Privacy Policy
Effective 7 September 2026 · Last updated 17 September 2026
The short version
- This page covers the Toggle AI website at prismlab.dev — the marketing pages you are reading now. It does not cover the Toggle AI application at toggle-app.prismlab.dev, which has its own notice.
- We use Mixpanel to count visits and see which pages people read. That is the only analytics on this site, and it sets no cookies at all — it keeps one random identifier in your browser's local storage instead.
- We do not run advertising, build advertising profiles, or sell or share your personal information. Mixpanel sells no advertising product.
- Outside the Republic of Korea and the United States, analytics loads only after you accept. In Korea and the US it is on by default and disclosed here, and you can switch it off at any time with Cookie settings. Why they differ is explained in section 5.
- Questions, or a request about your data: ringo@prismlab.dev.
1. Who we are
Prism Labs (“Prism Labs”, “we”, “us”) is the company behind Toggle AI. Prism Labs is established in the Republic of Korea and is the personal information controller (개인정보처리자) for this website, and the data controller for the purposes of the EU and UK General Data Protection Regulation.
Our Privacy Officer (개인정보 보호책임자, PIPA §31) is:
- Name: Ringo Kwon
- Position: Chief Executive Officer, Prism Labs
- Contact: ringo@prismlab.dev
You can raise any question about this policy, or make any request under section 9, at that address. We answer within 10 days of receiving a request, which is the period PIPA sets for access and correction requests, and within one month where the GDPR applies.
2. What this policy covers
This policy applies to prismlab.dev and the pages served from it: this privacy policy, the Toggle AI landing page, and the team profile pages.
It does not cover the Toggle AI application at toggle-app.prismlab.dev, which handles accounts, conversations and the content you send to AI models, and is governed by its own notice (the app privacy notice).
Links to Discord, X and LinkedIn are ordinary links. We do not embed those platforms' scripts, buttons or trackers, so they learn nothing about you until you choose to follow the link — at which point that platform's own privacy policy applies.
3. What we collect
We do not ask you to create an account, log in, or fill in a form to read this site, and we collect no personal information directly from you here. Everything below is collected automatically as your browser loads the page, or is something you send us yourself by email.
3.1 Website analytics (Mixpanel)
When analytics is active — see section 5 for when that is — Mixpanel collects:
- a randomly generated distinct identifier, stored in the local-storage entry listed in section 5. It identifies a browser, not a person, and we have no way to connect it to your name;
- the pages you view on this site, the order you view them in, and the page or search that referred you;
- campaign parameters from the address you arrived on — the
utm_source,utm_medium,utm_campaign,utm_contentandutm_termvalues that tell us which link or post brought you here. These are put in the link by us, and contain nothing about you; - approximate location — country, region and city — derived from your IP address;
- device and browser information: browser and version, operating system, device type, screen size, and language setting;
- a small, fixed list of things you click, and nothing else: Join the waitlist in the hero or the closing section; Log In and Contact Us in the header; and Join our Discord in the closing section. Where a control appears more than once, the click records which of those places it came from.
- which parts of this page you reach — the opening section, the product screenshot, each of the three feature sections, the closing section and the footer. A part is recorded once per visit, when it has stayed on your screen for at least a second. Only its name is recorded: not how long you stayed, how far you scrolled, or anything you did inside it.
Your IP address is transmitted to Mixpanel as part of the request, and Mixpanel uses it to derive the approximate location above. We never see your IP address in the analytics reports available to us.
Beyond the parts of the page named above, nothing is collected by watching the page. Mixpanel offers an "autocapture" mode that records clicks and form interactions across a site automatically; it is switched off, so the list above is exhaustive rather than indicative.
We do not collect, and Mixpanel is not configured to send, anything you type, or any special category of data as defined in GDPR Art. 9 (health, beliefs, biometrics, and so on).
3.2 Serving the page
This site is static files delivered by Amazon Web Services (Amazon CloudFront and Amazon S3). Delivering a page necessarily involves your IP address reaching that infrastructure, because it is the address the page is sent back to. We do not operate visitor access logging on this website and we do not use that traffic for analytics or profiling.
