Privacy Policy
End Game Consulting, LLC, doing business as PRISM (“PRISM,” “we,” “us,” or “our”), provides the PRISM Revenue Intelligence Operating System (the “Service”). This Privacy Policy explains how we collect, use, share, and protect personal information.
This policy is written to be read in plain English. Where it uses legal terms (like “controller” and “processor”), we explain what they mean.
1. The most important thing to understand first
PRISM handles personal information in two very different roles, and your rights — and who you should contact — depend on which one applies.
Role 1 — We are a “processor” of Customer Data. When a business (our “Customer”) uses PRISM, it connects its own systems — CRM, email, calendar, chat — and PRISM ingests, organizes, and analyzes that data on the Customer’s behalf. This includes information about the Customer’s own employees and about the prospects, leads, and contacts in the Customer’s systems. We call this “Customer Data.”
For Customer Data, the Customer is the “controller” — they decide what data goes into PRISM and why — and PRISM is only the “processor,” acting on the Customer’s instructions. Our handling of Customer Data is governed by our Data Processing Addendum (DPA) with that Customer, not by this Privacy Policy.
If you are a prospect, contact, or employee of a business that uses PRISM and you want to access, correct, or delete your information, you should contact that business directly — they control the data. If you contact us, we will forward your request to the relevant Customer and will not act on it ourselves, except as their DPA requires.
Role 2 — We are a “controller” of Site and Account Data. When you visit our website (prismmode.co), contact us, request a demo, or administer a PRISM account, we collect a limited set of information for our own business purposes. For this data, PRISM is the controller, and the rest of this Privacy Policy describes how we handle it.
2. Who we are and how to contact us
| Legal entity | End Game Consulting, LLC, DBA PRISM |
| Address | 1061 Winnsboro Loop, Round Rock, TX 78664, USA |
| Privacy contact | info@prismmode.co |
| Website | https://prismmode.co |
| Application | https://app.prismmode.co |
For any privacy question, request, or complaint, email info@prismmode.co.
3. Information we collect as a controller
This section covers data for which we are the controller — primarily website visitors, people who reach out to us, and the administrators and users who hold PRISM accounts.
Information you give us directly
- Contact and inquiry data — your name, business email, company, role, and the content of your message when you contact us, request a demo, or sign up for updates.
- Account data — when you are set up as a user of PRISM, your name, business email, job title, role/permissions, and authentication identifiers.
Information we collect automatically when you use the Service
- Authentication and audit data — single sign-on (SSO) identifiers, login timestamps, IP address, and logs of actions taken within the application. We use these to secure the Service, prevent abuse, and maintain an audit trail.
- Limited technical data — standard server logs (such as IP address, browser type, and request timestamps) generated when you access our website or application.
Our website uses only essential cookies. prismmode.co does not run third-party advertising or analytics trackers. We use only the cookies strictly necessary to operate the site and keep you signed in. See Section 12 for details.
Information we do not want and are not designed to handle. PRISM is not designed to collect or process payment card numbers, financial account numbers, Social Security numbers or other government-issued identifiers, or Protected Health Information (“PHI”) under HIPAA. PRISM is not a HIPAA Business Associate. Please do not submit these categories of data to the Service.
4. How we use information (and our legal bases)
As a controller, we use the information in Section 3 to:
- Respond to you and provide the information, demo, or support you request.
- Provide, secure, and operate the Service — authenticate users, enforce permissions, maintain audit logs, and detect and prevent fraud or abuse.
- Improve and develop our products and website.
- Communicate with you about your account, service changes, and (where permitted) relevant product updates.
- Comply with law and enforce our agreements.
Where the EU/UK GDPR applies, our legal bases are: performance of a contract (to provide the Service and respond to your requests), our legitimate interests (to secure, operate, and improve the Service and to communicate with business contacts), consent (where we ask for it, such as optional communications), and legal obligation (to meet our compliance duties). You may withdraw consent at any time where consent is the basis.
5. Artificial intelligence and your data
PRISM uses large language models to generate intelligence outputs such as deal summaries, account briefs, risk signals, suggested next actions, and notes summaries. Our commitments:
- No model training on your data. We do not — and we contractually require our AI providers not to — use Customer Data or your personal information to train, fine-tune, or improve any machine-learning models.
