Privacy Policy

Who is responsible for what

When a design company (“your organization”) uses Canvas, it decides what client information goes in and who can see it. For that information we act as the service provider and handle it on the organization's behalf. If you are a client and want to see, correct or delete your information, ask your designer first. We will also help directly: write to us at the address below.

What we handle

• Team members: name, email address, job title, role, profile picture, and the work you do in Canvas (boards, comments, messages and activity).
• Clients: name, email, phone, project address and dates, budget, contact preferences, notes, and the feedback, reactions and approvals a client gives on a review link.
• Board content: pictures, product details and prices, notes, and the pages and layouts you create.
• Technical data: sign-in and review sessions, the address a request comes from (used to limit abuse), and error and usage logs kept by our hosting.

We do not sell personal information and we do not show advertising.

How we use it

• To run Canvas: show boards to the people you choose, send sign-in codes and notifications, save and restore your work.
• To keep it safe: sign-in checks, limits on repeated attempts, and investigating misuse.
• To improve and support the service, using logs and the details you send us when you ask for help.

Cookies and storage

Canvas uses cookies and browser storage that the service needs to work: to keep you signed in, to remember that a client has entered a review link's code, and to keep your preferences such as panel sizes. It does not use advertising or cross-site tracking cookies.

Who else handles it

We use a small number of providers to run Canvas: hosting and database services, file storage for pictures, and an email service that delivers sign-in codes and notifications. They may only process information to provide those services to us. When a designer sends a client an email from Canvas, it goes through the designer's own email account.

The clipper

The Canvas browser extension reads the product page you are on, only when you open it, to fill in a product's name, price, pictures and details. It sends what you choose to save to your Canvas account and does not collect your browsing history.

How long we keep it

We keep information while your organization's account is active. Boards, clients and files you delete are removed from the live service, and from backups on their normal cycle. When an organization closes its account, we delete its information unless the law requires us to keep it.

Security

Access is limited to signed-in members and to review links with a one-time code. Passwords are stored as one-way hashes, traffic is encrypted in transit, and what clients see on a review link leaves out your costs and internal notes. No service is perfectly secure; tell us promptly if you think something has gone wrong.

Your choices

You can ask to see, correct, export or delete your personal information, or object to how it is used. Where the law gives you more rights, we will honour them. Canvas is not meant for children, and we do not knowingly collect their information.

Changes and contact

We will update this policy as Canvas changes, and the date above will show when. Questions or requests: support@craate.io.