Privacy Policy

This policy explains how TinyUniverse handles information for PrismTest, including chat analysis, payments, retention, deletion and your rights.

Last updated · November 4, 2026

1. Operator and privacy contact

Operator: TinyUniverse (Sole Proprietorship). Country: Republic of Korea.

Address: 1F, 33 Hyeonggok-ro, Gumi-si, Gyeongsangbuk-do 39291, Republic of Korea.

Privacy enquiries, complaints and rights requests: privacy@prismtest.app.

2. Information we handle

Public content may be viewed without an account. Storing chat analysis material requires email verification. We receive information through your use of features, authentication, payment notifications, enquiries and technical records.

Account and authentication: email, account ID, registration details such as display name, verification and session records, accepted terms version and time.
Analysis material: excerpts selected on your device from particular moments or scenes, participant labels, timestamps, aggregate metrics, participant selection, relationship, language and cultural settings, and submitted file metadata.
Results: preview and paid reports, their quotes, summaries and analysis, report IDs and generation status.
Purchases and support: product, order, payment, refund and access identifiers and status; necessary buyer email, amounts, taxes, dates, and support correspondence. Payment details are processed through Polar and its payment processors.
Technical and measurement data: IP address, browser and device data, pages, events, referral sources, cookies and online identifiers, security, authentication and error records.
Other features: answers, execution IDs and results for a test that stores data, and feature-specific inputs disclosed before use. The Saju 2027 launch alert collects an opted-in email and consent version and time.

3. Local processing and other participants

Your original conversation file is read and filtered in your browser. Only selected excerpts and relevant analysis material are submitted; the complete original file is not uploaded for server storage. Local masking covers detected patterns and does not guarantee anonymity. Excerpts may still contain other people’s messages and personal information.

Only submit information you are entitled to provide. Remove unnecessary real names, contact details, identity numbers and sensitive information, such as health data. Other participants can contact us about their information. Your confirmation does not remove our own legal duties.

4. Purposes and legal grounds

We use information to generate, deliver and reopen requested reports; manage authentication and accounts and send report-completion notices; verify purchases and handle refunds and support; protect the service; measure usage and advertising; and meet legal obligations. Where applicable, processing relies on a valid basis such as consent, performance of a contract, compliance with law, or a legitimate interest where legally available and appropriate. Separate consent is requested where required; this policy is not blanket consent.

We do not sell conversations or reports. We do not use them to train AI models or provide them for that purpose. Running GPT to generate your requested report is distinct from training. External processors’ retention depends on the actual route, contract and settings.

5. Retention and deletion

Selected excerpts, metrics and other analysis material have a retention period of seven days from their first server storage. A purchase or additional report does not restart that deadline. After expiry, material reads and further generation stop; a cleanup task runs every five minutes to delete server material and intermediate generation records.

Finished preview and paid reports are stored independently in Supabase until you delete them. Quotes, summaries and analysis included in a report remain with that report after the source material is deleted. We email a completion notice and viewing link to the verified account; minimal delivery status, times and message IDs are retained for up to 90 days. Emails contain no conversation or analysis text.

Use Storage and deletion on the report screen, signed in to the account that created it, to delete analysis material or the report. Deleting only material preserves finished reports but prevents further analysis. If the same material is linked to another report, we unlink this report and apply the original deadline to any remaining material. Contact privacy@prismtest.app for account-wide erasure and other requests.

Erasure removes content and links from the operational database and objects from private storage. Minimal material-deletion records are retained for 24 hours to retry failed erasure and prevent late uploads from restoring content. Minimal report-deletion identifiers are kept as needed to prevent restoration. Cleanup and legacy report archival failures are retried and require recovery. Recovery copies or backups, where present, are not reused for other purposes and expire under their respective deletion cycles. Deletion from our servers does not remove copies already saved on a device or by someone else.

We retain account and security information only as needed to provide and protect accounts, and support records as needed to resolve requests or disputes. Transaction records subject to legal retention are kept separately for the period actually required by applicable law. Our seven-day rule does not promise that independent AI, payment or analytics provider records are all erased within seven days.

