This notice is written to meet article 10 of Turkey's Personal Data Protection Law (KVKK, no. 6698). Where processing needs your explicit consent, that consent is asked for in a separate document, as the Board's decision of 18 February 2026 (2026/347) requires.
The data controller is PRISM Creations Ltd.. You can reach us from inside the app by writing to @administration.
What Prisma stores depends on the features you use. A feature you never turn on stores nothing.
| Data | Why | How long |
|---|---|---|
| Username, an irreversible hash of your password, your list of devices | So the account exists and you can sign in | Until you delete the account |
| Your IP address and device/app details, in the homeserver's session records | Security, spotting abuse, clearing stale sessions | Until the session record is removed |
| The encrypted content of your messages, plus metadata such as who is in which room and when a message was sent | Delivering messages and syncing them between your devices | As long as the room's retention setting says; otherwise until you or a room admin delete them |
| Encrypted files and images you send | Media sharing | With their message |
| If you set up the WhatsApp bridge: your phone number, WhatsApp session keys, contacts and the content of bridged chats | So your WhatsApp messages appear in Prisma | Until you remove the bridge |
| If you open the wallet: your Monero subaddress, balance and transaction history | Running the wallet | Until you delete the wallet; on-chain transactions cannot be deleted |
| If you buy from the library: which app, and the payment record | So you can download what you paid for | While the account exists |
| If you use PrismAI: what you write to it | To produce an answer | While the conversation exists |
Messages inside Prisma are end-to-end encrypted: the server carries them, it cannot open them. The wallet's master key is stored encrypted.
The WhatsApp bridge. For a WhatsApp message to appear in Prisma, the bridge decrypts it on the server and re-encrypts it for you. Bridged WhatsApp chats therefore pass through the server in the clear. If that is not acceptable to you, do not set up the bridge.
PrismAI. What you write to it is sent to Meta over WhatsApp to be answered. Meta processes it under its own rules and on its own servers, which means a transfer abroad. Do not write anything to PrismAI you would not share.
We do not sell personal data, do not use it for advertising and do not share it for marketing. Data leaves us only here:
Directly from you and your device, electronically, as you use the app. We do not buy data about you from anyone.
You may ask whether we process your personal data, request information about it, learn whether it is used for its stated purpose, learn who it has been transferred to inside or outside the country, have it corrected if it is wrong or incomplete, have it erased or destroyed where the conditions are met, ask that those changes be passed on to anyone it was transferred to, object to a decision made about you purely by automated analysis, and claim compensation for damage caused by unlawful processing.
Write to @administration in the app. We answer within 30 days.
No system is perfect. If personal data is breached we notify the Authority and the affected users within 72 hours, as the Board requires.
Prisma is not designed for anyone under 18.
If this notice changes, the date above changes with it, and we announce anything significant in the app.