Updated Oct 2026

Privacy Policy

Last updated: 26 October 2026

This Privacy Policy explains how Prisma, a service operated by Sopa Lab SL, accesses, uses, stores, shares, protects and deletes personal data, including data received from Google APIs, when you use the Prisma website, dashboard and API to read and reply to reviews of businesses and apps you own or manage.

1. Who we are

Prisma is operated by Sopa Lab SL, a Spanish company with tax ID B23884570 and registered address at Calle Reina Mercedes 1, 7º D, 28020 Madrid, Spain (“Sopa”, “we”, “us”).

Contact for privacy matters: privacy@prismareviews.com. We have not appointed a Data Protection Officer because the law does not require one for our activity; privacy@prismareviews.com reaches the person responsible for data protection.

2. Our two roles

• Controller (a “business” under US state privacy laws) for the data of our own customers and website visitors: account details, billing, support and security logs.
• Processor (a “service provider” under the CCPA and similar US laws) for the review data we handle on your behalf when you connect a location or app: the review content, reviewer names and the replies you publish. For that data, you (our customer) are the controller, and our Data Processing Agreement applies.

3. Data we process

We do not access reviews of businesses or apps you don’t own or manage, and we do not scrape review sites.

Signing in with Google, GitHub or Apple. These options are only used if you choose them. Your browser then goes to that provider, which shares your basic profile (name and email address) and an account ID with us so we can create or open your Prisma account. We don’t receive your password for that provider, we don’t post anything on your behalf, and the provider handles the sign-in under its own privacy policy. Signing in with Google is separate from connecting a Google Business Profile, described in the next section.

4. How we access Google user data

When you connect a Google Business Profile, you sign in with Google and grant Prisma access through OAuth. We request the scope https://www.googleapis.com/auth/business.manage, which allows us to:

• Read the accounts and locations you own or manage, and the reviews of those locations.
• Write replies to those reviews, and update or delete replies, only when you or your application ask us to through the API.

We do not use this access to change any other data in your Business Profile.

5. How we use the data

We use the data only to provide and improve the user-facing features of Prisma:

• Create and run your account: verify your email address, sign you in and keep you signed in, reset your password, issue and roll your API keys, and send account emails (verification and password reset, delivered through Resend).
• Show your plan, keys, usage and connections in the dashboard, and your connected locations and their reviews through the API.
• Publish, update and delete replies you request.
• Send webhooks and notifications you configure.
• Bill per connected location, prevent abuse, debug errors and secure the service.
• Answer support requests.
• Understand who signs up and how they found us (onboarding answers and sign-up origin), to improve the product and measure our own marketing. We look at this ourselves; it is never sold or shared for advertising.

Google API Services User Data Policy and Limited Use

Prisma’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• We use Google user data only to provide or improve the user-facing features described above.
• We do not transfer Google user data to others except as needed to provide or improve those features with your consent, for security purposes, to comply with applicable law, or as part of a merger, acquisition or sale of assets with your explicit prior consent.
• Our staff do not read Google user data unless you give us affirmative agreement for specific messages or items (for example, a support request), it is necessary for security purposes such as investigating abuse, it is required to comply with applicable law, or the data is aggregated and used for internal operations in line with applicable privacy law.
• We do not sell Google user data, transfer it to advertising platforms or data brokers, use it to serve advertising (including retargeting or personalized ads), or use it to determine creditworthiness or for lending.
• We do not use Google user data to develop, improve or train generalized or non-personalized AI or machine-learning models.

The same commitments apply to data from Trustpilot, App Store Connect and Google Play, in addition to each platform’s own terms.

6. Legal bases (EEA, UK and Switzerland)

• Contract (GDPR art. 6(1)(b)): to create and run your account (sign-up, email verification, sign-in with email and password or with the provider you choose, sessions, password reset, API keys and account emails), connect your locations and run the service.
• Legitimate interest (art. 6(1)(f)): to secure the service and your account (for example, using session data such as IP address and user agent to detect suspicious sign-ins), prevent abuse, and improve features using aggregated data.
• Legal obligation (art. 6(1)(c)): to keep invoices and accounting records.
• Consent (art. 6(1)(a)): for marketing emails and for analytics cookies such as prisma_attr, both of which you can withdraw at any time (unsubscribe link, or Cookie settings at the bottom of every page).
• Legal obligation (art. 6(1)(c) and art. 7(1)): to keep proof of the cookie consent you gave or refused.
• Legitimate interest (art. 6(1)(f)), also: to know which of our pages and campaigns bring customers, using the onboarding answers you choose to give and the campaign parameters of the sign-up link.

