Privacy Policy

This Privacy Policy explains how Prisfol ("Prisfol", "we", "us"), operated by Naveh Elya (Israel), collects, uses, shares and protects information when you use the Prisfol website, platform and APIs (the "Service"). For privacy questions you can reach us at support@prisfol.com.

We collect the following categories of information:

• Account information. When you create an account we collect your email address and authentication identifiers. If you sign in with a third-party provider, we receive a basic profile (name, email, avatar URL).
• Content you submit. Prompts, uploaded images, video and audio files, brand assets, workflows, node configurations and any other content you create or store in the Service.
• Generated outputs. Images, video, audio and other assets produced by the AI providers we orchestrate on your behalf, together with metadata about the generation (model used, parameters, timestamps, credits consumed).
• Billing information. When you subscribe or buy credits, our Merchant of Record Dodo Payments collects your payment-method details and billing address directly. We receive a customer ID, plan, billing status and the last four digits / brand of your card — we do not store full card numbers on our servers. Dodo Payments is responsible for sales tax / VAT collection and the issuing of invoices.
• Usage and device data. IP address, user agent, pages viewed, performance metrics and high-level interaction events, collected to operate, secure and improve the Service.
• Communications. If you email us, we keep the contents of those messages.

• Provide, operate and maintain the Service, including running your workflows and storing your assets.
• Process your inputs through the AI models you select and deliver the outputs back to you.
• Process payments, manage subscriptions and apply credit balances.
• Send transactional messages (account, billing, security and material product changes).
• Monitor and improve performance, debug issues, and prevent abuse, fraud and security incidents.
• Comply with legal obligations and enforce our Terms of Service.

We do not use your prompts, uploaded assets or generated outputs to train foundation AI models. We do not sell your personal information.

If you are in the EEA or UK, we rely on the following bases under the GDPR / UK GDPR:

• Contract. To create your account, deliver the Service and process payments.
• Legitimate interests. To secure the Service, prevent abuse and improve our product.
• Consent. For non-essential cookies and analytics where required, for optional marketing communications, and before we process voice samples you upload.
• Legal obligation. To meet tax, accounting and other regulatory requirements.

We share information with the following infrastructure processors strictly to operate the Service. Each provider is bound by confidentiality and data-processing obligations.

• Supabase — managed Postgres, authentication and file storage that hosts your account, content and generated assets.
• Vercel — application hosting, edge runtime, performance metrics and product analytics.
• Dodo Payments — Merchant of Record for all purchases. Handles checkout, subscription management, invoice issuing, and global sales tax / VAT collection and remittance. Dodo Payments' privacy policy applies to the data it collects directly from you at checkout.
• Resend — transactional and administrative email delivery.

AI model providers that process your prompts and media are listed separately in Section 6.

We may also disclose information when required by law, to enforce our Terms, to protect our rights or those of our users, or in connection with a merger, acquisition or sale of assets (in which case we will notify affected users where practical).

Ownership. You own the outputs you generate through our AI tools. We do not claim ownership of your content and do not use your outputs for any purpose other than delivering them to you. We do not train our own models on your prompts, uploaded media or generated outputs.

AI model sub-processors. To deliver the feature you requested, we transmit your prompts and uploaded reference media to the third-party AI model provider that powers the step you run. The current list of providers includes:

• Anthropic (Claude) — powers the chat assistant that helps you build and edit workflows.
• Google (Gemini) — large-language-model and image-model inference for orchestration and generation.
• Replicate — runs many of the image and video models used to generate and process media, including via webhook callbacks.
• ElevenLabs — speech and audio generation when you use voice / text-to-speech features.
• FAL, WaveSpeed, KIE and Kinovi — additional generation providers that run specific image, video and audio models.

Each provider operates under its own privacy and data-handling terms; please review them if you need detail on a specific model. Where a provider offers a no-training or zero-retention mode we use it when available; otherwise the provider's standard terms apply. For a current list of sub-processors, contact support@prisfol.com.

Voice and audio. If you upload voice or audio samples to use a speech feature, those samples are sent to our audio AI provider to generate your output. You must confirm you have the right to use any voice sample you upload. Voice recordings may constitute biometric data under certain laws (e.g. GDPR Art. 9, BIPA); we process them only to deliver the feature you requested and never sell or share them for any third party's own purposes.

Synthetic-media marking (EU AI Act Article 50). Outputs of the Service are AI-generated. We are progressively adding machine-readable markers — such as C2PA / Content Credentials and embedded metadata, where our upstream providers supply them — to AI-generated outputs, with the goal of meeting the EU AI Act Article 50 requirements. Coverage today is partial and varies by tool and provider. Regardless of marking, when you publish or share outputs you should disclose that they are AI-generated and must not remove any marker that is present.

The providers above operate in the United States, the European Union, Israel and other regions. Israel has been recognized by the European Commission as providing adequate data protection (Decision 2011/61/EU). Where personal data is transferred out of the EEA / UK to a country without an adequacy decision, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses or equivalent mechanisms.

• Account & content. Retained for as long as your account is active.
• After deletion. When you delete your account or specific content, we delete or anonymize it within 30 days, except where we are required to retain records (e.g. invoices for tax purposes — typically up to 7 years).
• Logs & usage data. Operational logs are retained for up to 90 days; aggregated analytics may be kept longer in de-identified form.

Depending on where you live, you may have the right to access, correct, delete, port, restrict or object to processing of your personal information, and to withdraw consent at any time. EEA / UK users have the right to lodge a complaint with their supervisory authority. California (CCPA / CPRA) and other US-state residents have rights to know, delete, correct and opt out of any "sale" or "sharing" — Prisfol does not sell or share personal information for cross-context behavioral advertising.

To exercise any of these rights, email support@prisfol.com from the address on your account. We respond within the timeframes required by applicable law.

We use a small set of cookies and equivalent technologies, grouped as follows:

• Strictly necessary. Authentication session tokens (Supabase), CSRF protection and load-balancing identifiers. The Service cannot function without these and they are exempt from consent requirements.
• Preferences. Local-storage entries that remember your selected theme and UI state.
• Analytics & performance. Vercel Analytics and Vercel Speed Insights collect anonymized usage and performance metrics. In regions where consent is required (EEA, UK, California), these are loaded only after you accept them via our cookie banner.

You can change or withdraw your cookie choices at any time by clearing your browser storage for this site, which will trigger the consent banner again on your next visit.

We use industry-standard safeguards including TLS in transit, encryption at rest on our database provider, role-based access controls and Supabase Row-Level Security to limit access to your data. No method of transmission or storage is 100% secure; if we become aware of a breach affecting your personal information we will notify you and the relevant authorities as required by law.

The Service is intended for users who are at least 13 years old. Users between 13 and 18 must have permission from a parent or legal guardian. We do not knowingly collect personal information from children under 13. In jurisdictions where the minimum age for data-processing consent is higher (for example 16 under the GDPR in some EU member states), users below that age require parental consent. If you believe a child has provided us with personal information without the required consent, contact us and we will delete it.

We may update this Privacy Policy from time to time. If a change is material, we will provide notice (for example by email or in-product banner) before it takes effect. The "Last updated" date above always reflects the current version.

Prisfol is operated by Naveh Elya, Israel. Privacy questions or requests: support@prisfol.com.