Other tests follow the retention disclosed before use. Tests that do not store answers process them only during the calculation request. Saju 2027 alert emails are retained until January 31, 2027, or deleted immediately after sending the alert; you may request earlier withdrawal or erasure.

6. Services and recipients

Providers receive only information needed for their role. We distinguish processors from independent recipients and apply the contracts, supervision, notices and consents required by applicable law.

Supabase: finished chat reports and user data for other supported features.
Cloudflare: hosting, CDN, security, account and authentication data, purchase and generation status, temporary selected material in D1/R2, GPT request routing, and verification/completion email and Turnstile for supported features.
OpenAI GPT: generating reports from selected excerpts, metrics and settings. GPT is our only external AI model provider.
Google Analytics 4 and Google Tag Manager: usage measurement. Meta Pixel and Conversions API: advertising referrals and purchase conversions.
Polar: purchases, taxes, receipts, payment confirmation and refunds. Its payment processors include Stripe; this does not mean PrismTest integrates directly with Stripe.

7. Payments

Polar Software, Inc. acts as merchant of record and reseller under the terms applicable to your purchase. PrismTest’s terms govern use and delivery of the product; Polar’s buyer terms also govern checkout and related payment services. Check the final price, taxes and available payment methods before paying.

We send and receive identifiers and purchase details needed to link a transaction to a report and verify access. Do not send full card numbers or security codes in analysis inputs or support messages. Deleting data and requesting a cancellation or refund are separate procedures; statutory rights remain available.

8. International processing and transfer details

TinyUniverse operates the service from South Korea. Information submitted from Japan or elsewhere may be stored, processed or accessed by the operator in Korea and by the services below. Transfers occur as needed when you use the service, request storage or generation, authenticate, make a purchase, or enable optional measurement.

A recipient’s domicile is distinct from its storage, processing and support-access locations. We distinguish verified storage from the provider’s published processing scope below. Global processing locations vary with routing, support needs and subprocessors, so we cannot identify one country for every operation. Linked official documents provide information about countries, subprocessors, safeguards and contact channels.

8.1 Supabase — finished report storage

Recipient and contact: Supabase Pte. Ltd.; its US affiliate Supabase, Inc. may provide necessary support and operations. Privacy contact: privacy@supabase.io.
Domicile, storage and processing countries: Processor domicile: Singapore. The connected PrismTest database uses South Korea (ap-northeast-2). Supabase states that databases and backups stay in the selected region, with necessary support access outside it, possible US affiliate involvement and operational logs in EU data centers.
Data: Finished reports, their quotes, summaries and analysis, owner, report and stage IDs; other stored features handle their disclosed data and necessary operational settings.
Purpose and role: Processing on the operator’s behalf: database storage, retrieval, report reopening, recovery and security.
When and how: On report completion, access, deletion and necessary operations, through protected database connections routed via Cloudflare.
Retention: Finished reports remain until user deletion. Backup expiry depends on the actual project plan. Supabase’s published project-deletion period of up to 30 days is distinct from deleting an individual report.
Safeguards and conditions: The public DPA provides purpose and access limits, confidentiality, subprocessor obligations and applicable transfer safeguards. Regional hosting does not confine all support access to Korea.

8.2 Cloudflare — hosting, authentication, temporary storage and AI routing

Recipient and contact: Cloudflare, Inc., with necessary affiliates and published subprocessors. Privacy contact: dpo@cloudflare.com.
Domicile, storage and processing countries: US-based global provider. Relevant information may be processed in network, support and subprocessor locations including Korea, Japan, the US and the EEA. The app’s Korea placement setting does not fix every D1/R2, email, security or AI-routing location to Korea.
Data: IP, browser and security signals, email, verification/completion messages and report viewing links, account, session and acceptance records, order and generation status, selected excerpts and metrics, AI requests and responses, necessary operational metadata.
Purpose and role: Hosting, CDN, security, authentication and email delivery, temporary D1/R2 material storage, Supabase connectivity and OpenAI request routing.
When and how: During visits, authentication, uploads, analysis, report completion and purchase checks, by encrypted browser or server communications. Email also passes to the recipient’s mail provider.
Retention: PrismTest-managed material and intermediate records follow the seven-day rule. Account, transaction and security metadata follow their respective purposes. Cloudflare body logging and response caching are disabled for GPT calls; independent service and security records do not all expire in seven days.
Safeguards and conditions: The published DPA and subprocessor list describe purpose limits, subprocessor duties and applicable transfer safeguards. Disabling gateway logs does not eliminate OpenAI retention.

