Privacy Policy

Last updated: 15 October 2026

Summary: we collect only what we need to deliver your assessment, we use an LLM provider that doesn't train on your data, and we delete your intake materials 30 days after delivery.

1. Who we are

ActPrism ("we", "us") is operated by Eric Phan and provides EU AI Act readiness assessments. Contact: eric@actprism.com. We are the controller for the personal data described here.

2. What we collect

Contact and booking details: name, work email, company, role, and anything you add when booking a call.
Intake information: your questionnaire answers and any documents you upload about your company, products and AI systems. Please don't include personal data about your own end-users or candidates unless it is needed.
Billing information: company name, address, and payment and invoice records. Card details go straight to the payment processor; we never see them.
Website data: this site uses no advertising or tracking cookies. Our hosting provider may keep standard server logs (e.g. IP address, browser type) for security.

3. How we use it

To schedule calls, deliver your assessment, and answer your questions (performance of a contract or steps before entering one).
To invoice you and meet tax and accounting obligations (legal obligation).
To send occasional, relevant business emails to prospective clients, which you can opt out of at any time (legitimate interests).

We do not sell your data or use it for advertising.

4. AI processing

We draft reports with a commercial large-language-model API. We use it under terms where the provider does not use your inputs or outputs to train its models. Every report is reviewed by a human before delivery. We do not make automated decisions about you that have legal or similarly significant effects.

5. Service providers

We share data only with providers that help us run the service, and only as needed: scheduling (Cal.com), forms (Tally), payments and invoicing (e.g. Stripe), email hosting, website hosting (Carrd), and our LLM API provider. Some are based outside the EU/EEA (e.g. in the United States). Where required, transfers rely on appropriate safeguards such as the EU Standard Contractual Clauses or an adequacy decision.

6. Retention

Intake answers, uploaded documents and working drafts: deleted 30 days after report delivery.
Final report: we keep a copy so we can handle re-assessments and questions, unless you ask us to delete it.
Billing records: kept as long as tax law requires.
Prospect contact details: deleted when you ask, or after 24 months without contact.

7. Confidentiality and security

We treat client materials as confidential, limit access to the person delivering your assessment, and use reputable providers with encryption in transit. We're happy to sign your NDA (or provide ours) before you share anything.

8. Your rights

Depending on where you are (for example under the GDPR or UK GDPR), you may have the right to access, correct, delete, restrict or port your personal data, and to object to processing, including direct marketing. Email eric@actprism.com and we will respond within 30 days. You can also complain to your local data protection authority.

9. Changes

We may update this policy. The "last updated" date shows the current version.