What data Canvane collects, why, and what control you have over it
2026/08/18
Canvane is operated by an independent sole trader trading as Canvane, who is the data controller for the personal data described in this policy. You can reach us at support@canvane.com with any privacy question or to exercise the rights in section 9.
Because Canvane is run by one individual rather than a company, our operator's full legal name and address are not published on this page. We will provide them on request within 5 business days — including where you need them in order to complain to a data protection authority. Email support@canvane.com.
This Privacy Policy explains what personal data we ("we", "us", "our") collect when you use our AI video generation service, why we collect it, who we share it with, and what rights you have.
We follow a minimal-collection approach: we process what is needed to run the Service, bill for it, keep it secure, and improve it.
Account data. Your email address, name, and profile image as provided by Google or GitHub when you sign in; your role; and session records. We never receive your Google or GitHub password.
Generation data. The prompts you submit, the model and settings you choose, and the generated video. We store all three. Your prompt is kept so we can operate and support the Service and investigate breaches of our Acceptable Use Policy; your video is copied to our own storage so that it keeps working after the model provider's own link expires, which it does within a day. A prompt is also transmitted to our routing partner and to your chosen model provider to fulfil the request, and to the moderation services to screen it. Section 7 gives how long each is kept. Prompts are the core of what this Service processes — please read section 4 on how they are shared, and do not put personal, confidential, or sensitive information in one.
Screening outcomes. When screening blocks a prompt, we record which service blocked it, the kind of decision it made, and which Acceptable Use Policy categories it matched. That record is a counter held on our own analytics instance: it carries no prompt text, no account identifier, and nothing else that ties it to you. A blocked prompt is not written to our database at all, and a prompt that passes screening leaves no screening record. Because nothing connects a block to your account, a request for human review under section 9 has to include the prompt.
Billing data. Plan and subscription status, credit balance and credit transaction history, order and payment records, and invoice identifiers. We do not receive or store your full payment card number — see section 4.
Technical and security data. IP address, device and browser information, request logs, error reports, and anti-abuse signals.
Website usage and session replay. Aggregate traffic measurement, and anonymised recordings of how pages are used — clicks, scrolling, and mouse movement — captured by Microsoft Clarity. Text you type into form fields is masked. See section 4.
Communications. Messages you send us via support or contact forms, and your newsletter subscription status.
Cookies. Used for authentication, session management, security, language preference, and analytics. See our Cookie Policy.
We use the data above to:
We do not sell your personal data, and we do not use your prompts or generated videos to train our own models.
We share limited data with the service providers needed to operate Canvane:
We may also disclose data where legally required, to enforce our Terms, or to protect the rights, safety, and property of Canvane, our users, or the public. If we are ever involved in a merger, acquisition, or asset sale, data may transfer as part of that transaction; we will notify you if that happens.
We do not subscribe you to marketing email when you create an account. The product newsletter is opt-in: you can subscribe from your notification settings, and unsubscribe at any time from there or via the link in any newsletter email.
Unsubscribing does not affect service, billing, or security emails, which are necessary to operate your account and are sent regardless of your newsletter preference.
Our providers operate in a number of countries, so your data may be processed outside the country where you live, including in jurisdictions with different data-protection laws. Where required, we rely on appropriate safeguards — such as the European Commission's Standard Contractual Clauses — for those transfers.
When a retention period ends, data is deleted or irreversibly anonymised.
We use encrypted connections (HTTPS/TLS) throughout, restrict internal access to personal data, delegate authentication to Google and GitHub, and never handle raw payment card data. No system is perfectly secure, and we cannot guarantee absolute security.
Breach notification. If a breach affects your personal data, we will notify any relevant supervisory authority and — where the breach is likely to put your rights at high risk — you directly, within 168 hours (7 days) of becoming aware of it. Where a shorter statutory deadline applies, we meet that instead: under the GDPR, notification to a supervisory authority is made within 72 hours.
Subject to applicable law, you may:
You can do much of this directly in your account settings. For anything else, email support@canvane.com. We respond within 30 days — the period the GDPR allows. Where a request is complex, or where you have made several, we may extend that by up to two further months; if we do, we will tell you within the first month and explain why. We usually reply sooner.
Some data must be retained despite a deletion request, for tax, accounting, fraud-prevention, dispute-resolution, or other legal-compliance reasons.
If you are in the EEA or UK, you have the right to complain to your local data protection authority.
Where the GDPR applies, we rely on:
The Service is not intended for children under 13, and we do not knowingly collect their personal data. In the EEA and the UK, where national law sets a higher age for consenting to online services — between 13 and 16 depending on the country — users below that age need their parent or guardian's consent. If you believe a child below the applicable age has given us personal data, contact support@canvane.com and we will delete it.
We may update this Privacy Policy. Material changes will be posted here with a revised date at least 30 days before they take effect, and where the change significantly affects your rights we will also make a reasonable effort to notify you by email.
Questions, requests, or complaints about privacy: support@canvane.com.