Privacy Policy

Introduction

Canvas Memories (“we,” “our,” or “us”) is a Canadian company registered in Charlottetown, Prince Edward Island. We are committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website and services.

By using Canvas Memories, you agree to the collection and use of information in accordance with this policy. If you do not agree with our policies and practices, please do not use our Service.

1. Information We Collect

1.1 Personal Information

When you place an order or create an account, we collect:

• Name and email address
• Shipping address
• Payment information (processed securely through Stripe and PayPal. We never store full credit card details.)
• Phone number (if provided)

1.2 Content You Submit

We collect photos and images you upload to create your custom artwork. Please review our Terms of Service for how we may use this content.

This may include the image itself, related metadata, and previews derived from that image. Because our service is custom and visual, uploaded content may be reviewed by authorized team members and service providers for fulfillment, customer support, quality assurance, fraud and abuse prevention, security, and content moderation.

1.3 Consent and Preferences

We collect your consent preferences, including:

• Marketing email consent
• Featured Customer Program participation
• Content usage permissions

1.4 Automatically Collected Information

When you visit our website, we automatically collect:

• IP address and browser type
• Device information and operating system
• Pages visited and time spent on our site
• Referral source
• Cookies and similar tracking technologies
• Recordings of how you use our pages, such as clicks and scrolling (see Section 6)

2. How We Use Your Information

We use the information we collect to:

• Process and fulfill your orders
• Create your custom artwork
• Communicate with you about your order status
• Send shipping notifications and tracking information
• Provide customer support
• Send marketing emails (only if you've consented)
• Improve our website and services
• Detect and prevent fraud or abuse
• Comply with legal obligations
• Review, moderate, and troubleshoot uploaded content
• Generate previews using third-party image and AI providers

2.1 Marketing Communications

If you've opted in to marketing emails, we may send you:

• Special offers and discount codes
• New product announcements
• Inspiration and creative ideas
• Customer success stories

You can unsubscribe at any time by clicking the unsubscribe link in our emails or contacting us directly.

2.2 Featured Customer Program

Customers who opt into our Featured Customer Program allow us to showcase their transformations in:

• Website gallery and homepage
• Social media posts and advertisements
• Marketing materials and email campaigns
• Customer testimonials

Participants receive exclusive discount codes as a thank-you for their participation.

2.3 Uploaded Image Review and Safety Checks

To operate the service, we may transmit uploaded photos to third-party image generation or processing providers and may review uploads internally when needed to fulfill an order, investigate failures, enforce our content rules, or protect the service from abuse. Some uploads may be rejected by our systems or by third-party providers based on safety or policy rules.

We may also review uploaded photos in aggregate, sometimes with the help of AI tools, to learn which kinds of photos customers choose and to improve our products.

3. How We Share Your Information

We do not sell your personal information. We may share your information with:

3.1 Service Providers

• Payment Processing: Stripe and PayPal (for secure payment processing)
• Artwork Generation: Google, through the Gemini API and Google Cloud (Vertex AI). Google's AI image models turn your photo into your preview and finished artwork.
• Printing and Fulfillment: Printful (for printing and shipping your orders)
• Order Notes: TypeSafe. Its AI reads the special instructions you type at checkout, the name on your shipping label, and any revision request, so we notice a request before your painting is printed. It sees only that text, not your photo, email address, or payment details.
• Email Service: Resend (for transactional and marketing emails, and for delivering job applications to us) and our email provider (for messages you send to support@canvasmemory.com, and the job applications we receive)
• Reviews: Trustpilot. We may send it your name, email address, and order number so it can invite you to review your order.
• Hosting and Storage: Vercel (website hosting), Supabase (our database and the photos you upload, stored in the United States, US East region), and Upstash (short-lived records of internet addresses, used to prevent abuse)
• Analytics: PostHog, Google Analytics, and Vercel Web Analytics (to understand how visitors use our site). PostHog also makes session recordings, which it may review with AI, using Google's Gemini models (see Section 6).
• Error Monitoring: Sentry (to find and fix errors, including recordings of some visits)
• Advertising: Meta (Facebook and Instagram) and TikTok (to measure how well our ads work; see Section 6)
• Team Alerts: Telegram (private alerts to our team about new uploads, previews, orders, and support messages, which can include your photo, preview, email address, and approximate location, and about new job applications, which show only the roles applied for and the country)
• AI Assistant: Anthropic (Claude), which helps us run day-to-day operations, such as checking orders, looking into problems, and drafting support replies

Most of these service providers are contractually obligated to protect your information and use it only for the services they provide to us. Some, including Meta, TikTok, Google, and Trustpilot, may also use the information they receive under their own privacy policies. Our providers store and process information in the United States and other countries (see Section 8).

3.2 Link-Based Access

Some previews, downloads, restore links, or internal review links may work through direct or secure URLs. Anyone who has one of these links may be able to access the related file until the link expires, is revoked, or the file is removed. Please do not share image links unless you intend to share the associated image.

3.3 Legal Requirements

We may disclose your information if required by law, court order, or to:

• Comply with legal processes
• Protect our rights and property
• Prevent fraud or illegal activities
• Protect the safety of our users or the public

3.4 Business Transfers

If Canvas Memories is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change.

