Privacy Policy

Last updated Jun 23, 2026

PRISM by Prism Talent Group

Effective Date: June 23, 2026
Last Updated: June 23, 2026

1. Introduction

Prism Talent Group (“Prism Talent Group,” “we,” “us,” or “our”) operates the PRISM Talent Group staffing platform, including the PRISM mobile application (the “App”), the web-based employee and client portals, and all related services (collectively, the “Services”). This Privacy Policy explains how we collect, use, disclose, retain, and protect your personal information when you use our Services, and describes the rights you have with respect to your data.

By creating an account or using the Services, you acknowledge that you have read, understood, and agree to the practices described in this Privacy Policy. If you do not agree, please discontinue use of the Services and contact us to request deletion of any data we have collected.

This Privacy Policy applies to:

Employees / Workers — individuals who register as workers seeking staffing placements
Clients — employer companies and their designated contacts
Administrators — Prism Talent Group internal staff

2. Information We Collect

We collect information you provide directly, information generated through your use of the Services, and information from third-party integrations.

2.1 Identity and Contact Information

Full legal name (first name, last name)
Email address
Phone number
Home address (street address, city, state, ZIP code)
Date of birth
Gender
Profile photograph

2.2 Employment and Tax Information

For employees/workers, we collect information necessary to process employment, payroll, and tax compliance, including:

Social Security Number (SSN) — required for payroll tax reporting and identity verification
Federal W-4 data: filing status, number of dependents, other income, deductions, additional withholding amounts
State DE-4 data (where applicable): filing status, withholding allowances
Federal I-9 data: citizenship or immigration status, acceptable identity and work authorization documents (document types, numbers, expiration dates), alien registration number, I-94 number, and foreign passport information
Hire date and rehire date
Payroll ID and payroll integration identifier (ADP employee ID)
Background check date and status
Work authorization expiration date

2.3 Professional Information

Resume and work history (uploaded documents and extracted text)
Professional certifications (certification name, issuing body, certificate number, issue date, expiration date)
Position applications and experience level (self-reported and AI-evaluated)
Interview notes recorded by Prism Talent Group staff

2.4 Identity Documents

Government-issued photo identification (e.g., driver’s license, passport, state ID)
Work authorization documents
Certification documents

We collect these documents to comply with federal I-9 employment eligibility requirements and to verify credentials.

2.5 Work Assignment and Schedule Data

Shift preferences, applications, and confirmations
Assigned events, venues, and positions
Work start and end times (scheduled and actual)
Meal break times
Timesheet data (hours worked, billing hours, break records)
Timesheet disputes and resolutions
No-show and cancellation records
Sick pay requests and approvals

2.6 Financial and Compensation Data

Pay rates (hourly), billing rates, and markup rates
Meal period premiums
Sent-home guarantee hours and pay
Sick pay accrual and approved amounts
Reimbursements for certifications

2.7 Communications

In-app messages between employees and administrators, including shift-specific and timesheet-related context
Notification preferences and acknowledgment status

2.8 Account and Security Data

Account credentials (passwords are stored only as cryptographic hashes using PBKDF2 and are never stored or transmitted in plain text)
Session tokens and JWT authentication tokens
Email verification tokens
Password reset tokens and expiration timestamps
Terms and Conditions acceptance timestamp and last-viewed timestamp

2.9 Device and Technical Information

When you use the PRISM mobile application, we may collect:

Push notification tokens — a device-generated identifier (Expo Push Token) used to deliver notifications to your device
Device platform — iOS or Android, used to format push notifications correctly
Last-seen timestamp for device tokens
IP address (collected by our hosting infrastructure)
App version and operating system version (may be collected by error monitoring services)

We do not collect precise GPS location, Bluetooth identifiers, microphone data, camera data (beyond photos you voluntarily upload), or contact lists.

