Privacy Policy
Updated October 28, 2026
This policy explains what data PrismWave collects, why, who we share it with and how you can exercise your rights, under the Brazilian General Data Protection Law (LGPD, Law 13,709/2018). This English version is a courtesy translation; if the two differ, the Portuguese text prevails.
1. Who controls your data
The data controller is PrismWave, CNPJ (Brazilian company ID) 65.080.757/0001-88, based in Rio de Janeiro/RJ ("PrismWave", "we").
Our data protection contact (DPO) and the channel for any privacy request: support@prismwave.com.br.
2. What we do not collect
The audio, projects and videos you create in PrismWave are processed in your browser. They are not sent to our servers.
We also do not use advertising cookies or third-party behavior analytics.
3. What data we collect and why
| Data | Purpose | Legal basis (LGPD, art. 7) |
|---|---|---|
| Email and name (name only if you sign in with Google); chosen language | Create and identify your account, send the sign-in link and purchase notices | Performance of a contract (V) |
| Login session: session code (we store only its hash), expiry date and browser user-agent | Keep you signed in for up to 30 days and protect the account | Performance of a contract (V) and legitimate interest in security (IX) |
| Email sign-in link: code hash, email and 15-minute expiry | Passwordless sign-in | Performance of a contract (V) |
| Devices: random identifier generated in your browser, label, creation and last-use dates | Enforce the license limit of 3 devices and one session at a time | Performance of a contract (V) and legitimate interest (IX) |
| Purchase: amount, currency, status (paid, refunded, disputed), dates and payment identifier | Grant and keep the license, issue refunds, meet tax obligations | Performance of a contract (V) and legal obligation (II) |
| Technical access logs: IP address, date, page and errors generated by the infrastructure | Security, fraud and abuse prevention, diagnostics | Legitimate interest (IX) |
| Messages you send us (for example, to support) | Reply to you | Performance of a contract (V) and legitimate interest (IX) |
| Waitlist email, if you sign up | Tell you about news you asked for | Consent (I) |
4. Data that stays on your device
PrismWave stores in your browser (localStorage and cookies) your language, app preferences, a device identifier and a signed cache of your license, which is renewed every few minutes. These items are necessary for the app to work and to validate the license.
The cookies we use are strictly necessary (login session, license cache and login origin). That is why the site shows no cookie consent banner. If we ever use non-essential cookies, we will ask for your consent first.
You can delete this data in your browser settings. Without it you will need to sign in again.
5. Who we share data with
We share data only with those who need it for the service to work. These processors handle data on our behalf:
- Cloudflare, Inc.: hosting of the site and app, database, system email delivery and anti-bot verification (Turnstile).
- Google LLC: Google sign-in, when you choose it. We receive your email and name.
- AbacatePay: Pix and card payment processing in Brazil. Payment details are entered directly in its environment and do not pass through our servers. We receive only the payment confirmation and the purchase identifier.
- An international payment provider (for example, Stripe), when that payment method becomes available. We will update this policy before turning it on.
We do not sell your data. We may also disclose it when required by law or a court order.
6. International transfers
Our providers operate in several countries, including the United States. When your data is processed outside Brazil, it happens with the safeguards set out in art. 33 of the LGPD, such as standard contractual clauses and providers' compliance programs.
7. Sign in with Google
We use Google sign-in only to identify you, with the "openid", "email" and "profile" scopes. We do not access your Gmail, contacts, calendar, Drive or any other data in your Google account.
PrismWave's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
8. How long we keep data
- Account and license: while the account exists. You can ask for deletion at any time.
- Sessions: up to 30 days. Sign-in links: 15 minutes, then they are discarded.
- Purchase records: for the period required by tax and accounting law, even if you delete the account.
- Technical access logs: for as long as the infrastructure provider keeps them, for security and diagnostics.
9. Your rights
Under the LGPD (art. 18) you can request: confirmation that we process your data; access; correction; anonymization, blocking or deletion of unnecessary data; portability; information about who we share data with; withdrawal of consent; and deletion of data processed with consent.
To exercise any of them, write to support@prismwave.com.br. We reply within 15 days. If you think we did not solve it, you can file a complaint with the Brazilian data protection authority (ANPD).
10. Security
We use encrypted connections (HTTPS), store only hashes of session and sign-in codes, rate-limit login attempts, and keep payment data with the payment provider. No system is completely secure. If an incident creates a relevant risk for you, we will tell you and the ANPD, as the law requires.
11. Minors
PrismWave is not directed to anyone under 18. People under 18 may only buy with the participation of a legal guardian.
12. Changes to this policy
When we make a relevant change, we will notify you by email or inside the app and update the date at the top of this page.