Privacy Policy
Status: January 2026
For Prismik GmbH ("Prismik", "we" or "us"), the protection of personal data is an important concern. We treat your data confidentially and in accordance with legal data protection regulations (GDPR/DSGVO and BDSG).
1. Responsible Party (Verantwortlicher)
Prismik GmbH
Stargarder Strasse 45, 10437 Berlin
E-Mail: [email protected]
A data protection officer has not been appointed, as the legal requirements for this are not met.
2. Data Processing on our Platform
2.1. Visit to the Website / Platform
When visiting our website, technical information is automatically processed (IP address, browser, device type, date/time, referrer URL). This is stored in server log files for security purposes and automatically deleted after 30 days.
Legal basis: Art. 6 (1) (f) GDPR (Legitimate interest in secure operation).
2.2. AI-Infographic Generation (New for 2026)
To provide our core service, we use external AI models. When you enter a prompt to generate an infographic, your input is processed by one of the following providers:
OpenAI (USA/Ireland), Google Gemini (USA/Ireland), Anthropic/Claude (USA), and xAI/Grok (USA).
Purpose: Generation of visual content based on user input.
Legal basis: Art. 6 (1) (b) GDPR (Performance of a contract).
Safety: We have concluded Data Processing Agreements with these providers. Transfers to the USA are based on the EU-U.S. Data Privacy Framework.
2.3. Customer Account & Subscriptions
We process contact data (Name, Email, Company, Address) and payment data.
Infrastructure: We use Railway for hosting and Supabase (EU-based) for database/authentication.
Payment & Tax: We use Stripe (Stripe Payments Europe Ltd.). Stripe also calculates local taxes (Stripe Tax) based on your address.
Legal basis: Art. 6 (1) (b) GDPR.
Retention: Until account cancellation, or up to 10 years for tax-relevant data (HGB/AO).
2.4. Product Analytics (PostHog)
We use PostHog EU to understand how our tool is used. Data is hosted on servers within the European Union (Germany). No personal data is transferred to the US for analytics.
Legal basis: Art. 6 (1) (f) GDPR (Product improvement).
3. Service Providers and Data Transfer
We work with external service providers (e.g., Railway, Stripe, AI Providers). Data transfer to third countries (USA) only occurs if an adequate level of protection exists (Standard Contractual Clauses or Data Privacy Framework).
4. Your Rights
Under the GDPR, you have the right to:
Access (Art. 15), Rectification (Art. 16), Erasure (Art. 17), Restriction (Art. 18), Data Portability (Art. 20), and Objection (Art. 21).
Withdraw Consent: If you gave us consent (e.g., for marketing), you can withdraw it at any time.
DPA for Business Customers: As we primarily serve entrepreneurs (§ 14 BGB), we offer a Data Processing Agreement (AV-Vertrag) per Art. 28 GDPR. Request it at [email protected].