CloudFront also derives the country your connection comes from, and tells your browser the two-letter country code. It is used only to decide whether you are asked about analytics (section 5.2), and is not stored.
3.3 Web fonts
The Inter typeface is served from this site itself, like the rest of its files. No font is requested from a third party, so rendering the page tells no one else that you visited.
3.4 If you email us
If you write to ringo@prismlab.dev we hold your email address and whatever you put in the message, for as long as we need it to deal with what you wrote about and to keep a record of the correspondence.
4. Why we use it, and on what legal basis
| What | Why | Legal basis (EEA / UK) | Legal basis (Korea) |
|---|---|---|---|
| Analytics storage and the data in section 3.1 | To understand how many people visit, which pages they read, and where they arrive from, so we can decide what to build and what to write | Consent, GDPR Art. 6(1)(a), given through the banner and withdrawable at any time. Storage on your device is on the basis of your consent under the ePrivacy Directive Art. 5(3) | PIPA §15(1)1 (consent) where given, and §30(1)7 — disclosure of the automatic collection device and of how to refuse it, which is this policy |
| Delivering the page, and the font files it needs | To show you the site you asked for, and to keep it available and secure | Legitimate interests, GDPR Art. 6(1)(f) — running a website that works. There is no way to serve a page without it | PIPA §15(1)4 — necessary to perform what you requested |
| Deriving the country of your connection (section 3.2) | To ask for consent before analytics wherever the law requires it | Legitimate interests, GDPR Art. 6(1)(f) — applying the consent rule that protects you. Only the country is derived, and it is not stored | PIPA §15(1)6 — our legitimate interest in applying the right rule, which clearly outweighs a country code that is never stored |
| Remembering your cookie choice | So that a refusal stays refused and we do not ask again on every page | Strictly necessary; exempt from consent under ePrivacy Art. 5(3), because honouring your choice is impossible without recording it | PIPA §15(1)4 |
| Email correspondence | To answer you | Legitimate interests, GDPR Art. 6(1)(f), or Art. 6(1)(b) where your message concerns a possible contract | PIPA §15(1)1 / §15(1)4 |
5. Cookies, local storage, and how to refuse
5.1 What is set
| Name | Type | Set by | Purpose | Lifetime |
|---|---|---|---|---|
mp_<token>_mixpanel |
Local storage | Mixpanel | Holds the random distinct identifier that distinguishes one browser from another, the referrer you arrived from, and the campaign parameters of your first visit | Until you clear your browser's site data, or decline |
__mp_opt_in_out_<token> |
Local storage | Mixpanel | Records that you accepted or declined, so the refusal is honoured on later visits. This one is kept when you decline — remembering a refusal is what honouring it requires | Until you clear your browser's site data |
__mpq_<token>_ev |
Local storage | Mixpanel | A short-lived outbox holding events that have not been sent yet, so a slow or interrupted connection does not lose them. Emptied as they send, and erased when you decline | Seconds, while analytics is active |
toggle.consent.analytics |
Local storage | This site | Records whether you accepted or declined analytics. It is never sent to any server | Until you clear your browser's site data |
This site sets no cookies. All four entries above are local storage, which — unlike
a cookie — is never attached to a request and is readable only by prismlab.dev itself.
Nothing on this site sets an advertising cookie or a cross-site tracker. Local storage is still
storage on your device, so it is treated here exactly as a cookie would be: consent is asked for
it in the same places and on the same terms.
5.2 When you are asked, and when you are not
Different laws give different answers, and this site follows each in its own territory.
- Everywhere except the Republic of Korea and the United States — including the EEA, the United Kingdom and Switzerland — nothing is stored and no request is made to Mixpanel until you press Accept in the banner. If you decline, or simply ignore the banner, the Mixpanel library is never even downloaded, so no request carrying your IP address reaches it. This follows ePrivacy Directive Art. 5(3), which requires consent before non-essential storage is written.
