← Back to home

Privacy Policy

Version 2026-07-26 · Effective as of the date above.

STS Automatic LLC, based in South Carolina, U.S.A., is the operator of the Prizm P.M. platform ("Prizm", "we", "us"). This Privacy Policy explains what personal information we collect, how we use and disclose it, and the choices you have. It applies to the Prizm P.M. website, applications, APIs, and related services (the "Service").

1. Information We Collect

  • Account information: name, email, hashed password, role (Landlord or Tenant), phone, and contact details you provide, plus your acceptance of our Terms and this Policy (with version and timestamp).
  • Property & lease information: property addresses, unit details, lease terms, tenant records, rent charges, autopay settings, maintenance requests, uploaded lease and property documents, and messaging within the Service (uploaded by Landlords and Tenants).
  • Payment information: payment-method identifiers, transaction amounts, surcharges, late fees, payout records, and Stripe account/connect identifiers. Full card numbers, full bank-account numbers, and Stripe-verification documents are handled by Stripe and are not stored on our servers.
  • Landlord Stripe Connect data: where a Landlord onboards for payouts, Stripe may collect identity, business, tax (e.g., SSN/EIN), and bank-account information directly; we receive limited status and reference identifiers from Stripe.
  • Communications: messages you send us, including support requests and emails to property@prizmbi.xyz.
  • Technical & usage data: IP address, browser and device information, log files, pages viewed, actions taken in the Service, and diagnostic error data.
  • Cookies & similar technologies: for authentication, session management, security, preferences, and limited analytics.

2. How We Use Information

  • to provide, secure, maintain, and improve the Service;
  • to process rent payments, autopay, late fees, surcharges, and payouts, and to prevent fraud;
  • to enable Landlords and Tenants to communicate, manage leases, and transact;
  • to send transactional messages (payment receipts, autopay notices, late-fee notices, maintenance updates, account notices);
  • to comply with legal, tax, and regulatory obligations and to enforce our Terms;
  • to record acceptance of legal terms (with version and timestamp) as evidence of agreement;
  • to analyze usage and improve product features.

We do not sell your personal information. We do not use your personal information to train third-party generative-AI models.

3. Our Role: Controller and Processor

For account, billing, security, and product-improvement data, we act as the controller (or "business"). For records a Landlord uploads or generates about their Tenants — leases, charges, notes, documents, and maintenance history — the Landlord is the controller and we act as a processor ("service provider"), processing that information only to provide the Service, on the Landlord's documented instructions, and as required by law. We do not sell, share for cross-context behavioral advertising, or retain such information for any purpose other than providing the Service.

4. Legal Bases (EEA/UK Users)

Where applicable, we process personal information based on (a) performance of a contract with you, (b) our legitimate interests in operating, securing, and improving the Service and preventing fraud, (c) compliance with legal obligations, or (d) your consent, which you may withdraw at any time without affecting prior processing.

5. How We Share Information

  • Between Landlord and Tenant. Information relevant to a lease is shared between the Landlord and their Tenants — for example, a Landlord can see rent charges, payments, autopay status, and maintenance requests for their Tenants; a Tenant can see their own lease, charges, receipts, and payment history. Landlord-only records, such as maintenance expense amounts, are not shown to Tenants.
  • Service providers (subprocessors). We share information with vendors that host and operate the Service on our behalf under written contracts limiting their use of it: Stripe (payment processing, Connect payouts, identity verification), our managed database, authentication, and storage infrastructure provider, transactional email providers, error-monitoring providers, and mapping and property-data providers. A current list is available on request.
  • Professional advisors. Auditors, accountants, and legal counsel bound by confidentiality.
  • Legal & safety. We may disclose information to comply with law, respond to lawful requests, protect our rights and users, and investigate fraud or security incidents. Where permitted, we will make reasonable efforts to notify the affected account holder.
  • Business transfers. In a merger, acquisition, financing, or sale of assets, information may be transferred subject to this Policy; we will notify you of any material change in control of your information.

We do not sell personal information, do not share it for cross-context behavioral advertising, and do not disclose it to data brokers.

6. Data Retention

We keep information only as long as needed for the purpose it was collected:

  • Account records: for the life of the account, then up to 90 days after deletion in backups.
  • Payment, payout, and tax records: typically at least seven (7) years, as required by tax, accounting, and payment-network rules.
  • Lease, charge, and maintenance records: for the life of the Landlord's account or until the Landlord deletes them, subject to legal holds.
  • Security and access logs: generally up to 12 months.
  • Legal-terms acceptance records: retained as evidence of agreement for the applicable limitations period.

You may request deletion of your account at any time by emailing property@prizmbi.xyz. Some records — including payment, payout, tax, and dispute records — may be retained where required by law, by our payment processor, or to resolve disputes and enforce our agreements.

7. Security

We use administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit (TLS) and at rest, row-level security in our database, hashed credentials, optional multi-factor authentication, least-privilege and role-based access controls, audit logging, and use of a PCI-DSS-compliant payment processor (Stripe) so that we do not store full card or bank-account numbers on our servers. We review access periodically and require confidentiality commitments from personnel and vendors. No method of transmission or storage is 100% secure; we cannot guarantee absolute security.

If we become aware of a breach of security affecting your personal information, we will notify you and any applicable regulator without undue delay and within the timeframes required by applicable law. Report suspected security issues to property@prizmbi.xyz.

8. Your Rights & Choices

Depending on where you live, you may have the right to:

  • know what personal information we collect, use, and disclose, and access a copy of it;
  • correct inaccurate personal information;
  • delete your personal information;
  • object to or restrict certain processing;
  • request portability of your information in a machine-readable format;
  • withdraw consent where processing is based on consent;
  • opt out of the sale or sharing of personal information (we do not sell or share);
  • appeal a denial of a privacy request;
  • not be discriminated or retaliated against for exercising these rights.

To exercise these rights, email property@prizmbi.xyz. We will acknowledge your request promptly and respond within 45 days (extendable by an additional 45 days with notice), or within one month for EEA/UK requests. We may need to verify your identity using information already associated with your account; we will not use verification information for any other purpose. An authorized agent may submit a request with written permission and proof of identity.

Appeals. If we deny your request, you may appeal by replying to our decision with the word "Appeal." We will respond in writing within 45 days with our reasoning and, where applicable, information on contacting your state attorney general or supervisory authority.

Tenant records. A Landlord is typically the controller of information about their Tenants; where we act only as processor, we will direct such requests to the applicable Landlord and assist them in responding.

9. U.S. State Privacy Rights

Residents of California, Colorado, Connecticut, Virginia, Texas, Oregon, Utah, and other states with comprehensive privacy laws have the rights described above. Under the CCPA/CPRA, in the past 12 months we have collected the categories of personal information described in Section 1 — identifiers, customer records, commercial information, internet/network activity, geolocation inferred from IP, and financial information — from you, your Landlord or Tenant, and our service providers, for the business purposes in Section 2, and disclosed them for business purposes to the service-provider categories in Section 5. We do not "sell" or "share" personal information as those terms are defined and do not knowingly process the personal information of consumers under 16 for such purposes. We use sensitive personal information (such as account credentials and financial account identifiers) only to provide the Service, secure accounts, and comply with law — never to infer characteristics.

10. Cookies, Analytics & Tracking Signals

We use strictly necessary cookies for authentication, session management, and security, plus limited preference and first-party analytics cookies. We do not use advertising or cross-site tracking cookies. You can block or delete cookies in your browser, though the Service may not function correctly without essential cookies. We honor Global Privacy Control (GPC) signals where legally required; because we do not sell or share personal information, no additional opt-out is necessary.

11. Automated Decision-Making

We do not use automated decision-making that produces legal or similarly significant effects about you without human involvement. Automated fraud and risk checks may flag transactions for review, but material actions such as account suspension involve human review, and you may contact us to contest an outcome.

12. International Transfers

We are based in the United States and process information there. If you access the Service from another country, your information will be transferred to and processed in the United States, which may have different data-protection laws. Where required, we use appropriate safeguards, such as the EU/UK standard contractual clauses, for cross-border transfers, and we make a copy available on request.

13. Children

The Service is not directed to children under 16, and we do not knowingly collect personal information from them. If you believe we have, contact us and we will delete it promptly.

14. Changes to This Policy

We may update this Policy from time to time. Material changes will be communicated by posting the updated Policy with a new version date and, when appropriate, by in-app notice or email at least ten (10) days before they take effect. Continued use after the effective date constitutes acceptance.

15. Contact

Prizm P.M. is owned and operated by STS Automatic LLC, based in South Carolina, U.S.A.. For questions about this Policy, to exercise your rights, or to reach our privacy contact, email property@prizmbi.xyz with "Privacy Request" in the subject line.