Privacy Policy

Last updated: October 21, 2026

CanvasGenie makes artwork from your words or a photo, then lets you order it as a print. This policy explains what information we handle and how long we keep it.

Optional Analytics

Google Analytics 4, PostHog, and Microsoft Clarity are optional analytics tools that help us understand visits, campaigns, and site usability. They do not load until you allow analytics. Separately, Vercel Web Analytics runs for all visitors without cookies or device identifiers and is used only for aggregate site statistics. Essential site functions, including checkout, work without optional analytics.

Vercel Web Analytics

Vercel Web Analytics counts visits and reports aggregate information about page paths, referring sites, allowed campaign tags, country, device type, operating system, and browser. Vercel derives country-level location from the request IP address; the IP address is not stored with analytics data. A short-lived request hash supports anonymous daily visitor counts and is discarded within 24 hours. The reports are aggregated and are not used for advertising or tracking you across websites. We allow only these URL parameters in analytics: utm_source, utm_medium, utm_campaign, utm_term, utm_content, and ref. See Vercel's Web Analytics privacy documentation.

How We Use Clarity

Microsoft Clarity measures how visitors use the site and may record interactions and generate heatmaps after you allow analytics. PostHog session replay and automatic interaction capture are disabled.

Data We Capture

When enabled, these analytics services may receive page paths, campaign tags, referral source, browser-generated analytics identifiers, and usage events. They do not receive names, email addresses, or shipping addresses from browser analytics.

Your Rights and Choices

Choose Accept all, Reject optional, or set analytics and advertising preferences in the consent panel. You can reopen Cookie preferences from the site footer at any time. Your choice is saved in a first-party cookie for up to one year. A small essential local-storage signal lets other open tabs on this site refresh their view of the saved choice; it contains only a timestamp and random nonce, not your choice, attribution, or user identifiers. The cookie remains the source of the saved choice. Do Not Track and Global Privacy Control signals keep both optional categories off.

Before you choose, campaign tags (UTM values and referral codes), the landing page path, and the referring website hostname may be held in session storage for this browser tab, or temporarily in page memory if session storage is unavailable. While analytics consent is absent, this session-only context is not saved in cookies or local storage; if you later allow analytics, it may be added to consented analytics history. It is sent to Stripe as checkout and order metadata if you place an order. It is not sent to analytics providers without analytics consent. Stripe metadata also records whether analytics consent was granted, rejected, unanswered, or disabled by Global Privacy Control or Do Not Track. Advertising click identifiers are collected only with advertising consent.

Advertising consent currently does not load advertising tags. If you allow both analytics and advertising, a page URL sent to analytics may include only a bounded Google click identifier (gclid, gbraid, or wbraid); other query parameters are removed. We do not currently use Microsoft Advertising or Pinterest advertising tags.

PostHog and Google Analytics

We use PostHog and Google Analytics 4 (GA4) to understand page visits, campaign sources, checkout starts, and completed purchases. When analytics is enabled, these services may receive page paths, campaign tags, referral source, browser-generated analytics identifiers, and purchase details such as the Stripe transaction ID, currency, item value, shipping, tax, and promotion code. We do not send names, email addresses, or shipping addresses in these analytics events.

Analytics is off until you explicitly allow it. It is also disabled when your browser sends a Do Not Track or Global Privacy Control signal. Rejecting or revoking analytics stops browser collection and prevents analytics identifiers from being sent. A purchase may still be recorded in our private order records, but it will not be sent to analytics without the required consent.

With analytics consent and the necessary provider identifiers, purchase events are sent by our server after Stripe confirms that a Checkout Session is settled. This includes paid orders and completed zero-total orders that require no payment. A successful HTTP response from an analytics provider does not confirm that the event appeared in its reports. Browser controls or extensions may also block analytics scripts.

What We Store When You Create Artwork

We store the prompt you type, or the photo you upload, so we can generate and show you artwork. Text-prompt artwork stays in the store while CanvasGenie operates. A photo upload is deleted automatically within 72 hours. Artwork made from a photo is deleted after 30 days if it was not bought. If it was bought, we keep it for 12 months so you can order a reprint. Purchased artwork is sent to Printful for printing.

Photos You Upload

When you use a photo to create artwork, we store it privately so our AI provider (Google Gemini) can paint from it and so you can try more styles without uploading again. Your photo is deleted automatically within 72 hours of upload. It is never shown publicly, never sold, and never used by us or Google to train AI models. Google may keep request logs for a limited time to detect abuse. OpenAI screens uploaded photos for disallowed content.

Artwork You Create

We store generated artwork so you can preview it on products and order it. Text-prompt artwork stays while the store runs. Artwork made from a photo is deleted after 30 days if it was not purchased, or after 12 months if it was purchased. Purchased artwork goes to Printful to make your print.

People in Photos

Only upload photos you have the right to use. If a photo shows other people, you confirm they agreed; for children, that you are their parent or guardian or have their permission. We do not create face templates, run facial recognition, or try to identify anyone in a photo. Because we do none of those things, this practice does not engage Illinois BIPA or Texas CUBI.

Order Data

We receive your name, email address, shipping address, and amount paid to process, print, and ship an order. We keep order records for as long as tax and bookkeeping rules require.

Who Processes Your Data

• Optional website analytics: Microsoft Clarity, PostHog, and Google Analytics 4 measure site use and attribution after consent.
• Hosting and storage: Vercel hosts the site and stores artwork and temporary photo uploads.
• Aggregate website analytics: Vercel Web Analytics reports site visits and traffic details without cookies or device identifiers.
• Artwork generation and safety checks: Google Gemini generates artwork and text; OpenAI screens uploaded photos before artwork is generated.
• Orders and payment: Printful prints and ships purchased artwork; Stripe processes payments.
• Site operations: Upstash provides rate limiting and daily spend counters; SendGrid sends order emails.

Retention at a Glance

Deleting Something Sooner

Email privacy@canvasgenie.ai and tell us what you want removed.

Children's Privacy

CanvasGenie is for adults 18 and older. People under 18 may not use the service. Adults may upload photos of children with permission from a parent or guardian.

Security

Uploaded photos are kept in private storage and are not shown in a public gallery. We do not use face recognition. Contact privacy@canvasgenie.ai to report a privacy concern.

Changes to This Policy

We will update this page if our data practices change. The date at the top shows when this policy was last updated.

More Information

For more information about how Microsoft collects and uses your data, please visit the Microsoft Privacy Statement.

Contact Us

For privacy questions or deletion requests, email privacy@canvasgenie.ai.