- In the Republic of Korea, PIPA §30(1)7 requires that the operation of an automatic collection device, and the means of refusing it, be disclosed in the privacy policy — which is what this section is. Analytics therefore runs by default and no banner interrupts you. This is only lawful because the measurement stays first-party: Mixpanel sells no advertising product and this site feeds none, so no behavioural information (행태정보) is generated for personalised advertising. If that ever changes, prior consent will be sought in Korea as well, and this policy will be updated before it is.
- In the United States, the CCPA / CPRA and the other state privacy laws give you the right to opt out rather than requiring consent first. Analytics therefore runs by default, and you can opt out at any time as described in section 5.3 — a Global Privacy Control signal counts as that opt-out automatically. We do not sell or share personal information (section 9.3).
Which territory you are in is decided by the country your connection comes from, as our hosting provider derives it from your IP address (section 3.2). No other lookup service is involved. If you connect through a VPN or proxy, its country is the one that counts. If the country is anything other than Korea or the United States, or cannot be determined at all, you are asked — the uncertain case always resolves toward showing the banner.
5.3 How to refuse or withdraw
- On this site, at any time: open Cookie settings, here or in the footer of any page, and choose Decline. Withdrawing is exactly as easy as accepting, as GDPR Art. 7(3) requires. Declining after having accepted also erases the Mixpanel entry, and the identifier in it, from your browser.
- Global Privacy Control: if your browser or extension sends a GPC signal, we treat it as a refusal, everywhere, on every visit, without you having to press anything. It overrides the Korean and US defaults described above.
- In your browser: every major browser can block or clear site data for a
site. Clearing it here disables analytics and affects nothing else — no part of this site needs
stored data to work. Menu names vary a little between versions:
- Chrome: Settings → Privacy and security → Site settings → Additional
content settings → On-device site data → add
prismlab.devunder “Not allowed to save data on your device”. - Edge: Settings → Cookies and site permissions → Manage and delete cookies
and site data → Block → add
prismlab.dev. - Firefox: Settings → Privacy & Security → Cookies and Site Data →
Manage Exceptions → enter
https://prismlab.dev→ Block. - Safari on Mac: Settings → Privacy → Manage Website Data → remove
prismlab.dev, or turn on “Block all cookies”. - Safari on iPhone and iPad: the Settings app → Safari (Apps → Safari on
iOS 18 and later) → Advanced → Website Data → remove
prismlab.dev.
- Chrome: Settings → Privacy and security → Site settings → Additional
content settings → On-device site data → add
- Do Not Track: if your browser sends a DNT signal, Mixpanel is instructed to honour it and collects nothing, in addition to everything above.
6. Who else is involved
We do not sell personal information, we do not share it for cross-context behavioural advertising, and we do not disclose it to anyone for their own purposes. The only third parties that process data from this site are the ones needed to run it:
- Mixpanel — website analytics. Mixpanel acts as our processor for the data in section 3.1 and may not use it for its own purposes. See Mixpanel's Privacy Policy.
- Amazon Web Services — hosting and content delivery for the static files that make up this site.
We may also disclose information where the law requires it — a valid court order, a lawful request from a regulator, or the defence of a legal claim. Nothing in this policy prevents that, and nothing else does either.
7. Sending data outside Korea
Mixpanel is operated from outside the Republic of Korea, so the data in section 3.1 leaves the country. PIPA §28-8 requires that a cross-border transfer be disclosed item by item, and this is that disclosure:
| Recipient | Mixpanel, Inc. (United States), contact compliance@mixpanel.com. Its representative in the EEA is MIXPANEL S.L., Avenida Diagonal 442, P. 3 PTA. 1, 08037 Barcelona, Spain; in the United Kingdom, MIXPANEL UK LIMITED, 71–75 Shelton Street, Covent Garden, London WC2H 9JQ. |
|---|---|
| Country | The United States. |
| When and how | Continuously, at the moment you view a page, over an encrypted HTTPS connection. |
| Items transferred | The data listed in section 3.1: the distinct identifier, pages viewed, campaign parameters, approximate location, device and browser information, the four clicks named there, and which parts of the page you reached. Your IP address is transmitted in order to derive the approximate location. |
| Purpose | Website traffic analysis, on our behalf. |
| Retention | Two years from the date of each event, after which Mixpanel deletes it automatically. Aggregate reports (visit counts and similar) are not subject to that limit because they contain no user-level data. |
| How to refuse | Decline in Cookie settings, or block site data in your browser. Refusing has no effect on your use of this site. |
For transfers out of the EEA and the UK, Mixpanel, Inc. self-certifies under the EU-U.S. Data Privacy Framework and its UK Extension and the Swiss-U.S. Data Privacy Framework, and offers the European Commission's Standard Contractual Clauses in its data-processing addendum. Amazon Web Services likewise offers Standard Contractual Clauses in its own.
