution history;
• feedback and survey responses.

7.12. Subscription and Payment Data

Where PRYZM offers paid subscriptions, purchases, or other paid functionality, PRYZM may process:

• subscription plan and status;
• transaction identifier;
• purchase date and amount;
• currency;
• billing country or region;
• payment-provider or app-store identifier;
• refund and cancellation information;
• records required for accounting, tax, or dispute purposes.

Full payment-card details should ordinarily be processed directly by an authorized payment provider and should not be stored by PRYZM unless expressly stated in a separate payment notice.

7.13. External Authentication Data

When a user chooses an external authentication provider, such as Google, PRYZM may receive:

• provider account identifier;
• email address;
• display name;
• profile photograph;
• authentication and authorization tokens;
• other information specifically displayed and authorized during the external authentication process.

PRYZM does not receive the password used for the external provider’s account.

8. Purposes and Legal Grounds for Processing

PRYZM processes personal data only where an applicable legal ground exists. The applicable ground depends on the purpose, category of data, and circumstances of processing.

Where consent is the legal ground, the user may withdraw it. Withdrawal does not affect processing lawfully performed before the withdrawal and does not prevent processing based on another legal ground.

9. Special Categories of Personal Data

PRYZM is a social and communication platform whose profiles and content may reveal information relating to sexual orientation, intimate life, health, nationality, beliefs, or other special categories of personal data.

PRYZM will process special categories of personal data only where an exception or other legal ground expressly permitted by applicable law applies.

Where required, PRYZM will obtain separate consent in the legally prescribed form before processing such information.

Users are not required to provide optional special-category information unless it is necessary for a clearly identified feature and a lawful basis applies.

10. Biometric Personal Data

PRYZM does not treat every photograph or video as biometric data. Photographs or videos may constitute biometric personal data where PRYZM processes physiological or biological characteristics for the purpose of establishing or confirming identity.

Before biometric processing begins, PRYZM will provide specific information about:

• the biometric data involved;
• the verification purpose;
• whether processing is performed by PRYZM or another provider;
• where the data is processed;
• whether the original image or video is retained;
• the applicable storage period;
• the consequences of refusing consent;
• the available alternative verification methods, if any.

Separate written or otherwise legally compliant consent will be obtained where required.

11. Public Profiles and Data Made Available to Others

PRYZM allows users to select an audience for certain profile information and user-generated content.

Depending on the selected settings, information may be visible to:

• only the account holder;
• selected users;
• followers or approved followers;
• registered PRYZM users;
• an unrestricted number of persons, including website visitors.

Information made public may be copied, saved, photographed, indexed, republished, or otherwise used by other persons outside PRYZM’s control. Removing information from PRYZM does not guarantee removal of copies previously created by other persons.

Where applicable law requires separate consent for processing personal data made available to an unrestricted number of persons, PRYZM will request such consent separately and allow the user to establish permitted categories, purposes, conditions, and restrictions.

A user’s decision to publish one item does not constitute consent to make all account data public.

PRYZM may restrict public indexing or public visibility where necessary for privacy, safety, legal compliance, or protection against unauthorized data collection.

12. Private Communications and End-to-End Encryption

Where a communication feature is expressly identified as protected by End-to-End Encryption, PRYZM uses cryptographic mechanisms designed so that the protected message content can ordinarily be decrypted only on participating users’ devices.

End-to-End Encryption applies only to the features, content types, and application versions for which PRYZM expressly confirms that it is enabled.

Unless PRYZM expressly states otherwise, End-to-End Encryption does not necessarily protect:

• sender and recipient identifiers;
• message date and time;
• delivery and read status;
• conversation membership;
• device, session, and network information;
• message size and protocol metadata;
• push-notification routing information;
• content voluntarily submitted to PRYZM through a report;
• content saved outside the encrypted conversation;
• screenshots or copies created by a conversation participant;
• information available on a compromised, unlocked, or malicious user device.

When a user reports an encrypted message, the reporting interface may allow that user to voluntarily submit the relevant message content and context to PRYZM for moderation and safety review.

PRYZM must not state that it is technically unable to access any message content unless that statement has been confirmed for the production cryptographic implementation, key-management model, linked devices, backup system, reporting system, and every supported application version.

13. Recommendation Technologies

PRYZM may use information technologies that collect, organize, and analyze information relating to user preferences in order to select or rank content, profiles, accounts, or other information.

Recommendation signals may include:

• profile and content preferences;
• follows and subscriptions;
• likes, reactions, comments, and saves;
• searches and filters;
• content viewed or skipped;
• accounts hidden, blocked, or marked as irrelevant;
• language and approximate location;
• content popularity and recency;
• safety and quality signals.

Recommendation technologies may affect the order, selection, or prominence of content and accounts shown to a user.

Detailed information about the recommendation technologies used by PRYZM, including the types of information collected, the methods of processing, and ways to influence recommendations, is provided in the PRYZM Recommendation Technologies Notice .

