Data Deletion

1. Who this applies to

This page explains the deletion process for three groups of people:

• Facebook or Instagram users whose Platform Data flowed through PRISM because a partner organisation connected their Facebook Page or Instagram Business account.
• Authenticated PRISM users — staff of SublimeCare or staff of a partner provider organisation who use PRISM with credentials.
• Partner organisations requesting deletion of their entire workspace.

2. What data deletion covers

A deletion request, once approved, removes the following from active PRISM systems:

• Your account record (name, email, password hash, role assignments, profile image).
• OAuth tokens and connected-platform credentials, including any Meta Graph API access tokens.
• Operational content directly attributed to your account (notes, drafts, threads you authored).
• Cached Platform Data obtained from Meta on your behalf, including insights and previously fetched posts.

Backups are rotated on a standard schedule. Information removed from live systems is purged from backups within ninety days at most.

3. How to submit a request

Use whichever route applies to you:

Facebook or Instagram users

If a partner organisation managed a page or account that included your interactions, email contact@sublimecare.com.au with the subject line "Meta user data deletion request". Include:

• Your Facebook or Instagram handle, or your Facebook user ID if known.
• The name of the partner organisation whose page or account you interacted with, if you know it.
• An email address we can reply to.

You may also revoke PRISM's access directly from your Facebook account at any time: Settings & privacy → Settings → Apps and websites → Active → remove PRISM. Revocation immediately stops any further data collection on our side.

Authenticated PRISM users

• Email the request from the same address you use to sign in to PRISM.
• State which records you would like removed (entire account, or specific items).
• We will confirm your identity and respond within five business days.

Partner organisations

A nominated administrator of the partner organisation may request deletion of the entire workspace by email from a verified administrator address. Workspace deletion removes all data attributed to the partner organisation, including OAuth integrations and cached Platform Data.

4. Timeframe

• Receipt confirmation: within five business days of your request.
• Identity verification: we may ask reasonable questions to confirm you are the data subject.
• Completion: within thirty days of confirmed receipt.
• Backup purge: within ninety days at most, on the standard rotation.

5. When we may retain information

Some information cannot be deleted on request because we are legally required to keep it for a defined period. These exceptions are narrow and only retain what the relevant law requires:

• NDIS service-delivery records: the NDIS Quality and Safeguards Commission requires providers to retain certain service-delivery records for at least seven years.
• Financial and tax records: retained for the period required under Australian tax law.
• Active investigations: records subject to a current legal hold, regulator request, or active security investigation.

Information retained under an exception is access-restricted, used only for the purpose that triggered the retention, and deleted once the retention period ends.

6. Confirmation and appeals

On completion we will email you a written confirmation summarising what was deleted and noting any records retained under an exception. If you are not satisfied with our response you may lodge a complaint with the Office of the Australian Information Commissioner at oaic.gov.au.

7. Relationship to our other policies

This page describes the deletion process. Broader information handling is covered by the Privacy Policy, and platform access is governed by the Terms of Service. Information about PRISM's role as a Tech Provider, including the data flows from Meta, is on the Tech Provider page.