8.3 OpenAI GPT — requested analysis and report generation

Recipient and contact: The OpenAI GPT API provider; Cloudflare’s published AI Gateway subprocessor list names OpenAI, Inc. We use our own OpenAI API key. Requests may be sent to privacy@prismtest.app for coordination with the relevant processor.
Domicile, storage and processing countries: Processing may involve the US-based provider and its published global infrastructure and subprocessors. This integration does not specify a Japan-only storage or inference region; processing exclusively in Japan or Korea is not guaranteed.
Data: Selected excerpts, necessary participant labels, timestamps, metrics, relationship and language settings, and generated output. The complete original conversation file is not sent to GPT.
Purpose and role: Generating requested free and paid analysis and reports, rather than advertising targeting or training our own AI.
When and how: For generation and bounded correction attempts, via encrypted server requests through Cloudflare AI Gateway to OpenAI’s API.
Retention: OpenAI’s standard API policy generally retains abuse-monitoring logs for up to 30 days, with legal or safety exceptions. Separate ZDR approval for our own-key route has not been verified, so we do not promise zero retention. Our server’s seven-day rule is separate.
Safeguards and conditions: OpenAI states that API data is not used for training by default unless sharing is explicitly enabled. Gateway logging controls are distinct from OpenAI retention and regional settings.

8.4 Polar — purchases, payments, tax and refunds

Recipient and contact: Polar Software, Inc. Its privacy policy below provides rights and contact channels. Polar’s payment processors may include Stripe.
Domicile, storage and processing countries: US-based merchant of record and reseller. Polar discloses potential transfers to the US, Canada and other processing destinations; processor locations depend on payment method and transaction routing.
Data: Product and report-linking IDs, return address and order settings from PrismTest; buyer-provided checkout email, billing and payment information; necessary order, amount, tax, payment and refund status received by us.
Purpose and role: Polar independently handles the purchase, payment, tax, receipt and refund functions. PrismTest uses necessary information to verify purchases and provide report access.
When and how: During checkout creation, payment, status queries and refund notifications, through protected checkout, APIs and signature-verified webhooks.
Retention: As needed for purchase and payment services and applicable tax, accounting and dispute-resolution obligations. Required transaction records may remain after an erasure request.
Safeguards and conditions: Polar’s buyer terms, privacy policy and payment-provider safeguards apply. Full card numbers and security codes are not analysis inputs. Data erasure and refunds are separate processes.

8.5 Google Analytics 4 and Google Tag Manager — usage measurement

Recipient and contact: Google LLC. Official privacy contact channels, rights procedures and service terms are linked below.
Domicile, storage and processing countries: US-based provider with global servers and subprocessors. Google discloses that processing may occur outside your country of residence.
Data: Normalized paths, events, referral, device and browser data, cookies and online identifiers, and connection information such as IP. Application events are restricted to avoid chat text, email and report-access identifiers.
Purpose and role: Visit, usage-funnel and conversion measurement. Our code sets Google advertising-storage, advertising-user-data and personalized-ad consent signals to denied.
When and how: HTTPS requests from the browser on pages and events permitted by the regional consent and rejection settings.
Retention: GA4 settings checked November 4, 2026: event data two months; user data fourteen months; user retention resets on new activity. This does not set an expiry for all standard aggregate reports. Automatic deletion cycles and legal or security exceptions may also apply.
Safeguards and conditions: Google Analytics processing terms and Google’s international-transfer and security disclosures apply. Rejecting optional measurement does not prevent basic service use. Separate advertising uses require their own notice and valid basis.