2.10 Information Collected About Client Company Contacts

For client company users and contacts, we collect:

Company name, industry, and operational details
Contact name, phone number, email address, and contact role (e.g., Accounts Payable, Site Contact)
Location/venue addresses and operational notes (parking, check-in instructions)

3. How We Use Your Information

We use collected information for the following purposes:

3.1 Providing the Services

Creating and managing your account
Matching workers to available shifts and events
Processing shift applications, confirmations, and cancellations
Recording and processing timesheets
Communicating shift details, schedule changes, and timesheet updates
Processing sick pay requests
Verifying employment eligibility and identity

3.2 Payroll and Tax Compliance

Generating and maintaining payroll records
Transmitting employment and earnings data to our payroll processor (ADP)
Ensuring compliance with federal and state withholding requirements (W-4, DE-4)
Fulfilling I-9 employment eligibility verification obligations under federal law (8 U.S.C. § 1324a)

3.3 Account Security and Authentication

Verifying your identity when you log in
Sending password reset emails
Managing session tokens and preventing unauthorized access
Delivering push notifications about shifts and timesheets

3.4 AI-Assisted Review

Profile photograph screening: Profile photographs are reviewed using an AI service (Anthropic Claude) to determine whether the image meets professional standards (e.g., clear face photo, appropriate attire, no filters). The AI receives a temporary, time-limited link to your photo and returns a suitability decision. Human administrators may perform a secondary review.
Position qualification screening: Resumes and self-reported experience descriptions are evaluated using an AI service to assess your relevant experience level for specific positions. This determination may affect the roles you are offered. Human administrators may override AI evaluations.

You may request human review of any AI-assisted decision by contacting us using the information in Section 15.

3.5 Safety and Platform Integrity

Maintaining block lists to protect workers and clients from known unsafe situations
Auditing actions via event logs for dispute resolution
Detecting and preventing fraudulent activity

3.6 Regulatory Compliance

Retaining records as required by federal and state employment, tax, and labor laws
Responding to lawful requests from government authorities

3.7 Communications and Notifications

Sending shift confirmations, reminders, and updates via email and push notification
Notifying you of changes to the Terms of Service or this Privacy Policy

4. How We Share Your Information

We do not sell your personal information. We share your information only as described below.

4.1 With Client Companies (Employers)

When you are assigned to a shift for a client company, that client’s authorized users may see your:

First and last name
Profile photograph
Certifications relevant to the position
Timesheet records for shifts you work for them

Clients do not have access to your SSN, tax documents, pay rate, home address, or other sensitive personal information.

4.2 With Service Providers

We share data with the following third-party service providers who process data on our behalf under written agreements:

Provider	Purpose	Data Shared
Cloudflare R2 (Cloudflare, Inc.)	Secure cloud file storage	Profile photos, resumes, certification documents, ID documents, completed onboarding forms (W-4, I-9, DE-4 PDFs)
Anthropic, PBC	AI profile photo review	Temporary presigned URL to profile photograph (no other personal data)
LiteLLM / OpenAI	AI position qualification review	Resume text and self-reported experience descriptions
ADP Run (ADP, Inc.)	Payroll processing	Name, SSN, address, DOB, banking details, earnings data, and tax withholding information as required for payroll
SMTP Email Provider	Transactional email delivery	Your email address and email content
Neon (Neon, Inc.)	Database hosting (production)	All data stored in our database
Railway (Railway Services, Inc.)	Application hosting	All data transmitted through the application

These providers are contractually required to use your data only as necessary to provide services to us and are prohibited from using it for their own purposes.

4.3 Legal Requirements

We may disclose your information if required to do so by law, regulation, legal process, or enforceable governmental request, including to comply with I-9 verification audits by the U.S. Department of Homeland Security.

4.4 Business Transfers

If Prism Talent Group is acquired, merges with another company, or transfers substantially all of its assets, your information may be transferred as part of that transaction. We will notify you via email and/or a prominent notice in the App before your information is transferred and becomes subject to a different privacy policy.

4.5 With Your Consent

We may share your information with third parties when you have given us explicit consent to do so.

5. Data Retention

We retain your personal information for as long as your account is active, as needed to provide you with the Services, and as required by applicable law. Specific retention practices include:

Account data: Retained for the duration of your account and for a minimum of 7 years after termination to satisfy federal and state employment and tax record retention requirements (including IRS Form W-4 records, I-9 records, and payroll records).
I-9 records: Retained for the period required by law — the later of three years after the date of hire or one year after the date of employment termination (8 C.F.R. § 274a.2).
Timesheet records: Retained for a minimum of 3 years under the Fair Labor Standards Act.
Soft deletion: Most account data is “soft-deleted” (marked as inactive but not immediately purged) to preserve audit trails. You may request full deletion subject to legal retention requirements.
Push notification tokens: Retained until you revoke them, uninstall the App, or we determine the token is no longer valid.
Uploaded files: Files stored in Cloudflare R2 are retained for the duration of your account and the applicable legal retention period thereafter.

