Privacy Policy

1.1 Information You Provide Directly

• Account information when you sign in via Google OAuth (name, email address, profile photo)
• Content you submit to the Service (prompts, uploaded images, chat history)
• Payment information processed securely by Stripe (we do not store card details)
• Communications you send us (support emails, feedback)

1.2 Information Collected Automatically

• Log data: IP address, browser type and version, pages visited, time and date of visit
• Device information: hardware model, operating system, unique device identifiers
• Usage data: features used, diagrams generated, credits consumed, session duration
• Cookies and similar tracking technologies (see Section 6)

1.3 Information from Third Parties

When you sign in using Google, we receive basic profile information (name, email, avatar) as permitted by your Google account settings. We do not receive access to your Google Drive, Gmail, or other Google services.

We use the information we collect to:

• Provide, operate, and maintain the Service
• Process your AI generation requests and manage your credit balance
• Authenticate your identity and manage your account
• Process payments and send transaction confirmations
• Send administrative communications (security alerts, policy updates)
• Respond to customer support inquiries
• Monitor and analyse usage patterns to improve the Service
• Detect, prevent, and address fraud, abuse, or security incidents
• Comply with legal obligations

We do not sell your personal data to third parties. We do not use your content to train AI models without your explicit consent.

If you are located in the European Economic Area (EEA) or UK, we process your personal data under the following legal bases:

• Contract performance: to provide the Service you have signed up for
• Legitimate interests: to improve the Service, ensure security, and prevent fraud
• Consent: for analytics cookies and optional marketing communications
• Legal obligation: to comply with applicable laws and regulations

We may share your information with:

Service Providers

• OpenAI / Anthropic / OpenRouter — AI processing of your prompts (subject to their privacy policies)
• Google — authentication and image generation via Gemini API
• Stripe — payment processing
• Vercel — hosting and infrastructure
• MongoDB / database providers — data storage

All service providers are contractually required to handle your data securely and only for the purposes we specify.

Legal Requirements

We may disclose your information if required by law, court order, or governmental authority, or if we believe disclosure is necessary to protect our rights, prevent fraud, or ensure the safety of our users.

Business Transfers

In the event of a merger, acquisition, or sale of all or a portion of our assets, your information may be transferred as part of that transaction. We will notify you via email and/or prominent notice on the Service before your data is transferred and becomes subject to a different privacy policy.

We retain your personal data for as long as your account is active or as needed to provide the Service. Specifically:

• Account data: retained until you delete your account
• Conversation and generation history: retained for 12 months, then anonymised
• Payment records: retained for 7 years as required by tax law
• Server logs: retained for 90 days

Upon account deletion, we will delete or anonymise your personal data within 30 days, except where retention is required by law.

We use the following types of cookies:

• Essential cookies: required for authentication and session management (cannot be disabled)
• Analytics cookies: Google Analytics — help us understand how users interact with the Service
• Preference cookies: remember your settings (e.g. light/dark mode, language)

You can control non-essential cookies through your browser settings. Note that disabling cookies may affect the functionality of the Service.

Depending on your location, you may have the following rights:

• Access: request a copy of the personal data we hold about you
• Rectification: request correction of inaccurate or incomplete data
• Erasure: request deletion of your personal data (“right to be forgotten”)
• Restriction: request that we limit how we use your data
• Portability: receive your data in a structured, machine-readable format
• Objection: object to processing based on legitimate interests
• Withdraw consent: where processing is based on consent, withdraw it at any time
• Non-discrimination (CCPA): we will not discriminate against you for exercising your rights

To exercise any of these rights, email us at support@neuralcanvas.io. We will respond within 30 days. You also have the right to lodge a complaint with your local data protection authority.

We implement industry-standard technical and organisational measures to protect your personal data, including:

• TLS/HTTPS encryption for all data in transit
• Encryption of sensitive data at rest
• Access controls limiting data access to authorised personnel only
• Regular security reviews and vulnerability assessments

However, no method of transmission over the internet or electronic storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

Neural Canvas Inc. is based in the United States. If you access the Service from outside the US, your data may be transferred to and processed in the US and other countries where our service providers operate.

For transfers from the EEA/UK, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission to ensure adequate protection of your personal data.

The Service is not directed to children under the age of 13 (or 16 in the EEA). We do not knowingly collect personal data from children. If you believe a child has provided us with personal information, please contact us immediately at support@neuralcanvas.io and we will delete it promptly.

The Service may contain links to third-party websites or services. We are not responsible for the privacy practices of those third parties. We encourage you to review the privacy policies of any third-party sites you visit.

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy on this page and updating the “Last updated” date. For significant changes, we will also send an email notification to the address associated with your account at least 14 days before the changes take effect. Your continued use of the Service after changes become effective constitutes acceptance of the revised policy.

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: