Privacy Policy
Version 2.0 · Effective September 3, 2026
This policy explains what information Custom Canvas collects, why, who processes it, how long we keep it, and the choices you have. It covers cookies too, in §10.
1. What we collect
You give us:
- Name, email address, password (stored hashed by our auth provider)
- Profile details — avatar, bio, artist story, mediums, neighborhood, education, links
- Listings — titles, descriptions, prices, photographs, tags
- Order details, including the recipient name and shipping address you enter at checkout
- Messages and any files you attach
- Reviews and reports
Artists additionally give Stripe (not us) identity and bank details for payouts. We never see or store your full bank details or card number.
We collect automatically:
- Usage events — listings viewed, pieces saved, artists followed
- Standard request data — IP address, browser type, pages requested
- Error diagnostics when something breaks
Location information. If you choose to use a location feature, your browser or device may provide coordinates, ZIP code, city, or similar location information to Custom Canvas or a geocoding provider (BigDataCloud for coordinates, zippopotam.us for ZIP codes) for the purpose of identifying nearby communities and artwork.
We do not request background location access. The Platform is intended to use location only when you actively use the feature. Depending on the implementation, location information may be transmitted temporarily even if it is not stored in your account.
Your selected community is stored in your browser as described in the location picker itself. You can decline device location and enter a city or ZIP code manually.
In summary, depending on how you use Custom Canvas, we may process identifiers, account credentials, profile information, commercial and transaction records, communications, uploaded content, approximate or device-provided location information, internet or device activity, fraud and security signals, and inferences regarding marketplace preferences.
2. Why we use it
We use this information to:
- create and administer accounts;
- operate listings, search, messaging, purchases, pickup, shipping, payouts, and refunds;
- process payments and applicable taxes;
- prevent fraud, abuse, infringement, and security incidents, including through rate limiting and CAPTCHA;
- investigate disputes and enforce agreements;
- communicate transactional and optional marketing messages;
- analyze and improve the Platform, including understanding which pieces are viewed and saved;
- comply with legal, tax, accounting, and reporting obligations; and
- establish, exercise, or defend legal claims.
We do not sell personal data. We do not use it for advertising or share it with advertisers.
3. Who processes it for us
| Processor | Purpose | What it receives |
|---|---|---|
| Supabase | Database, authentication, file storage | Account data, listings, orders, messages, uploads |
| Stripe | Payments, payouts, tax, artist identity | Payment data, artist KYC and bank details |
| Resend | Transactional email | Email address, message content |
| Vercel | Hosting, analytics, performance | Request and usage data |
| Sentry | Error monitoring | Error context, which may include identifiers |
| Cloudflare Turnstile | Sign-up / sign-in CAPTCHA | Challenge and device signals |
| BigDataCloud | Reverse-geocoding for the location picker | Device coordinates |
| zippopotam.us | ZIP-to-city lookup | ZIP code |
These providers process information under their own terms and applicable data-protection roles. Some act primarily as service providers or processors on our behalf, while others, including payment, tax, fraud-prevention, geolocation, and infrastructure providers, may process certain information as independent controllers or businesses for their own compliance, security, or operational purposes.
Their handling of information may also be governed by their respective privacy notices. Custom Canvas does not control independent processing performed by a provider outside the services it supplies to us.
Between buyers and artists. When necessary to complete a transaction, we disclose relevant buyer information to the selling artist and relevant artist information to the buyer. Each user receiving that information may use it only to complete the transaction, communicate about the order, comply with law, or resolve a related dispute. Users may not use transaction information for unrelated marketing or disclose it publicly.
Legal and corporate. We also share data when the law requires it and to investigate fraud or abuse. We may disclose information as part of a merger, financing, acquisition, reorganization, bankruptcy, sale of assets, or due-diligence process, subject to appropriate confidentiality protections where practicable. Any successor may continue to use the information as described in this Policy unless it provides notice of a materially different practice.
4. What other people can see
- Public: your display name, avatar, and — for artists — profile, story and listings
- Private to the two of you: messages and attachments
- Never public: your email address, which is restricted at the database level and is not readable by other users
- Shared with the artist when you buy: your name and shipping address, so they can post your piece
Artists in draft or pending review are not publicly visible at all.
5. Email
Transactional email — order confirmations, shipping notices, security and account messages — is part of the service and cannot be switched off while you have an account.
Optional email — new listings from artists you follow, price drops, reminders — can be switched off in your account settings or by the unsubscribe link in any such message.
6. How long we keep it
| What | How long | Why |
|---|---|---|
| Order and payment records | 7 years after the sale | Tax, accounting, and defending a dispute or chargeback |
| Artist payout and tax records | 7 years | Same |
| Messages between buyer and artist | 3 years after the last message in the thread | Evidence for disputes and abuse reports |
| Listings and images | Until you delete them, or 90 days after account closure | Sold listings are retained as part of the order record |
| Account profile | Deleted within 30 days of a deletion request | — |
| Error logs and diagnostics | 90 days | — |
| Analytics events | 24 months, aggregated thereafter | — |
| Backups | Purged on a rolling 90-day cycle | Deleted data persists in backups until the cycle completes |
How deletion interacts with records we must keep. If you ask us to delete your account we remove your profile, listings, saved items and preferences, and disconnect your identity from analytics. We cannot delete a completed sale. Tax law, accounting obligations and dispute defense require us to keep the transaction record — order amount, date, tax collected, and the shipping address the piece went to — for seven years. What we do is reduce it to what those obligations need and detach it from your active account.
7. Your rights
You can view and change your information in your account settings, adjust email preferences, or ask us to delete your account by writing to support@customcanvas.shop.
Texas residents. The Texas Data Privacy and Security Act gives Texas consumers rights to access, correct, delete and port their personal data, and to opt out of targeted advertising, the sale of personal data, and certain profiling.
The TDPSA applies to businesses operating in Texas other than a "small business" as defined by the U.S. Small Business Administration. Custom Canvas currently qualifies as a small business, so most of the Act's obligations do not apply to us. One does regardless of size: we will not sell sensitive personal data without your consent, and we do not sell personal data at all.
We honor these rights anyway. Being exempt is not a reason to behave differently. Write to support@customcanvas.shop.
Verifying your request. To protect account security, we may take reasonable steps to verify your identity before completing an access, correction, deletion, or portability request. Verification may require confirmation through the email address associated with the account or additional information reasonably related to the request. An authorized agent may submit a request where permitted by law, but we may require proof of authorization and may separately verify your identity.
If we turn a request down. We may deny or limit a request where permitted by law, including when we cannot verify identity, must retain information for legal or security purposes, or the request would adversely affect another person's rights. We will explain any denial within 45 days, and you may appeal by replying to that decision. We will answer an appeal within 60 days, and if we refuse it again we will tell you how to complain to the Texas Attorney General.
Browser signals. Where your browser sends a Global Privacy Control signal, we treat it as an opt-out of any sale or sharing of personal data. We do not sell or share personal data in any case.
California residents. We do not currently meet the CCPA/CPRA applicability thresholds. We extend the same rights described above to California residents voluntarily, and we do not sell or share personal data for cross-context behavioral advertising.
We will not discriminate against you for exercising any of these rights.
8. Security
Encryption in transit (TLS). Row-level security on the database, so users can only read what they are entitled to. Email addresses and sensitive artist fields are restricted at the database level, not merely hidden in the interface. Passwords are hashed by our auth provider. Rate limiting and CAPTCHA on sensitive endpoints.
No system is perfectly secure, and we will not claim otherwise.
If a breach affects your personal data, we will notify you without unreasonable delay once we have determined what happened and what data was involved. Texas law requires that affected individuals be notified within 60 days of determining that a breach occurred, and that the Texas Attorney General be notified within 30 days where 250 or more Texas residents are affected. We will meet both and aim to tell you sooner where we can do so usefully.
Our notice will describe what happened, what data was involved, what we have done, and what you can do.
9. Age
You must be 18 or over to hold a Custom Canvas account, whether you buy or sell. We do not knowingly collect personal information from anyone under 18. If we learn that an account holder is under 18 we close the account and delete the information, and if you believe a minor has given us information, write to us and we will do the same.
10. Cookies and similar technologies
Strictly necessary. Sign-in and session cookies, set by our authentication provider, that keep you logged in and secure your session. Security cookies set by Cloudflare Turnstile when you sign up or sign in. Without these the site cannot work.
Preferences. Your chosen community (city) and your acknowledgement of the cookie banner are stored in your browser's local storage, not sent to us. Clearing your browser data resets them.
Analytics — and these set no cookies. Vercel Web Analytics and Speed Insights record aggregate usage and page-performance data. They are cookieless: visitors are counted using a hash derived from the request rather than a stored identifier, no personally identifying information is collected, and nothing tracks you across other websites.
We use no advertising or cross-site tracking cookies, and no third-party advertising networks.
Your choices. Most browsers let you refuse or delete cookies. Refusing strictly necessary cookies will prevent you from signing in.
11. Changes
We will post any update here and change the effective date above. Material changes will be notified, and we will tell you what changed.
Questions: support@customcanvas.shop