6. Data Security

We implement industry-standard technical and organizational measures to protect your personal information:

Password security: All passwords are hashed using PBKDF2 with a salt before storage. Plaintext passwords are never stored.
Transport security: All data transmitted between your device and our servers is encrypted using TLS (HTTPS).
Access controls: Access to sensitive data (SSNs, tax documents, identity documents) is restricted to Prism Talent Group personnel with a legitimate operational need.
Token security: Mobile authentication refresh tokens are stored as hashed values and expire automatically.
File access: Documents stored in Cloudflare R2 are not publicly accessible. Access requires temporary, time-limited presigned URLs generated by our servers.
Database security: Our production database (PostgreSQL on Neon) is access-controlled and encrypted at rest.

Despite these measures, no security system is impenetrable. If you believe your account has been compromised, contact us immediately at the address in Section 15.

Data Breach Notification: In the event of a security breach that affects your personal information, we will notify you and applicable regulatory authorities in accordance with applicable law.

7. Your Rights and Choices

Depending on your location, you may have the following rights with respect to your personal information:

7.1 Access and Portability

You have the right to request a copy of the personal information we hold about you, including a portable, machine-readable copy.

7.2 Correction

You have the right to request that we correct inaccurate or incomplete personal information. Many fields can be updated directly in the App. For fields you cannot update yourself (such as records related to completed payroll), contact us.

7.3 Deletion

You have the right to request deletion of your personal information. Note that we may be legally required to retain certain data (see Section 5). When you request deletion, we will delete or anonymize information we are not required to retain and will explain what we are legally obligated to keep.

7.4 Restriction and Objection

You may request that we restrict processing of your information in certain circumstances, or object to processing based on legitimate interests.

7.5 Withdrawal of Consent

Where processing is based on your consent, you may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing before the withdrawal.

7.6 AI Decision Review

You have the right to request human review of any decision made about you through automated processing, including AI-based profile photograph screening and position qualification evaluation.

To exercise any of these rights, contact us at the information provided in Section 15. We will respond within 30 days (or the timeframe required by applicable law). We may need to verify your identity before processing your request.

8. California Privacy Rights (CCPA / CPRA)

If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), grants you additional rights:

8.1 Categories of Personal Information Collected

In the preceding 12 months, we have collected the following categories of personal information as defined by the CCPA:

Identifiers: Name, email address, phone number, IP address, device identifiers
Personal information (Cal. Civ. Code § 1798.80): Address, SSN, driver’s license number, financial information
Characteristics of protected classifications: Date of birth, gender, citizenship/immigration status
Professional or employment-related information: Resume, employment history, position qualifications, timesheet records, pay rates
Sensitive personal information: SSN, government ID numbers, financial account information, immigration status, racial or ethnic origin (as may be reflected in I-9 documents)

8.2 Sources

We collect this information directly from you, through your use of the Services, and from our payroll processor.

8.3 Business or Commercial Purposes

We use this information to provide employment staffing services, process payroll, comply with applicable law, and maintain the security and integrity of the Services.

8.4 Disclosure to Third Parties

We disclose personal information to the service providers described in Section 4.2 for operational purposes. We do not sell personal information. We do not share personal information for cross-context behavioral advertising.

8.5 Your CCPA Rights

Right to Know: Request disclosure of the categories and specific pieces of personal information we collect, use, and disclose.
Right to Delete: Request deletion of personal information, subject to legal exceptions.
Right to Correct: Request correction of inaccurate personal information.
Right to Opt-Out of Sale/Sharing: We do not sell or share your personal information for advertising purposes.
Right to Limit Use of Sensitive Personal Information: You may request that we limit our use of sensitive personal information (SSN, government IDs, financial data, immigration status) to purposes necessary to provide the Services.
Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights.

To submit a CCPA request, contact us at the address in Section 15 or visit www.prismtalentgroup.com/privacy-request. We will verify your identity before processing your request.

