Privacy Policy
Version 2.2 · Effective October 4, 2026 · Prysm Solutions Co., a trade name of Malandros LLC
This policy explains what Prysm collects, why, who we share it with, and the choices you have. It covers two groups of people: merchants who use Prysm to accept payments, and customers who pay a Prysm merchant.
1. If you are a merchant
We collect:
- Account and business information you give us: your name, email, phone, business name, address, tax ID, website, incorporation date, expected volume, and current processor.
- Owner and identity information required by law to verify your business (Know Your Customer and anti-money-laundering rules): the names, dates of birth, addresses, ownership percentages, and government ID details of beneficial owners. Where a Processor collects this directly in its hosted form, Prysm does not see the document itself.
- Bank account details for payouts.
- Transaction data: amounts, dates, card brand and funding type, last four digits, fees, refunds, disputes, and settlement records.
- Technical data: IP address, device and browser information, and logs of your use of the dashboard and API, used for security and fraud prevention.
2. If you are a merchant's customer
When you pay a Prysm merchant at their counter, we process the order details (items, amount, any surcharge or tip) and, if you provide it, your email address, used only to send your receipt or order confirmation. Your full card number never touches Prysm's servers. Card details are encrypted and tokenized in your browser or the merchant's device by our PCI DSS Level 1 certified Processors. We receive only the card brand, funding type, and last four digits. The merchant you paid controls how your order information is used; contact them for questions about their practices.
3. How we use information
- To open and verify merchant accounts and process payments, refunds, payouts, and disputes.
- To detect and prevent fraud, abuse, and security incidents, and to enforce our Terms.
- To meet legal, tax (including 1099-K reporting), card-network, and Processor obligations.
- To provide support and send service notices (fee changes, downtime, compliance requirements).
- To improve the platform using aggregated or de-identified data.
4. Who we share information with
We do not sell personal information. We share it only with:
- Payment processors and their sponsor banks — Finix Payments, Inc. (Finix privacy policy) — which underwrite merchants, authorize and settle payments, and handle disputes. Merchant and owner information is shared with them for underwriting and may be shared onward with their processors, sponsor banks, and the card networks as their policies describe. The Processors act as independent controllers of the data they collect through their own forms and terms.
- Stripe, Inc. (legacy only) — for sales processed through Stripe before September 2026, we still exchange data with Stripe to complete refunds, receive status updates, and keep required records; for accounts opened before then, the register may also load Stripe's payment script (Stripe privacy policy). New sales are processed by Finix only.
- Card networks (Visa, Mastercard, Discover, American Express) as required by their rules, including for account-updater services and dispute handling.
- Identity-verification, fraud-prevention, and infrastructure vendors (hosting, database, email delivery) who process data only on our instructions.
- Law enforcement, regulators, or courts when legally required, or to protect the rights and safety of Prysm, our merchants, or the public.
- A successor in a merger, acquisition, or sale of assets, under the same protections.
5. Data ownership and retention
Merchants own their business and transaction data. We keep account and transaction records for as long as your account is open and afterwards only as long as tax, card-network, anti-money-laundering, and dispute rules require, then delete or anonymize them. A deletion request (Section 7) is honored for everything outside those required records. Customer email addresses used for receipts are kept with the transaction record. Processors retain data under their own policies.
6. Security
All data is encrypted in transit (TLS) and at rest. Card data is tokenized by our Processors before it reaches us. Access to production data is limited to authorized personnel and logged. No system is perfectly secure; if we learn of a breach affecting your data we will notify you as required by law.
7. Your choices and rights
- Access and correction: merchants can view and update most account data in the dashboard; email us for anything else.
- Deletion: you may request deletion of your data. We will honor it except where we must retain records for legal, tax, dispute, or fraud-prevention reasons.
- Marketing: you can opt out of marketing email at any time; service notices cannot be opted out of while your account is open.
8. California residents
Under the California Consumer Privacy Act you have the right to know what personal information we collect and how we use and share it, to request deletion, to correct inaccurate information, and not to be discriminated against for exercising these rights. We do not sell or share personal information for cross-context behavioral advertising. To exercise your rights, email privacy@prysmsolutions.io; we will verify your identity and respond. An authorized agent may submit a request on your behalf with your written permission.
9. Cookies
We use only strictly necessary cookies and browser storage: to keep you signed in, to protect forms against forgery, and to remember dashboard preferences. We do not use advertising or cross-site tracking cookies.
10. Children
Prysm is a business service and is not directed to anyone under 18. We do not knowingly collect information from minors.
11. Changes
We will post any update here with a new version and effective date. The current version is always shown at the top of this page.
12. Contact
Prysm Solutions Co. (Malandros LLC) · privacy@prysmsolutions.io · support@prysmsolutions.io · Merchant Terms of Service