- Zero-retention inference. AI processing of personal data is performed on a zero-data-retention basis: the AI provider does not retain the data after generating the output.
- Bring-your-own-key model. Where a Customer connects its own enterprise AI account (a “BYO key” arrangement), the AI provider acts as that Customer’s own processor for those calls — the data does not pass through an AI key controlled by PRISM.
6. Google Workspace data (Gmail and Calendar)
When a user connects their Google account to PRISM, we access certain Google user data through Google APIs, and only to provide user-facing features the user chooses to use. Connecting Google is optional and initiated by the user.
What Google data we access
- Gmail — read (
gmail.readonly) — the content and metadata of email messages between the user and their business contacts, so PRISM can log them as activity on the correct customer record and generate short summaries and suggested next steps. - Gmail — send (
gmail.send) — the ability to send an individual email the user composes in PRISM to a recipient they choose. - Google Calendar (
calendar.readonly,calendar.events,calendar.freebusy) — the user’s calendar events and free/busy availability, so PRISM can prepare meeting briefings and create or update meetings the user schedules in PRISM.
How we use Google data
Google user data is used solely to provide and improve the user-facing features described above. We do not use Google user data for advertising or lending, and we do not sell it. PRISM handles only one-to-one correspondence between the user and contacts they already do business with; it is not a bulk, cold-outreach, or email-warming tool.
How we share Google data
Google user data is processed on our behalf by Supabase (encrypted database and hosting) and Anthropic (large language model inference for the summaries and suggestions described above), each under contracts requiring them to use the data only to provide their service to PRISM. We do not share Google user data with any other third parties.
Limited Use
PRISM’s use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Data received from Google Workspace APIs is not used to develop, improve, or train generalized artificial-intelligence or machine-learning models, and is not transferred to any third party that would use it to train such models.
Retention and deletion of Google data
We retain Google user data only while the user’s Google account remains connected. A user can disconnect at any time from Settings → Connected Accounts in the application, which immediately stops further access; on disconnection or account deletion, stored OAuth tokens are revoked and data derived from Google APIs is deleted in line with Section 9 (generally within 90 days). A user may also request deletion by emailing info@prismmode.co.
7. How we share information, and our sub-processors
We do not sell personal information, and we do not share it for cross-context behavioral advertising.
We share information only with:
- Service providers / sub-processors who help us run the Service under written contracts that require them to protect the data and use it only to provide their service to us.
- Professional advisors (legal, accounting) under confidentiality obligations.
- Authorities or others where required by law, or to protect rights, safety, and security.
- In a business transfer (merger, acquisition, financing), subject to this policy continuing to apply.
Our current sub-processors (as of the effective date):
| Sub-processor | Purpose | Location |
|---|---|---|
| Vercel Inc. | Application hosting, edge network, TLS termination | United States (multi-region) |
| Supabase Inc. | Managed Postgres database, authentication, object storage | United States |
| Anthropic, PBC | Large language model inference for AI outputs | United States |
| Google LLC | Google Workspace APIs (Gmail, Calendar) for connected accounts; OAuth identity provider; analytics warehouse for permissioned data | United States |
| Slack Technologies, LLC | Inbound/outbound messaging integration (where enabled) | United States |
| Customer.io | Customer messaging integration (where enabled) | United States |
Customers receive advance notice of changes to the sub-processor list as set out in their DPA. To request the current list, email info@prismmode.co.
8. How we protect information
We maintain technical and organizational security measures appropriate to the data we handle. Measures currently in place include:
- Authentication — all user access is via Google SSO (OAuth 2.0). We do not store user passwords.
- Access control — role-based access control enforced at the application layer; sensitive functions require elevated roles.
- Tenant isolation — Postgres Row-Level Security (“RLS”) is enforced on every customer-data table, so isolation between Customers is enforced by the database engine itself, not by application code alone.
- Encryption — TLS 1.2 or higher for all traffic in transit; AES-256 encryption at rest for the application database and object storage.
- Secrets management — third-party credentials and signing secrets are held in managed, encrypted environment infrastructure and are never committed to source control.
- Network security — all traffic served over HTTPS; inbound webhooks verified by HMAC-SHA256 signatures.
- Application security — dependency vulnerability scanning, secrets-in-code scanning, and required code review before changes reach production.
