Beta Privacy Policy

1. Who we are

PRISM is operated by Mitchell Wierstra, an individual in Alberta, Canada, doing business as PRISM. PRISM is not yet incorporated; this policy will be updated when it is. Mitchell Wierstra is responsible for personal information under PRISM’s control and can answer questions about it, including questions about our use of service providers outside Canada: prismportfolioanalytics@gmail.com.

2. The short version

• During the beta, upload anonymized holdings only: tickers or fund codes and amounts, with no client names, account numbers, SINs or other identifiers.
• Portfolio data you analyze is sent to Anthropic (United States) to generate the written summary, and uploaded screenshots are sent to Anthropic to read the holdings.
• Your account and saved analyses are stored with Supabase (United States). The site runs on Vercel (United States). Usage analytics use PostHog (United States) and Vercel Analytics.
• We don’t sell personal information and we don’t show ads.
• Email prismportfolioanalytics@gmail.com to access or delete your data.

3. Anonymized data only (beta rule)

The upload page shows the same notice.

4. What we collect

• Account: your email address and password. Passwords are handled by Supabase Auth; we don’t see them.
• Holdings you analyze: tickers or fund codes and amounts, from a CSV or Excel file, pasted text or a screenshot.
• Saved analyses: when you click Save, we store that portfolio’s holdings and the analysis results under your account.
• Usage events: actions such as uploading a portfolio, completing an analysis, saving, signing in, running a What-If and opening a report. Events can include counts, the upload method, your browser language, a random browser ID and your user ID if you’re signed in; for What-If, the ticker and amount you tested; for holdings PRISM doesn’t recognise, those tickers or fund codes (so we know which funds to add; entries made only of numbers are never recorded); and for reports, the preset and number of sections chosen (never the branding you enter).
• Analytics and logs: page views and interactions (PostHog and Vercel Analytics), and standard server logs kept by our hosting provider (for example, IP address and request time).
• Help chat: the messages you type into the help assistant.
• Access requests: the name, work email, firm type, province and how you heard about PRISM that you enter on the “Get advisor access” form, used only to reply about access.

We don’t ask for brokerage logins, banking details or SINs, and you shouldn’t upload them.

5. Where it goes

Your browser also contacts a public exchange-rate service to convert between US and Canadian dollars; no portfolio data is sent to it. Information processed outside Canada may be accessible to courts and authorities there under local law.

6. On your device

Your browser stores the current holdings, a random ID and your last visit time (local storage), plus your sign-in session. PostHog may also set cookies or use local storage. Clearing your browser data removes these.

If you download a report, the branding you enter (advisor name, firm, "prepared for" label and disclaimer) and your section choices are saved in your browser only so they are filled in next time. They are not sent to PRISM; the report is built in your browser.

7. How we use it

To run the analysis, generate the written summaries, save the analyses you choose to save, keep the beta working and secure, and understand how the beta is used. We don’t sell personal information, and we don’t use your data for advertising.

8. How it’s protected, and a known limitation

Saved analyses and usage events are protected by database access rules: each signed-in user can only access their own saved analyses, and usage events can’t be read through the website.

PRISM’s reference data — its securities and fund-holdings data — can be read with the public key the website uses. It contains no information about you or your uploads, but it is one reason the beta is limited to anonymized data. We don’t claim any security certification, and no system is completely secure.

9. How long we keep it

• Account data, saved analyses and usage events: until you ask us to delete them, or until the beta ends and we delete them.
• Data in your browser: until you clear it.
• Data sent to Anthropic, PostHog and Vercel: handled under each provider’s own terms and retention periods.

10. Your choices and rights

Email prismportfolioanalytics@gmail.com to access, correct or delete your account and saved analyses. We’ll respond within 30 days. You can withdraw your consent at any time by stopping use of PRISM and asking us to delete your data; you won’t be able to use PRISM after that.

11. Canadian privacy law

We aim to handle personal information in line with Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) and Alberta’s Personal Information Protection Act (PIPA). We don’t claim any certification. If you have a concern, please contact us first; you can also contact the Office of the Privacy Commissioner of Canada or the Office of the Information and Privacy Commissioner of Alberta.

12. Changes

If we change this policy materially, we’ll tell you by email or in PRISM before the change applies.