For review data we process as a processor, the legal basis is determined by you as controller.

7. How we share data

We share data only with:

• Subprocessors that host and run Prisma, listed on our Security page: hosting, email delivery, payments, invoicing and review data providers. They are bound by contracts with data-protection terms at least as strict as ours.
• The sign-in provider you choose (Google, GitHub or Apple), which receives the sign-in request only when you pick that option.
• The platform you connected, when you publish a reply (the reply goes to Google, Trustpilot, Apple or Google Play).
• Authorities, when required by law.
• A buyer or successor, in a merger or acquisition, with your explicit prior consent where Google user data is involved.

We never sell personal data or share it for cross-context behavioral advertising, as those terms are defined in US state privacy laws, and we have not done so in the past 12 months.

8. International transfers

We store data in the European Union. Some subprocessors, such as Resend and Stripe, are based in the United States. For those transfers we rely on the EU-US Data Privacy Framework where the provider is certified, or on the European Commission’s Standard Contractual Clauses plus supplementary measures. If you are in the United States, your data is processed in the EU and the US under these safeguards.

9. How we store and protect data

• Data is encrypted in transit (TLS) and at rest.
• OAuth tokens and platform credentials are encrypted at application level and only decrypted to make API calls on your behalf.
• Access to production is limited to a small number of authorized engineers, uses multi-factor authentication and is logged.
• See Security for details.

10. Retention and deletion

How to delete your data

• Disconnect a location with the API (DELETE /v1/connections/{id}); we delete its tokens and review data as described above.
• Revoke Prisma’s access at any time from the platform, for Google at https://myaccount.google.com/permissions.
• To close your account and delete all your data, email privacy@prismareviews.com from the address on your account. We delete your account within 30 days and confirm by email; invoices are kept as required by law.

11. Your rights

In the EEA, UK and Switzerland, under the GDPR you can request access, rectification, erasure, restriction, portability, and object to processing, and withdraw consent at any time. Write to privacy@prismareviews.com. We answer within one month.

If you are a reviewer whose review appears in a business’s account, contact that business first: they are the controller. We will help them answer your request.

You can also complain to the Spanish Data Protection Agency (Agencia Española de Protección de Datos, www.aepd.es) or your local data protection authority.

12. Notice for United States residents

This section applies to residents of California and the other US states with comprehensive privacy laws (such as Colorado, Connecticut, Virginia, Utah, Texas and Oregon), and adds to the rest of this policy.

Categories of personal information we collected in the last 12 months, with the sources and purposes described in sections 3 and 5:

The only sensitive personal information we collect is your account login (email address and password, with the password stored only as a hash). We use it only to sign you in and keep your account secure, which the law allows without a right to limit, and we don’t use personal information to infer characteristics about you.

We don’t sell or share personal information. We don’t sell it, share it for cross-context behavioral advertising, or use it for targeted advertising or profiling, so there is nothing to opt out of. We still honor Global Privacy Control signals as a valid opt-out request.

Your rights. Depending on your state, you can ask us to:

• tell you what personal information we collect, use and disclose, and give you a copy;
• correct inaccurate personal information;
• delete it;
• review a decision we made about your request (appeal).

To make a request, email privacy@prismareviews.com from the address on your account. We verify requests by matching them to your account details and answer within 45 days. An authorized agent can make a request for you with your signed permission. We won’t treat you differently for using these rights. If we deny your request, you can appeal by replying to our answer; if you’re still not satisfied, you can contact your state attorney general.

Do Not Track. We don’t track visitors across websites or over time, so our website works the same whether or not your browser sends a Do Not Track signal.

Reviewers. If your review appears in a business’s account, that business decides how it’s used. Send your request to the business; we will help it respond.

13. Children

Prisma is a business service and is not directed to anyone under 18. We don’t knowingly collect personal information from children under 13 (as defined by the US Children’s Online Privacy Protection Act) or under 16. If you believe a child has given us personal information, write to privacy@prismareviews.com and we will delete it.

14. Changes to this policy

We will post any change here with a new “Last updated” date. If we plan to use Google user data, or any other data, in a new way, we will notify you in advance and ask for your consent before doing so.

15. Contact

Sopa Lab SL · Calle Reina Mercedes 1, 7º D, 28020 Madrid, Spain · B23884570 · privacy@prismareviews.com