Authorized Agents: You may designate an authorized agent to submit requests on your behalf by providing written authorization.

9. Nevada Privacy Rights

Nevada residents may opt out of the sale of their personal information. We do not currently sell personal information. If you have questions, contact us at the information in Section 15.

10. European and UK Users (GDPR / UK GDPR)

If you are located in the European Economic Area (EEA) or the United Kingdom, the General Data Protection Regulation (GDPR) or UK GDPR applies to our processing of your personal information.

10.1 Legal Bases for Processing

We process your personal information on the following legal bases:

Contract performance (Art. 6(1)(b)): To provide the staffing services you engage with us for, including matching you to shifts, processing timesheets, and managing your employment relationship.
Legal obligation (Art. 6(1)(c)): To comply with employment, tax, payroll, and immigration law requirements (W-4, I-9, FLSA recordkeeping, etc.).
Legitimate interests (Art. 6(1)(f)): To maintain platform security, prevent fraud, and conduct internal analytics — balanced against your interests and rights.
Consent (Art. 6(1)(a)): For AI-assisted review of profile photographs and position qualifications, and for non-essential communications, where we seek your explicit consent.
Special category data (Art. 9(2)(b)): Processing of health data (if any), racial or ethnic origin information embedded in immigration documents, or other special category data is performed to meet obligations under employment and social security law.

10.2 International Transfers

Your personal information may be transferred to and processed in the United States and other countries where our service providers operate. Such transfers are subject to appropriate safeguards, including Standard Contractual Clauses (SCCs) approved by the European Commission, where applicable.

10.3 Data Protection Rights

In addition to the rights described in Section 7, you have the right to lodge a complaint with your local data protection authority.

10.4 Data Protection Contact

For GDPR-related inquiries, contact us at: support@prismtalentgroup.com

11. Children’s Privacy

The Services are not directed to individuals under the age of 18. We do not knowingly collect personal information from minors. If you are a parent or guardian and believe that a minor has provided us with personal information, contact us immediately at the address in Section 15, and we will take steps to delete the information.

12. Push Notifications

The PRISM mobile app may send push notifications related to your shifts, timesheet submissions, application status, and other account activity. You can manage push notification permissions through your device’s operating system settings at any time. Disabling notifications does not delete your account or affect your ability to use the App, but you may miss time-sensitive shift communications.

13. Third-Party Links and Services

The Services may contain links to third-party websites or services that are not operated by us. This Privacy Policy does not apply to third-party sites. We encourage you to review the privacy policies of any third-party services you access.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or service features. When we make material changes, we will:

Update the “Last Updated” date at the top of this policy
Notify you by email (to the address on your account) at least 14 days before the change takes effect
Display a prominent notice in the App

Your continued use of the Services after the effective date of the revised policy constitutes your acceptance of the changes. If you do not agree to the updated policy, you must discontinue use of the Services and may request account deletion.

15. Contact Us

If you have questions about this Privacy Policy, wish to exercise your privacy rights, or want to report a privacy concern, please contact us:

Prism Talent Group
Privacy and Compliance
Email: support@prismtalentgroup.com

For urgent account security concerns, please also email the above address with “URGENT” in the subject line.

We aim to respond to all privacy inquiries within 30 calendar days.

Appendix A: Summary of Personal Data Collected

Category	Examples	Purpose
Identity	Name, email, phone, address, DOB, SSN	Account management, payroll, I-9 compliance
Tax documents	W-4, DE-4, I-9 form data	Federal/state payroll tax compliance
Identity documents	Driver’s license, passport, work permit	I-9 employment eligibility verification
Professional	Resume, certifications, experience	Shift matching and position qualification
Work data	Shifts, timesheets, assignments	Core staffing service delivery
Financial	Pay rates, sick pay, reimbursements	Payroll and compensation
Communications	In-app messages	Operational coordination
Device data	Push token, device platform	Push notifications
Profile media	Photograph	Professional identification; AI review

This Privacy Policy was prepared for the PRISM application operated by Prism Talent Group. It is intended to comply with requirements of the Apple App Store, Google Play Store, GDPR, CCPA/CPRA, and applicable U.S. federal and state law. It does not constitute legal advice. Consult qualified legal counsel to ensure compliance with all requirements applicable to your specific situation.

← Back to sign in