- Logging and backups — audit logging of sensitive actions, and continuous database backups with point-in-time recovery.
- Confidentiality — personnel with access to personal data are bound by written confidentiality obligations, and access is limited on a need-to-know basis.
Our security program is designed to meet SOC 2 Type II criteria for security, availability, and confidentiality. We are working toward formal third-party certification; references to SOC 2 describe the design of our program and are not a representation that certification has been completed. No method of transmission or storage is perfectly secure, and we cannot guarantee absolute security.
9. How long we keep information
We keep personal information only as long as needed for the purposes described in this policy, or as required by law.
- Inquiry and contact data — kept for as long as needed to respond to you and for a reasonable period afterward.
- Account, authentication, and audit data — kept for the life of the account.
- Customer Data (where we are processor) — retained for the term of the Customer’s agreement and then returned or deleted as set out in the DPA, generally within 90 days of termination. Routine backups and audit logs are deleted in the ordinary course, not to exceed 90 days after deletion.
When we no longer need information, we securely delete or anonymize it.
10. International data transfers
We are based in the United States and our sub-processors process data in the United States. If you are located in the European Economic Area, the United Kingdom, or Switzerland, transferring your data to the U.S. means transferring it outside your home region.
Where such transfers involve personal data protected by the GDPR or UK GDPR, we rely on the European Commission’s Standard Contractual Clauses (and the UK International Data Transfer Addendum where applicable) as the legal transfer mechanism. You may request more information about these safeguards at info@prismmode.co.
11. Your privacy rights
Depending on where you live, you may have some or all of the following rights. Remember the distinction in Section 1: if your data is in a PRISM Customer’s systems (Customer Data), the Customer controls it — direct your request to that business, and we will assist them. For data we control, you can exercise your rights directly with us.
If you are in the EEA, UK, or Switzerland (GDPR / UK GDPR), you have the right to: access; rectification; erasure; restriction of processing; data portability; objection to processing; and to withdraw consent. You also have the right to lodge a complaint with your local supervisory authority.
If you are a California resident (CCPA / CPRA), you have the right to: know what personal information we collect, use, and disclose; access and obtain a copy of it; correct inaccurate information; delete it; and to not be discriminated against for exercising your rights. We do not sell or share personal information as those terms are defined under the CCPA, and we do not process sensitive personal information for purposes that would trigger a right to limit. When acting for our Customers, PRISM is a “service provider” and does not retain, use, or disclose personal information except to provide the Service.
To exercise any right, email info@prismmode.co. We will verify your request and respond within the timeframes required by applicable law. You may use an authorized agent where the law permits. We will not discriminate against you for exercising your rights.
12. Cookies and tracking
Our website (prismmode.co) uses only essential cookies — the small files needed to make the site work and to keep authenticated users signed in. We do not use third-party advertising cookies or third-party web-analytics trackers on our website, and we do not engage in cross-site tracking. Because we do not track you across sites, we treat browser “Do Not Track” and Global Privacy Control signals as consistent with how we already operate.
The PRISM application uses essential cookies for authentication and session management only.
13. Education records (FERPA)
Some of our Customers are educational institutions or act on their behalf. Where a Customer is an “educational agency or institution,” PRISM may incidentally process “education records” subject to the Family Educational Rights and Privacy Act (“FERPA”). In that case, PRISM acts solely as the Customer’s processor under the Customer’s direct control as a “school official,” uses such records only to provide the Service, and does not re-disclose them except on the Customer’s documented instructions and as FERPA permits. Requests regarding education records should be directed to the educational institution.
14. Children’s privacy
The Service is a business tool intended for use by organizations and their personnel. It is not directed to children, and we do not knowingly collect personal information directly from children under 16. Where a Customer’s data incidentally includes information about minors (for example, an education Customer’s records), that data is handled as Customer Data under the Customer’s control and instructions.
15. Changes to this policy
We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last updated” date above and, where appropriate, provide additional notice (for example, by email or an in-product notice). Your continued use of the Service after an update means you accept the revised policy.
16. Contact us
Questions, requests, or complaints about this policy or your personal information:
End Game Consulting, LLC (DBA PRISM)
Attn: Privacy
1061 Winnsboro Loop, Round Rock, TX 78664, USA
info@prismmode.co