LEGAL

PRISM CEO is a service of SIRT, Inc., a Florida corporation ("PRISM," "we," "us"). This policy explains what information we collect through prism.ceo, how we use it, and the choices you have. It also explains how we protect the confidential documents our customers share with us during a review.

We treat customer information the way an accounting or law firm treats a customer file: we collect only what the work needs, we limit who can see it, and we delete it when the work is done.

1. Information we collect

When you contact us. If you fill out our contact form, use our chat, or book a call, we collect your name, email address, phone number, company name, and anything you choose to write in your message.

When you visit our website. Like most websites, ours automatically collects basic technical information, such as your browser type, device type, pages visited, the website that referred you, and general location based on your IP address. We collect this through cookies and similar tools, described in section 5.

When you become a customer. During a review, you share business documents with us, such as invoices, contracts, statements, and vendor bills, along with information about your website, email setup, and online presence. These documents may include names and contact details of your employees or vendors. We ask you not to send passwords, full payment card numbers, Social Security numbers, or health records, and we do not need them to do our work.

When you pay. Payments are handled by our payment processor. We do not store full card numbers.

2. How we use your information

We use your information to:

- reply to your questions and schedule calls

- prepare proposals and agreements

- perform the review you hired us to do and deliver your report

- send invoices and service messages about your engagement

- send occasional updates, only if you ask for them

- keep our website and systems working and secure

- meet our legal and accounting obligations

We use customer documents only to perform your review. We do not use them for marketing, and we do not use them to train artificial intelligence models.

3. How we share your information

We do not sell your personal information, and we do not share it for targeted advertising.

We share information only with:

- Service providers who help us run our business, such as website hosting, forms, scheduling, email, secure file transfer, document storage, payment processing, and business software. They may use your information only to provide services to us.

- Software and tools used under paid business accounts whose terms do not allow your data to be used.

We use these tools to help collect, organize and analyze information for your review, and our team reviews the results.

- Members of our team who work on your engagement and are bound by confidentiality agreements.

- Legal and safety reasons, when required by law, subpoena, or court order, or to protect our rights or the safety of others.

- Business changes, if PRISM is merged, sold, or reorganized, in which case this policy continues to apply to your information.

Our main service providers currently include GoHighLevel (website, forms, CRM, and chat), Microsoft 365 (email, scheduling, office files, and data analysis), ShareFile (secure customer portal), and Stripe (payment processing).

4. Customer documents

When you become a customer, you upload documents through our encrypted customer portal, which requires multifactor sign in. Your files stay in the portal until your project closes. While we work, copies are kept in encrypted storage limited to the PRISM team.

We also use our own in-house analysis tools to review your information, and those tools keep your data within PRISM's secure environment.

Within 30 days after your project closes, we delete your documents from the portal, its recycle bin, and our working storage, and we send you a signed Certificate of Destruction. We keep a copy of your final report and our invoices for 3 years for our business and tax records, unless you ask us to delete the report sooner.

Your customer agreement and data handling agreement control if they say something different from this policy.

5. Cookies and tracking

Our website uses cookies and similar tools to make the site work, remember your preferences, and understand how visitors use the site. We also use tracking codes in links (sometimes called UTM codes) that tell us which campaign or link brought you to us.

We use Google Analytics and GoHighLevel's built-in tools to understand site traffic. Google Analytics collects information such as pages visited, time on site, device type, and general location. You can learn how Google uses this information at Google's privacy page, and you can opt out with the Google Analytics opt out add-on.

We do not use advertising cookies that track you across other websites.

You can block or delete cookies in your browser settings. Some parts of the site may not work as well if you do.

6. Email and text messages

- Email. If you ask to receive updates from us, every marketing email includes an unsubscribe link and our mailing address. We honor unsubscribe requests promptly. We may still send messages about an active engagement or invoice.

- Text messages. If you give us your mobile number and agree to receive texts, we may text you about your inquiry, appointments, or your engagement. Message frequency varies. Message and data rates may apply. Reply STOP to opt out or HELP for help. Agreeing to texts is not a condition of buying anything.

- We do not share or sell your mobile number or text messaging consent with anyone for their marketing. Text consent data is not shared with third parties, except service providers who deliver messages for us.

7. How long we keep information

- Contact form, chat, and booking details from people who do not become customers: up to 24 months after our last contact, then deleted.

- Customer documents: deleted within 30 days after project close, as described in section 4.

- Final reports, agreements, and invoices: 3 years, for business, tax, and legal records.

- Unsubscribe and opt out records: kept so we can continue to honor your choice.

8. Security

We use reasonable safeguards to protect your information, including encryption, multifactor sign in, limited access, and confidentiality agreements. No website, storage system, or transmission is completely secure, so we cannot guarantee absolute security. If a breach affects your personal information, we will notify you as required by law, including Florida's Information Protection Act.

9. Your privacy choices

You may ask us to:

- tell you what personal information we have about you

- correct information that is wrong

- delete your information, unless we must keep it for legal or tax reasons

- stop sending you marketing emails or texts

To make a request, email [email protected]. We may need to confirm your identity first. We will respond within 45 days. We will not treat you differently for making a request.

State privacy laws. Some states, including Florida and California, have consumer privacy laws that apply to businesses above certain size or data thresholds. Based on PRISM's current size and activities, we believe those laws do not currently apply to us, but we offer the choices above to everyone. If that changes, we will update this policy.

10. Children

Our website and services are for businesses. They are not directed to children under 13, and we do not knowingly collect information from children. If you believe a child has sent us information, contact us and we will delete it.

11. Links to other websites

Our site may link to other websites, such as Microsoft Bookings or LinkedIn. Their privacy policies, not ours, apply when you use them.

12. Changes to this policy

We may update this policy from time to time. We will post the new version here with a new effective date. If we make a significant change, we will tell customers directly.

13. Contact us

PRISM CEO, a service of SIRT, Inc.
[email protected]