8.6 Meta Pixel — advertising referrals and conversions

Recipient and contact: The provider under the applicable Meta Business Tools terms. Principal entities include Meta Platforms, Inc. (US) and, where applicable, Meta Platforms Ireland Limited (Ireland). See Meta’s privacy policy for contact channels.
Domicile, storage and processing countries: Potential processing in the US, Ireland and other Meta data-center or subprocessor locations. The exact contracting entity, retention and transfer conditions for our advertising account still require confirmation.
Data: Measured visits, events, referrals, cookies and online identifiers, browser, device and connection data such as IP. Chat text, report content and analysis inputs are not intended Pixel data.
Purpose and role: Advertising referrals, conversions and performance measurement. Google consent-mode signals alone do not automatically control Meta processing.
When and how: Encrypted browser requests when optional measurement is permitted and the relevant GTM Pixel tag runs. The published GTM container currently includes Meta script code.
Retention: Meta’s purpose-specific retention and erasure procedures apply, depending on account, security and legal requirements. We do not promise an unverified fixed number of years.
Safeguards and conditions: Applicable Meta Business Tools terms and privacy policy govern processing. Contact privacy@prismtest.app for rejection, withdrawal and information requests. Required specific consent and transfer grounds must be distinguished from accepting general terms.

8.7 Transfer grounds, protections and your choices

Where Korean law applies, outsourcing or storage necessary to enter into or perform a contract with the individual must satisfy the applicable requirements, including disclosure requirements under Article 28-8(1)(3) of Korea’s Personal Information Protection Act. Advertising disclosures, another person’s data where that person is not the contracting individual, and processing outside that ground require a separate valid basis and any necessary consent.

Where Japan’s foreign-third-party rules apply, required advance information and consent, or another recognized basis such as continuously maintained equivalent safeguards, must be established separately. Recipient-country protections may differ from Japan or Korea. A provider’s DPA, SCCs or transfer policy alone neither establishes every transfer’s lawfulness nor constitutes your consent.

Contact privacy@prismtest.app for transfer information, objections or withdrawal where applicable. Stopping processing necessary for analysis, authentication, storage or payment may prevent the relevant feature. Rejecting optional measurement does not prevent basic content or report use. We explain the basis and scope of any legally required records retained after a restriction or erasure request.

9. Cookies and measurement

GA4 and Meta Pixel measure pages, events, referrals, identifiers and connection information according to their settings. Application measurement events are restricted to avoid conversation text, answers, email and report access identifiers.

When optional measurement is permitted, our server may send verified purchases and refunds to GA4, and purchase value, currency, advertising click and browser identifiers and campaign labels to Meta Conversions API. Deduplication identifiers do not grant report access. Our attribution and delivery records are retained for up to 90 days. We stop this server conversion measurement after an opt-out or a detected GPC or Do Not Track signal.

Optional measurement currently waits for opt-in in the EEA, UK and Switzerland. In other regions it is enabled by default unless rejected. The first-party pt_analytics_consent cookie remembers the choice for 180 days. Deleting the cookie resets the choice and is not an opt-out where measurement defaults to enabled. You may use browser cookie and tracking controls or contact us with a request. Essential account and security processing is separate.

10. Rights and security

Contact privacy@prismtest.app to request access, correction, erasure, restriction or withdrawal of consent, or exercise other rights available under the law that applies to you, including portability and objections where applicable. We verify the minimum necessary information and respond within applicable deadlines, explaining any lawful refusal or retained records. Do not send passwords or one-time codes.

We use access controls, protected communications and private storage. Secret links and pseudonymous IDs are not anonymisation, and no online service guarantees absolute security. You may complain to the competent data protection authority in your jurisdiction.

11. Age and changes

Chat analysis is restricted to people aged 18 or older. Other content remains subject to its stated audience and applicable child-protection rules. Changes will be announced with an effective date and any notice or consent required by law.