Last updated: 8 November 2026

Privacy Policy

Your canvases are personal. This page explains in plain words what data we handle, why, who helps us, and what your rights are under the GDPR.

1. Who is responsible

The controller of your data is Canvas PRO. For anything about privacy, use our contact form.

2. What we collect and why

Data	Why	Legal basis
Account: e-mail address, password (stored only as a salted hash, never in clear), date of creation, date you accepted the terms	To create and secure your account, let you log in and recover your password	Contract
Your content: the notes, text, drawings, pictures, names of canvases and the settings you store in them	To store your canvases and sync them between your devices, and show them to people you share them with	Contract
Subscription: plan, Stripe customer and subscription numbers, status and end date of the paid period (we do not store card numbers)	To give you Pro, handle renewals and cancellations	Contract; legal duty (accounting)
Sharing: who you invited and who joined which canvas, with what role	To let you collaborate	Contract
Technical data: IP address and request logs, kept for a short time	To keep the Service secure, stop abuse (rate limiting) and fix errors	Legitimate interest
E-mails we send you: password reset, security notices, welcome message	To run your account safely. We send no marketing e-mail without asking you first	Contract; legitimate interest

We do not use advertising, tracking pixels or analytics cookies, we do not sell your data and we do not use your content to train AI models.

3. Who else handles your data (processors)

Render hosts the website and the database, in the EU (Frankfurt, Germany).
Stripe processes payments and sends invoices/receipts. Stripe is responsible for the card details you enter on its page and may transfer data outside the EU under the safeguards required by the GDPR (see Stripe's privacy policy).
An e-mail provider delivers our account e-mails.

These companies may only use the data to provide their service to us. Fonts and images of this website are served from our own server, so visiting our pages does not send your data to Google or other third parties.

One thing to know: if you paste a YouTube link in a note (a Pro feature), your browser loads the thumbnail directly from YouTube/Google, which then sees your IP address. Pictures you add by web address are loaded in the same way from the site that hosts them.

4. How long we keep it

Account and canvases: as long as your account exists. When you delete your account (Account, then Delete my account), they are erased from our database at once. Encrypted backups made by our hosting provider disappear after their normal retention period.
Invoices and payment records: Stripe and we keep them for the period the accounting law requires (in Belgium, 7 years).
Server logs: a short period only (days to a few weeks).
Password reset links: 60 minutes.

5. Your rights

You have the right to access your data, have it corrected, erased, receive it in a usable format (portability), restrict or object to some uses, and to withdraw consent where we rely on it. Most of this you can do yourself: your account page lets you download all your data and delete your account. For anything else write to contact form; we answer within one month.

If you think we handle your data wrongly, you can complain to the Belgian Data Protection Authority (gegevensbeschermingsautoriteit.be) or to the authority of your own country.

6. Security

Connections are encrypted (HTTPS). Passwords are stored as salted hashes. Sessions use secure, HTTP-only cookies. Only you (and the people you invite) can open your canvases. No system is 100% safe: if a breach affects your data, we tell you and the authority as the law requires.

7. Children

Canvas PRO is not meant for people under 16 and we do not knowingly collect their data.

8. Changes

If we change this policy in a way that matters, we tell you in the app or by e-mail. The date at the top shows the latest version.