4. Data Retention

We retain your information for as long as necessary to:

• Fulfill the purposes described in this Privacy Policy
• Provide you with customer support
• Comply with legal, accounting, or reporting requirements
• Resolve disputes and enforce our agreements

Order information and artwork files are typically retained for 2 years. You may request deletion of your data by contacting us (see Section 13).

We may keep certain records or files longer when necessary for fraud prevention, legal compliance, dispute resolution, backup integrity, or to complete an order you already placed.

5. Data Security

We implement industry-standard security measures to protect your information, including:

• SSL/TLS encryption for data transmission
• Secure payment processing through Stripe and PayPal (both PCI DSS compliant)
• Cloud infrastructure safeguards and vendor security controls
• Regular security audits and monitoring
• Administrative and technical controls intended to limit access to team members and providers who need it to perform their duties

However, no method of transmission over the Internet is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

Because our service involves visual uploads, you should avoid submitting nude, sexually explicit, or other highly sensitive images. If you do submit content that violates our rules or a provider's safety standards, we may block or remove it.

6. Cookies and Tracking Technologies

We use cookies and similar technologies to:

• Remember your preferences and settings
• Keep you logged in (if you have an account)
• Analyze website traffic and user behavior
• Improve our services and user experience
• Measure how well our ads on Meta (Facebook and Instagram) and TikTok work

The providers behind these tools are listed in Section 3.1. When you place an order or give us your email address, our server may also send Meta and TikTok a scrambled (hashed) copy of details such as your email address, along with your IP address and browser information, so they can match the order to our ads.

Session recordings: PostHog and Sentry can record how you use our pages, such as clicks, scrolling, and the pages you view, so we can find and fix problems. We set these tools to hide what you type into forms, but a recording can still show some text, such as your email address. They never include your card details, because you enter those on Stripe's or PayPal's own pages. PostHog may use AI to review session recordings so we can find and fix problems on our site. It does this with Google's Gemini models.

Most browsers allow you to control cookies through their settings. However, disabling cookies may limit your ability to use certain features of our Service.

7. Your Rights and Choices

7.1 Access and Correction

You have the right to access and update your personal information. If you have an account, you can update your information through your account settings. Otherwise, contact us at support@canvasmemory.com.

7.2 Data Deletion

You may request deletion of your personal information. Note that we may retain certain information as required by law or for legitimate business purposes (e.g., order history for tax purposes).

7.3 Marketing Opt-Out

You can opt out of marketing emails at any time by:

• Clicking the “unsubscribe” link in our emails
• Updating your preferences in your account settings
• Contacting us at support@canvasmemory.com

Note: You will still receive transactional emails (order confirmations, shipping updates, etc.) even if you opt out of marketing.

7.4 Featured Customer Program Withdrawal

If you previously opted into the Featured Customer Program and wish to withdraw, contact us. We will stop using your content in new marketing materials, though content already published may remain publicly available.

7.5 Do Not Track

Our website does not currently respond to Do Not Track (DNT) signals.

8. Where We Are Based and Where Your Information Is Stored

Canvas Memories is a Canadian company registered in Charlottetown, Prince Edward Island. Our team works remotely from Montreal, Quebec, and some team members and contractors may work from other countries.

Wherever you live, your information is stored and processed in the United States and in other countries by the service providers listed in Section 3.1. For example, our database and the photos you upload are stored by Supabase in the United States (US East region). While your information is in another country, that country's laws apply to it, and courts, law enforcement, or national security authorities there may be able to access it. By using our Service, you consent to this transfer.

Canadian Privacy Law: Because we are a Canadian company, we handle personal information under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and any provincial privacy laws that apply. If we cannot resolve a privacy concern with you, you can contact the Office of the Privacy Commissioner of Canada.

For European Users: If you are in the European Economic Area (EEA), you have additional rights under GDPR, including the right to data portability and the right to lodge a complaint with a supervisory authority.

For California Residents: California residents have additional rights under CCPA. See Section 9 for details.

9. California Privacy Rights (CCPA)

If you are a California resident, you have the right to:

• Know what personal information we collect, use, and share
• Request deletion of your personal information
• Opt out of the sale of your personal information (we do not sell personal information)
• Non-discrimination for exercising your privacy rights

To exercise these rights, contact us at support@canvasmemory.com.

10. Job Applicants

If you apply to work with us through canvasmemory.com/work-with-us, we collect the information you give us, such as your name, email address, where you are based, the role you are applying for, links to your work, your rates, and your answers to our questions. If you send us links to videos or other files, those files stay where you host them, and we keep the links.

We use this information only to review your application, contact you about it, and decide who we will work with. Only the people making that choice see it: our founder and anyone helping with that round of hiring. We may use AI tools to help sort applications, but a person makes every decision. Your application reaches us by email through Resend (our email service) and is kept in our email inbox. We don't store applications in our database.

We delete your application 6 months after you apply, unless we end up working together (then we keep what we need for that work). Ask us and we'll delete it sooner. To see, correct, or delete your application, email support@canvasmemory.com.

Please watch out for scams. We will never ask you for money, and we only recruit through canvasmemory.com/work-with-us and emails from @canvasmemory.com.

11. Children's Privacy

Canvas Memories is not intended for children under 13. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by:

• Posting the updated policy on this page
• Updating the “Last Updated” date
• Sending you an email (for significant changes)

Your continued use of the Service after changes constitutes acceptance of the updated Privacy Policy.

13. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or your personal information, please contact us: