Privacy and Data Policy

Prism is operated by Templeton-Smith Ltd, a company registered in England and Wales under company number 14618653. Where this policy says "we" or "Prism", it means that company. There are two kinds of account, and who is responsible for your data depends on which you hold.

If you are a member of a photography club that uses Prism (most people): Prism is competition management software provided to your club. In data protection law your club is the "data controller" (it decides what data is collected and why) and Prism acts as the "data processor" (it processes that data on the club's behalf under instruction). For questions about your personal data, contact your club's designated data officer or administrator.

If you hold an independent portfolio account (you belong to no club, and signed up at prismphoto.club/portfolios): there is no club, so the arrangement above does not apply to you. Templeton-Smith Ltd is the data controller for your account, and you deal with us directly rather than through a club.

For any question about how Prism handles data, or to exercise the rights described below, contact: prism@templeton-smith.com

Who is responsible. For an independent account Templeton-Smith Ltd is the data controller. For a club member's portfolio the club remains the controller for their membership and competition data, while the portfolio itself is published at the member's own choosing.

What we hold for an independent account. The name you chose to show on your portfolio, your email address, your password (stored only as a hash, by our authentication provider), the photographs you upload and anything you write alongside them - titles, captions, alternative text and your biography - plus the dates your account was created and activated, the offer it was opened under, and a record of which version of our Terms of Service and Content Standards you accepted and when.

Why, and on what lawful basis.

• To give you the account and publish the portfolio you asked for - performance of our contract with you.
• To send you service email: address verification, password resets, and notices about your account or the terms. Verification and password email is part of the contract; notices about changes are our legitimate interest in keeping you informed.
• To keep the service secure and deal with abuse reports - our legitimate interests in protecting the service and the people in it.
• To respond to reports of illegal or prohibited content, and to keep records of that - our legal obligations.

What becomes public, and how public. A portfolio you set to Public is visible to anyone on the internet at your chosen address, with no sign-in: your display name, biography, photographs, any titles and captions you show, your club name if you have chosen to show it, and any social or website links you add. Search engines and social networks may index it, copy it into previews, and keep those copies for a time after you change or remove it - that is outside our control. A portfolio set to Link only is not listed by us, but anyone holding the address can open it. A Draft portfolio is not published at all.

Who processes it for us. This is the full list, taken from what Prism is actually configured to use:

• Supabase - database, sign-in and file storage. Stored in the London region (eu-west-2).
• Vercel - hosting and the code that runs the site. Served from the London region (lhr1).
• Resend - sending the emails described above.
• Anthropic - only if your club has switched on searchable AI tags, which is off unless a club enables it. A reduced copy of a club photograph (768 px, not the stored original, which is never altered) is sent to be given content tags. Independent portfolio accounts are never sent to Anthropic for tagging at all. Separately, your messages are sent if you use the in-app help assistant. Anthropic states that commercial API inputs and outputs are not used to train its models by default, and normally retains them for up to 30 days, subject to its documented exceptions.
• Vercel Analytics - counting page views. Cookieless; see Cookies below.

They process data on our instructions and not for their own purposes. We do not sell your data, licence your photographs to anyone for any purpose unrelated to running Prism, or use them to train AI models ourselves.

How long we keep it. Your account and photographs are kept while your account is open. Reaching the end of a free period does not delete anything by itself.

How to close your account. Email prism@templeton-smith.com and say you want your account closed. That address is monitored and is the same one used for every other data request in this policy. You can also unpublish or delete your portfolio yourself at any time from your account, without closing anything.

When an account is closed, by you or by us, the portfolio stops being available straight away, and we delete your account content within 30 days. Two exceptions: copies inside routine backups disappear as those backups age out on their normal cycle, and we keep anything the law requires us to keep for as long as it requires.

Your rights. You can ask for a copy of your data, ask us to correct it, ask us to delete it, object to or restrict how we use it, and ask for it in a portable form. Write to prism@templeton-smith.com and we will handle the request; this does not depend on any feature being built, and you do not need one to exercise these rights. If you are not satisfied you can complain to the Information Commissioner's Office at ico.org.uk.

Separately from that, you can unpublish or delete your portfolio yourself at any time from your account, and you can download your image files from My Images. That download is a convenience, not a data-rights process and not a backup: it contains the image files only, without titles, captions, collections or the rest of your portfolio's detail.

Age. An independent portfolio account is for adults: you must be 18 or over to open one, and you confirm that when you register. Younger members of a club that uses Prism are welcome through the account their club creates and manages for them. We do not carry out identity or age verification.

Prism stores only the minimum information necessary to run a photographic club's competitions:

• Your name (first and last name as provided to the club).
• Your email address, used for your Prism login and club communications.
• Your competition class (grade), such as Advanced, Intermediate, or Club - per discipline.
• Your competition entries: image files you upload, entry titles, and any photographer's statement you choose to add.
• Your competition scores and results, once judging is complete.
• Your member bank images, if you choose to upload a personal image library.
• A record of your competition entry history and season standings.
• Anything you type into the in-app help assistant or a bug report, and the reply, kept so the conversation can be continued and so a reported problem can be investigated.

The legal basis for processing your data is "legitimate interests" of the club in administering its competitions, and the performance of an agreement (your club membership). Specifically:

• Name and email: to identify you as a member and provide access to the platform.
• Competition entries and images: to run the competition night and display your work.
• Scores and results: to calculate standings, award prizes, and maintain the club's historical record.
• Grade/class: to ensure entries are judged against the correct category.

Personal data is retained for the duration of your club membership and for a reasonable period afterwards to maintain the club's historical records. Competition results (scores and placings) may be retained indefinitely as part of the club's official records, but personal identifiers (name, email) may be anonymised or removed at your request.

What a deletion leaves behind, so there is no surprise in it. When your data is deleted, your past entries stay in the club's records with their titles blanked and no name attached, so season standings and series totals still add up. Results already sent to an outside body are anonymised rather than withdrawn, because they form part of that body's records and not ours. And the club's audit log keeps one entry naming who was deleted, when, and which administrator did it: a deletion that left no record of having happened could not be shown to have happened, and that entry is the evidence it was carried out. Nothing else of yours is kept.

You have the right to:

• Access: request a copy of the personal data held about you.
• Rectification: ask us to correct inaccurate data.
• Erasure: ask us to delete your personal data (subject to the club's legitimate interest in retaining historical competition records).
• Restriction: ask us to limit how we use your data while a dispute is being resolved.
• Portability: receive your data in a machine-readable format.
• Objection: object to processing based on legitimate interests.

To exercise any of these rights, contact your club administrator or email prism@templeton-smith.com. We will respond within one calendar month.

A judge is not a club member and has no membership record. When a club invites you to judge through Prism we hold your name and email address, the invitation itself and when it expires, and the scores and any written critique you give. The club that invited you is the data controller for that; Prism processes it on the club's instruction, exactly as for its members.

It is held so the club can run the competition, publish its results and keep its historical record, which is the club's legitimate interest in administering its own programme. Your scores and critiques stay attached to the competition record afterwards, because they are the result. Your name and email can be removed on request without disturbing that: write to the club that invited you, or to prism@templeton-smith.com, and the rights set out above apply to you in the same way.

All data is encrypted in transit using TLS and at rest using industry-standard encryption. Access is restricted by role - regular members can only see their own data. Two-factor authentication is available on every account and strongly recommended for administrators. For a full description of our security measures, see the Security Overview.

We do not sell, rent, or share your personal data with any third party for commercial purposes. Data may be shared in the following limited circumstances:

• With the club's own committee and administrators, who need it to run competitions.
• With competition results published to external bodies (e.g. federation competitions) - only with your knowledge and as part of the normal competition entry process.
• If required by law or a court order.

Prism uses a single session cookie to keep you logged in. No advertising or tracking cookies are used, and no analytics cookies are set. The session cookie is deleted when you log out or after a period of inactivity.

We use Vercel Analytics to count page views. It sets no cookies and stores nothing on your device: visitors are counted using a hash that is discarded after 24 hours, and the figures are aggregated and cannot identify you. Because nothing is stored on your device, it needs no consent banner.

To raise any concern about how your data is handled, contact prism@templeton-smith.com. If you are not satisfied with our response, you have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk or by telephone on 0303 123 1113.