Privacy Policy

• Account data: name, email address, profile image, authentication identifiers, and workspace membership.
• Customer content: feature requests, votes, comments, reactions, attachments, roadmaps, changelogs, tags, and internal notes.
• Billing data: plan, subscription status, invoices, tax location, and payment-provider identifiers. Complete card numbers are handled by Stripe.
• Technical data: IP address, browser and device information, request timing, security events, session data, and service diagnostics.
• Communication data: support messages, notification choices, email delivery status, and integration configuration.
• Optional connected data: identifiers and content received from tools you deliberately connect, such as Slack or GitHub.

Public posts, comments, roadmap entries, and changelogs are visible to visitors by design. Avoid putting confidential or sensitive personal data in a public field.

• provide accounts, feedback workflows, public portals, widgets, APIs, notifications, and integrations;
• process subscriptions, prevent fraud, and maintain billing records;
• secure, monitor, diagnose, and improve the service;
• answer support, legal, privacy, refund, and cancellation requests;
• send service messages and requested product-update notifications;
• comply with tax, accounting, legal, and regulatory obligations.

Depending on the context and applicable law, these activities rely on performing a contract, legitimate interests in operating and securing the service, consent, or compliance with a legal obligation. You may withdraw consent where consent is the basis, without affecting earlier lawful processing.

An authorized workspace member may choose to send selected feedback or release context to OpenAI to draft a changelog. PrioSmith does not send workspace content to the AI provider merely because it is stored in the service. The draft is a suggestion and must be reviewed before publication.

Do not include secrets, special-category personal data, or information that you are not authorized to send to an AI provider. PrioSmith does not use customer content to train a PrioSmith model.

We disclose personal data only as needed for the service or as required by law. Current provider categories include:

• Supabase for hosted database, authentication, and storage;
• Vercel for application hosting, delivery, and operational logs;
• Stripe for Checkout, subscriptions, invoices, taxes, fraud controls, and payments;
• Resend for transactional email and delivery events;
• OpenAI only for user-requested AI drafting;
• Slack and GitHub when a workspace deliberately enables the relevant integration.

We may also disclose information to professional advisers, authorities, or a successor in a business transaction when legally permitted and subject to appropriate confidentiality. We do not sell personal data or share it for cross-context behavioral advertising.

PrioSmith uses browser storage and cookies that are necessary for sign-in, security, preferences, and core service behavior. The public demo may store local acknowledgements and theme choices. PrioSmith does not currently use advertising cookies. If optional analytics or non-essential cookies are introduced, this policy and any required consent controls will be updated before they are enabled.

Account and workspace data is retained while the account is active and for the period reasonably needed to provide the service. A confirmed account-deletion request has a 30-day grace period so the owner can reverse an accidental request. After that period, active service data is scheduled for deletion, subject to legal and technical limits.

Billing and tax records may be kept for the period required by law. Security logs, delivery suppression records, and dispute evidence may be retained for a limited period necessary to prevent abuse or establish legal claims. Public content remains until the controlling workspace removes it or the associated account or workspace is deleted.

PrioSmith uses access controls, tenant isolation, encryption in transit, protected provider credentials, signed callbacks, and operational safeguards designed to protect personal data. No online system can guarantee absolute security, so report a suspected incident promptly to the support address.

Providers may process data outside your country. Where the law requires it, the operator uses an approved transfer mechanism or relies on another lawful basis for the transfer. Provider locations and safeguards may change as the service evolves.

Depending on your location, you may have rights to access, correct, delete, restrict, object to, or obtain a copy of personal data, and to complain to a data protection authority. You can change some profile and notification data in the service. For another request, email support@priosmith.com.

We may need to verify identity and authority before acting. If PrioSmith processes your data only for a customer, the request may be referred to that customer. We will respond within the period required by applicable law.

PrioSmith is a business service and is not directed to children. Do not create an account or submit a child's personal data unless a lawful customer use case, appropriate notice, and any required parental authorization are in place.

This policy may be updated when data practices, providers, the service, or legal obligations change. The new effective date will appear here, and material changes will be communicated through the website, service, or account email when required.