Privacy Policy
How we collect, use and protect personal data. Last updated 1 August 2026.
This policy explains what personal data Canvas Inc. collects when you visit this site, open an account or contact support, why we collect it, and what rights you have over it. It is written to be read rather than to be defensible, and if anything in it is unclear we would rather you asked.
Who we are
Canvas Inc. is the data controller for the personal data described here. You can reach our privacy team through the contact form by choosing “Billing question” and mentioning privacy in the message.
What we collect
We collect three kinds of data, and nothing else.
- Account data: name, email address, company, billing address and the payment method token held by our payment processor. We never see or store full card numbers.
- Service data: the sites, domains and records you create, plus the server logs generated by running them.
- Usage data: pages visited on this site and in the control panel, kept in aggregate to work out what to fix next.
Why we are allowed to use it
Account and service data are processed to perform the contract you entered into when you opened an account. Usage data and the analytics on this site rest on our legitimate interest in improving a product people pay for, and you may object to that at any time without losing access to anything.
Marketing email is sent only with consent, and every message carries a one-click unsubscribe that works immediately rather than "within ten working days".
How long we keep it
- Server and access logs: 30 days
- Backups: 30 days, then destroyed
- Support tickets: 3 years from closure
- Invoices and tax records: 7 years, as required by law
- Account data: until you close the account, then 30 days
Closing an account deletes the sites, databases and backups after thirty days. That window exists because people change their minds; after it, the data is genuinely gone and we cannot recover it for you.
Who else sees it
We do not sell personal data and we never have. It is shared only with the processors needed to run the service: our payment provider, our transactional email provider and the data centre operators who house the hardware. Each is bound by a data-processing agreement, and the list is available on request.
We will disclose data to law enforcement only against a valid, binding order in the relevant jurisdiction, and we will tell you it happened unless the order forbids it.
Where it lives
You choose the region for your service data when you order, and it stays there until you move it. Account and billing data are held in the European Union. Transfers to processors outside your region rely on the appropriate safeguards, including standard contractual clauses.
Your rights
- Access a copy of everything we hold about you
- Correct anything that is wrong
- Delete your data, subject to the tax records above
- Export it in a portable format
- Object to processing based on legitimate interest
- Complain to your local supervisory authority
Requests are answered within thirty days and there is no charge. Most of them are also self-service: export and deletion are both buttons in the control panel.
Cookies
This site sets a session cookie when you sign in and stores your cookie preferences. Analytics are first-party and aggregated. We do not run advertising trackers, and there is no third-party pixel on any page of this site.
Changes
If this policy changes materially we will email account holders at least thirty days before it takes effect, and the previous version stays available for comparison. Minor corrections are noted by the date at the top.