PRYZM does not make a decision producing legal consequences for a user or otherwise significantly affecting the user solely through automated processing where such a decision is prohibited without the user’s written consent or another legal basis.

14. Cookies and Similar Technologies

PRYZM may use cookies, local storage, session storage, application identifiers, authentication tokens, push-notification tokens, service workers, security identifiers, and similar technologies.

These technologies may be used to:

• maintain sessions;
• authenticate users;
• protect forms and accounts;
• remember preferences;
• prevent fraud and abuse;
• measure performance;
• provide optional analytics or personalization.

Information about the technologies actually used, their purposes, providers, and retention periods is available in the PRYZM Cookie Policy.

Optional cookies will be activated only on an appropriate legal basis and after consent where consent is required.

15. Processing Operations and Methods

PRYZM may perform the following operations:

• collection;
• recording;
• organization;
• accumulation;
• storage;
• verification;
• updating and modification;
• retrieval;
• use;
• comparison and matching;
• analysis;
• personalization;
• transfer and provision;
• granting access;
• dissemination where separately authorized;
• anonymization;
• restriction;
• deletion;
• destruction.

Processing may be automated, non-automated, or mixed, including through information systems and network transmission.

16. Recipients and Processing by Other Persons

PRYZM does not sell personal data.

Personal data may be provided or made accessible only where a lawful basis exists and only to the extent necessary for the relevant purpose.

Potential recipients may include:

• authorized PRYZM personnel;
• hosting and data-center providers;
• cloud infrastructure providers;
• email and notification delivery providers;
• external authentication providers;
• payment providers and application stores;
• security, anti-fraud, and anti-abuse providers;
• technical-support and ticketing providers;
• identity, age, or liveness-verification providers;
• error-monitoring and performance providers;
• analytics providers where enabled and lawfully configured;
• professional legal, accounting, or security advisers;
• competent courts, authorities, regulators, and law-enforcement bodies where disclosure is required or permitted by law;
• another party involved in a lawful restructuring, transfer, or succession of the Service, subject to appropriate safeguards.

PRYZM will maintain an up-to-date register of processors and recipients. Material external providers should be identified in this Policy or in an accessible provider list:

Entries that do not correspond to the actual production infrastructure must be removed before publication.

17. Data Localization

When collecting personal data of citizens of the Russian Federation, including through the Internet, PRYZM records, organizes, accumulates, stores, updates, modifies, and retrieves such personal data using databases located within the Russian Federation, except where an applicable statutory exception permits otherwise.

The location of the primary database does not necessarily mean that no lawful remote access, backup, processing, or cross-border transfer occurs. Every such operation must have an appropriate legal basis and comply with the requirements described in this Policy.

18. Cross-Border Transfers

Some external providers or technical integrations may involve processing or access outside the Russian Federation.

Before beginning a cross-border transfer, PRYZM will take the measures required by applicable law, which may include:

• identifying the recipient and destination state;
• evaluating the legal and security protections available in the destination state;
• obtaining information from the foreign recipient concerning its safeguards;
• determining an appropriate legal ground for the transfer;
• obtaining written or other required consent where applicable;
• submitting a notification to Roskomnadzor;
• observing any waiting period, prohibition, restriction, or regulatory decision;
• implementing contractual, organizational, and technical safeguards.

PRYZM must not state that it performs no cross-border transfers while an authentication provider, push provider, email provider, analytics provider, content-delivery service, error-monitoring service, or other foreign infrastructure receives personal data or remotely accesses it.

19. Storage and Retention

Personal data is retained no longer than required by the processing purpose, user agreement, applicable consent, or law.

PRYZM will maintain an internal retention schedule corresponding to its actual database, backup, logging, moderation, support, and infrastructure configurations.

The values in square brackets are implementation fields and must be replaced with periods corresponding to the production system before this Policy is published.

20. Account Deletion and Destruction of Data

A user may request account deletion through the account settings or the contact method specified in this Policy.

Following a valid deletion request, PRYZM will:

• restrict access to the account;
• remove or anonymize public profile information and content according to the applicable deletion process;
• delete personal data from active systems within the applicable operational period;
• allow backup copies to expire according to the backup-rotation schedule;
• retain only information that PRYZM is legally required or permitted to retain.

Certain information may continue to be processed where necessary to:

• comply with law;
• complete an active transaction;
• resolve a dispute;
• protect users or other persons;
• investigate fraud, abuse, or serious rule violations;
• prevent evasion of a lawful restriction or permanent ban;
• establish, exercise, or defend legal claims;
• maintain evidence of consent, withdrawal, deletion, or other compliance actions.

Content previously shared with another person may remain on that person’s device or account where PRYZM does not control the copy.

Destruction of personal data is documented in accordance with applicable requirements.