8. How long we keep it
- Mixpanel analytics data — held by Mixpanel for two years from the date of each event, then deleted automatically. We do not copy it into our own systems.
- Your cookie choice — in your own browser only, until you clear its site data. We never receive it.
- Email correspondence — for as long as needed to handle the matter and keep a record of it, and then deleted.
9. Your rights
Write to ringo@prismlab.dev to exercise any of these. We will not charge you, and we will not treat you differently for asking.
9.1 In the Republic of Korea (PIPA §§35–37, §39-7)
You may request access to your personal information, ask that it be corrected or deleted, ask that we stop processing it, and withdraw a consent you have given. You may act through a representative, and you may appeal if we refuse.
9.2 In the EEA and the United Kingdom (GDPR Arts. 15–22)
You have the right of access, rectification, erasure, restriction of processing, data portability, and objection to processing based on legitimate interests. Where processing rests on consent, you may withdraw it at any time without affecting anything done before you did. We carry out no automated decision-making or profiling that produces legal or similarly significant effects.
9.3 In the United States (CCPA / CPRA and other state privacy laws)
Depending on the state you live in, you have the right to know what we collect, to delete it, to correct it, and to opt out of the sale or sharing of personal information. We do not sell or share personal information as those terms are defined in the CCPA, and we honour Global Privacy Control signals automatically.
9.4 One honest limitation
Analytics data is pseudonymous: it is tied to a random identifier in your browser, and we hold nothing that links it to your name or email. Where that is the case, GDPR Art. 11 does not require us to acquire more information about you purely to find your records — so if you ask us to produce or delete your analytics data, we may not be able to identify it. What we can always do, immediately, is stop collecting: decline in Cookie settings, and the collection ends and the stored identifier is erased.
10. Children
This site is not directed at children and we do not knowingly collect personal information from a child under 14 (the threshold set by PIPA §22-2) or under 16 in the EEA. If you believe a child has provided personal information to us, write to us and we will delete it.
11. Security
The site is served only over HTTPS. We store no analytics data on our own systems, which means there is no visitor database here to breach. Access to the Mixpanel project and to the hosting account is limited to the people at Prism Labs who need it, and is protected by multi-factor authentication. Should a breach of personal information occur, we will notify affected individuals and the relevant authority as PIPA §34 and GDPR Arts. 33–34 require.
12. Complaints
Please raise it with us first — ringo@prismlab.dev — but you are entitled to go straight to a regulator, and to do so at any point.
12.1 Republic of Korea (권익침해 구제방법)
- Personal Information Dispute Mediation Committee (개인정보분쟁조정위원회) — 1833-6972, kopico.go.kr
- Privacy Infringement Report Centre (개인정보침해신고센터) — 118, privacy.kisa.or.kr
- Personal Information Protection Commission (개인정보보호위원회) — pipc.go.kr
- Supreme Prosecutors' Office (대검찰청) — 1301 · National Police Agency (경찰청) — 182
12.2 EEA and United Kingdom
- EEA: the supervisory authority of the country you live or work in — list of members
- United Kingdom: the Information Commissioner's Office — ico.org.uk
13. Changes to this policy
If we change this policy we will post the new version here and move the “last updated” date at the top. Where a change is material — a new purpose, a new recipient, or a new category of data — we will say so on this page at least seven days before it takes effect, and where the change requires your consent we will ask for it rather than assume it.
Prism Labs — the company behind Toggle AI.
Privacy Officer (개인정보 보호책임자): Ringo Kwon, Chief Executive Officer.
Email: ringo@prismlab.dev