Privacy Policy

PRISMA PM is operated by Don’t Scroll Soluções em Tecnologia e Comunicação Ltda, CNPJ 66.282.029/0001-11, Aracaju, Sergipe, Brazil. You can reach us at contato@dontscroll.agency.

For your account data (section 2), Don’t Scroll Soluções em Tecnologia e Comunicação Ltda is the data controller. For the project content that organizations store in PRISMA PM, the organization that owns the account is the controller and Don’t Scroll Soluções em Tecnologia e Comunicação Ltda acts as its processor (see section 4).

• Account data: your name, email address, a hashed password (we never see or store it in readable form), your organization memberships and roles, and your language, theme and default-organization preferences.
• Organization content: what you and your colleagues enter or upload: projects, budgets, contracts and addendums, payments and incomes, progress and schedules, requisitions, events, materials and documents, including names, emails and phone numbers of client and service-provider contacts.
• Invitations: the email address of the people you invite and who invited them.
• Audit data: which user created or last changed each record, and when.
• Technical data: IP address, browser and device details and request logs generated by our hosting and infrastructure providers when the service is used. We use them for security and troubleshooting.
• AI connector data: if you connect an AI assistant, the records described in section 7, and the fact that you connected it.

• To provide, secure and support the service and to run your account (performance of our agreement with you).
• To send invitations and essential account emails (same).
• To keep the service secure, prevent abuse and fix problems (our legitimate interest).
• To comply with legal obligations.
• To connect an AI assistant or to use AI import, only when you choose to use those features.

We do not sell personal data, we do not use it for advertising, and we do not use your content to train AI models.

Organizations decide what to put in PRISMA PM. If you enter personal data of other people (for example a client contact), you are responsible for having a lawful basis to do so and for informing them. We process that content only to provide the service and following your instructions.

If you are a contact or worker whose data appears in an organization's PRISMA PM account and you want to exercise your rights, please contact that organization. We will help it respond.

We use only what is needed for the service to work: a session cookie that keeps you signed in; a language preference; your light/dark theme and table column widths, stored in your browser; and a service-worker cache that lets the installed app load faster.

We do not use advertising or analytics cookies, and we do not include third-party trackers.

We use the providers below to run PRISMA PM. They process data on our behalf and only as needed to provide their service.

• Supabase: database and authentication.
• Cloudflare (R2): private storage of uploaded documents and of encrypted database backups.
• Resend: delivery of invitation emails (the recipient's address and the invitation link).
• OpenAI: only when a user runs "Import with AI" on a requisition. The content of the uploaded document is sent to OpenAI to extract its fields.
• Application hosting: Vercel (region sa-east-1 / gru1, São Paulo, Brazil) for the web application; Supabase (region sa-east-1, São Paulo, Brazil) for the database and authentication; and a Hostinger server in Brazil that runs the AI assistant connector and the database backup job.
• AI assistants you connect: only at your choice; see section 7.

We may also disclose data when the law requires it, and to a successor if the business is transferred, in which case this policy continues to apply unless you are told otherwise.

PRISMA PM can be connected to an AI assistant through a connector. This is optional and starts only when you approve the connection on a consent screen. You can disconnect at any time from AI assistants in the app; access stops immediately.

What the assistant can see. Read-only access to the budgets, financial execution, progress, schedule, requisitions, events and contracts of the projects you can already access. It cannot change anything and can never see more than your own permissions allow. This includes projects that colleagues have shared with you, and those colleagues do not see a consent screen for your connection.

How we de-identify it before it leaves PRISMA PM:

• Names of people, companies, clients, projects and contracts are replaced by pseudonymous codes (for example Provider_3fh9d0qv). The same item always gets the same code, and there is no lookup table.
• Contact details, tax numbers, addresses and cities, links, attached documents and invoice numbers are never sent.
• Notes and descriptions go through an automatic filter that removes emails, phone numbers, links, tax and account numbers, and replaces names known to PRISMA PM with codes.
• Financial amounts and dates are sent exactly as stored.

What this does not do. Pseudonymised data is not anonymous. Exact amounts and dates can make a project recognisable to someone who already knows it, and the filter cannot recognise a name that appears only inside free text and nowhere else in PRISMA PM. Reference codes (for example requisition codes) are sent as typed. Please avoid writing confidential details into free-text fields.

What the AI provider does with it. Once data reaches the assistant you chose, it is handled by that provider (for example Anthropic or OpenAI) under its own privacy policy and terms, which we do not control.

What we log. Our connector logs your user id, the time and the name of the tool called. It does not log the content of requests or the data returned.

Our web application, database and connector server run in Brazil (São Paulo: Supabase sa-east-1 and Vercel gru1). The following providers process data outside Brazil, so using PRISMA PM involves an international transfer of personal data:

• Cloudflare R2 (Eastern North America, United States): uploaded documents and encrypted database backups.
• Resend (United States): invitation emails and their delivery logs, whichever sending region is used.
• OpenAI: only when you use "Import with AI"; the provider may process data outside Brazil.
• The AI assistant you connect (for example Anthropic or OpenAI), at your choice and under its own terms.

Where the law requires it, we rely on safeguards for these transfers, such as standard contractual clauses.

• Account data and organization content are kept while the account is active.
• When an account or organization is deleted, its data is removed from live systems. Copies in encrypted backups expire as backups rotate (retention: 30 days).
• Technical logs are kept only as long as needed for security and troubleshooting.
• Some records may be kept longer where the law requires it.

• Traffic is encrypted in transit (HTTPS).
• Each organization's data is isolated by database row-level security, and access within an organization is based on roles and project membership.
• Uploaded documents are kept in private storage and opened only through short-lived signed links.
• Database backups are encrypted.
• The AI connector works under your own permissions and holds no administrative database key.

No system is perfectly secure. If you suspect a problem, tell us at contato@dontscroll.agency. If a breach affects your data, we will notify you as the law requires.

Depending on where you live (for example under the GDPR or Brazil's LGPD), you can ask to access, correct, delete, export or restrict the use of your personal data, to object to processing, and to withdraw consent. Write to contato@dontscroll.agency and we will answer within the time the law requires. You can also complain to your local data protection authority.

Some things you can do yourself in the app, such as updating your name and preferences and disconnecting AI assistants. For data inside an organization's account, see section 4.

PRISMA PM is for business use by adults and is not directed to children under 18.

We may update this policy. We will post the new version here with a new date and, for material changes, notify you by email or in the app.

Don’t Scroll Soluções em Tecnologia e Comunicação Ltda, CNPJ 66.282.029/0001-11, Aracaju, Sergipe, Brazil. Email: contato@dontscroll.agency.