21. Security Measures

PRYZM implements legal, organizational, and technical measures designed to protect personal data against unauthorized or accidental access, modification, disclosure, provision, dissemination, copying, restriction, deletion, destruction, and other unlawful processing.

Measures may include:

• appointment of a person responsible for personal data processing;
• internal personal data and information-security policies;
• access control and separation of privileges;
• authentication and session management;
• password hashing;
• encrypted network transmission;
• cryptographic protection where appropriate;
• End-to-End Encryption for expressly identified communications;
• logging and security monitoring;
• rate limiting and anti-abuse controls;
• vulnerability management and software updates;
• backup and recovery procedures;
• incident response procedures;
• processor due diligence and contractual safeguards;
• employee and contractor confidentiality obligations;
• periodic review of security controls.

No method of storage or transmission can provide an absolute guarantee of security. Users should use a unique password, protect their devices, enable available security functionality, and report suspected account compromise promptly.

22. Personal Data Incidents

PRYZM maintains procedures for detecting, assessing, containing, investigating, documenting, and remediating personal data incidents.

Where PRYZM establishes that an unlawful or accidental transfer, provision, dissemination, or access has violated personal data subjects’ rights, PRYZM will notify Roskomnadzor within the periods required by law, including:

• an initial incident notification within 24 hours after the incident is identified;
• information about the results of the internal investigation within 72 hours.

PRYZM may also notify affected users or other persons where required by law or reasonably necessary to reduce a material risk of harm.

23. Rights of Personal Data Subjects

Subject to applicable law, a personal data subject may:

• obtain confirmation of whether PRYZM processes their personal data;
• obtain information about the purposes, legal grounds, methods, categories, sources, recipients, and retention periods of processing;
• request access to their personal data;
• request correction or updating of inaccurate or incomplete data;
• request restriction of processing where data is inaccurate, unlawfully processed, or no longer required;
• request deletion or destruction where a processing purpose has been achieved or another legal ground applies;
• withdraw consent;
• establish restrictions concerning data made available to an unrestricted number of persons;
• request cessation of processing for direct marketing purposes;
• obtain information concerning solely automated decisions where applicable;
• appeal PRYZM’s actions or omissions to Roskomnadzor or a competent court;
• exercise other rights provided by applicable law.

These rights may be subject to lawful restrictions. For example, PRYZM may retain certain information where required by law, necessary to protect other persons, or required for a legal claim.

24. How to Submit a Privacy Request

A privacy request may be submitted:

• through the relevant account settings;
• through the PRYZM Help Center;
• by email to support@pryzm.club;
• by post to the Controller’s address stated in this Policy.

The request should contain information sufficient to:

• identify the requester;
• locate the relevant account or data;
• understand the requested action;
• verify that the requester is the personal data subject or an authorized representative.

PRYZM may request reasonable identity verification before providing access to personal data or performing an irreversible action.

Verification information will be limited to what is reasonably necessary for the request and will not be used for unrelated purposes.

PRYZM will respond within the period required by applicable law.

25. Adults Only

PRYZM is intended exclusively for persons who are at least 18 years old, or any higher age required by applicable law.

Persons below the required age must not use the Service.

PRYZM does not knowingly create accounts for minors or intentionally process their personal data for ordinary Service purposes.

Where PRYZM has reasonable grounds to believe that an account belongs to a minor, PRYZM may:

• restrict the account;
• request age or identity verification;
• delete the account and associated information;
• retain limited evidence where necessary to prevent repeated access, investigate exploitation, or comply with law;
• report suspected child exploitation to competent authorities where required or permitted.

26. Third-Party Links and Services

PRYZM may contain links to external websites, profiles, payment services, authentication providers, embedded content, or other independent services.

PRYZM is not responsible for the independent privacy practices of a service it does not control.

Users should review the privacy and security information provided by the relevant third party before providing information to it.

27. Information About Other Persons

Users must not upload, disclose, or distribute another person’s personal data unless they have a lawful basis and any required permission.

This includes:

• photographs and videos;
• private messages;
• contact details;
• location information;
• health information;
• sexual orientation or gender identity;
• identity documents;
• intimate content;
• other confidential or sensitive information.

A person’s permission to create an image or message does not automatically constitute permission to publish it through PRYZM.

28. Changes to This Policy

PRYZM may update this Policy to reflect changes in:

• the Service or its functionality;
• the categories or purposes of processing;
• service providers and processing locations;
• security practices;
• applicable law or regulatory guidance.

The current version will be published through the Service with the updated effective date.

Where a change requires new consent, PRYZM will request that consent separately. Continued use of the Service will not replace consent where consent is legally required.

29. Contact Information

Questions, complaints, and requests concerning this Policy or personal data processing may be directed to:

[Full legal name of the Controller]
Address: [full postal address]
Russian Federation
Privacy email: support@pryzm.club
Support: PRYZM Help Center

A personal data subject may also submit a complaint to Roskomnadzor or protect their rights through a competent court in accordance with applicable law.