PRISM Privacy Policy

1.Introduction

Welcome to PRISM. This Privacy Policy explains how we collect, use, and protect your personal data when you use the PRISM web application (prism-careers.com) and related services. We are committed to complying with the EU General Data Protection Regulation (GDPR), Egypt's PDPL (Law 151/2020), KSA's PDPL, and UAE's PDPL.

2.Controller Identity

The data controller is PRISM. For privacy-related inquiries or to reach our Data Protection Officer, please contact: privacy@prism-careers.com.

3.Data We Collect

• Account Data: Email address, name, and country of residence. If you sign in with Google we receive your email address and name from Google; we never see or store your password. If you register with an email address, your password is stored only by Firebase Authentication in hashed form and is never visible to us.
• Assessment Data: Your answers to every module, how long each answer took, the trial-level records from the interactive games, and completion timestamps.
• Derived Data: Your 29 dimension scores, your RIASEC code, your career matches, and the narrative text generated to explain them.
• Sharing Data: Which organisation invited you, what you agreed they may receive, and a record of every report link you create — including who it was sent to and when it was opened.
• Technical Data: Session and error logs, and — only if you accept analytics cookies — usage analytics.
• We do not ask for or collect special-category data such as race, religion, health, political opinion, or biometrics.

4.Lawful Basis for Processing

• Contract Performance: To run the assessment, produce your report, and give the organisation that paid for your place the specific information you agreed to at the start.
• Consent: For analytics cookies, for marketing email, and for each report link you choose to create. You give the invitation consent explicitly, on screen, before the assessment begins.
• Legitimate Interest: For platform security, abuse and fraud prevention, and improving the service.
• Legal Obligation: For statutory tax and regulatory records.

5.What the Organisation That Invited You Receives

• Most students reach PRISM through an invitation from an employer or a university that has paid for their place. What that organisation receives depends on which kind it is, and you are told exactly which before you agree. This is the main way your data reaches a third party — it does not require you to send anything.
• An employer receives: your name and the email address they invited, whether you finished, your scores across the 29 dimensions, and your career directions with the reasoning behind them. This is delivered automatically when you complete the assessment — you do not have to send it, and it is what you agree to on the consent screen before you begin.
• A university receives: your name and the email address they invited, and whether you finished. It also receives cohort-level figures — averages across a group, never an individual — and only once at least ten students in that group have completed. A university never receives your individual report.
• An organisation with no type set receives: your name, the email address they invited, and whether you finished. Nothing else. This is what an invitation from PRISM itself carries.
• No organisation ever receives your individual answers. Not one of them, at any tier — only the scores they add up to.

6.Links You Create

• Separately from any invitation, you can create a link to share your report with a specific person. A link is readable only by the email address you name, and only once that person has verified it — forwarding the URL does not grant access. You can revoke a link at any time, after which it stops working for the recipient.
• You can also create a Mirror challenge — a public link that lets a friend guess how you scored. It carries your first name, your archetype, and up to six trait bands (low / mid / high). It carries no email address, no numeric scores, and no answers. Anyone holding the link can open it until you revoke it.

7.Sub-processors

• We do not sell your data. We use the following processors, each under a data-processing agreement:
• Google Firebase / Google Cloud — authentication, database, and hosting. Your data is stored in the EU (`eur3` multi-region) and our server functions run in `europe-west1`.
• Anthropic — generates the narrative text in your report and your Decision Kits. It receives your scores and the career being described; it does not receive your name, your email address, or your individual answers.
• Resend — delivers transactional email such as invitations and completion notices. It receives your email address and the content of that message.
• Google Analytics — usage analytics, loaded only if you accept analytics cookies. Decline and it is never loaded, and you are never counted.

8.Scoring and Automated Decisions

Your scores are produced by fixed, deterministic psychometric algorithms — the same input always produces the same result — not by an AI model. Large language models are used only to write the explanatory text around those scores. PRISM does not make automated decisions that produce legal or similarly significant effects about you: it does not hire, reject, admit, or rank you. Any decision an employer or university makes remains theirs.

9.International Transfers

Your account, answers, and report are stored in the EU. Where data flows to the United States — narrative generation and email delivery — it is protected by Standard Contractual Clauses.

10.Data Retention

• We keep active account data for as long as your account exists, so you can retake the assessment and compare over time.
• When you delete your account, we permanently delete your answers, your scores and report, your saved careers, your preferences, your sharing records, your consent record, and the copy of your report held by the organisation that invited you. This happens immediately, not on a schedule.
• Our database keeps a rolling seven-day point-in-time recovery window for disaster recovery. Deleted data can persist within that window and is then gone.

11.Your Rights

• You have the right to access your data, correct it, erase it, restrict processing, object to processing, and withdraw consent.
• Two of these you can exercise yourself, immediately, from Your account: Export your data returns everything we hold about you — including your report, your saved careers, your consent record, and the copy held by the organisation that invited you. Delete your account does what the section above describes.
• For anything else, or if you cannot sign in, contact privacy@prism-careers.com and we will respond within 30 days.

12.Security

Data is encrypted in transit and at rest. Access is enforced by database rules that deny everything by default, so a signed-in user reaches their own data and nothing else. Your individual answers are never readable by any organisation.

13.Young People

PRISM is built for students and early-career professionals, and we expect some of our users to be under 18. If you are under the age at which you can consent for yourself in your country, please use PRISM with a parent or guardian's involvement. If you believe a child has used PRISM without appropriate consent, contact privacy@prism-careers.com and we will delete the account and its data.