Privacy Policy

Last updated: 2 October 2026. This policy explains what CanvasOfYou collects when you make a portrait, why, who helps us process it, how long we keep it, and how to delete it.

CanvasOfYou (canvasofyou.com) is operated by App Agentic Ltd, a company registered in England and Wales (company number 16428873). "We" and "us" mean App Agentic Ltd. Questions or requests: support@canvasofyou.com.

What we collect

•  Photos you upload, and the portraits we create from them (including any text you type to edit a portrait).

•  Your email address, if you give it to us to see or save your portrait, place an order, or hear about new styles.

•  For physical orders: your name and shipping address.

•  Payment details are entered into our payment provider's secure form (Stripe). We never see or store your full card number; we receive a payment reference, the amount paid and, for saved cards, the card brand and last four digits.

•  Technical data needed to run and protect the site: your IP address (rate limits and fraud prevention), your browser type, and a bot-check score from Google reCAPTCHA when you upload a photo.

•  Cookies and similar technologies (see "Cookies and ad measurement" below).

How we use it

To create your portrait and let you retry or edit it; to deliver digital downloads; to print and ship physical orders; to run your Portrait Plan membership; to email you your portrait link, up to two reminders about a portrait you haven't bought (with an unsubscribe link), order confirmations, membership notices and shipping updates; to prevent abuse and fraud; and to measure which of our ads work. We don't sell your photos or portraits, and we never use your photos or portraits in ads or as examples without asking you first.

We don't create or store face templates, face embeddings or other biometric identifiers. Your photo is sent to the image model only to paint the portrait you asked for.

Who processes it for us

•  OpenAI creates the portraits from your photo and screens edit instructions for harmful content. Under OpenAI's API terms, data sent through the API isn't used to train their models and may be kept by OpenAI for up to 30 days for abuse monitoring.

•  fal (Topaz upscaling) enlarges a portrait to print resolution after you buy it.

•  Google Cloud and Firebase host the site and store your photos, portraits and order records privately, in the United States. Google reCAPTCHA checks uploads for bots; Google's Privacy Policy and Terms of Service apply to it.

•  Stripe processes payments on our behalf; CanvasOfYou appears on your card statement. Stripe's own privacy policy applies to the payment details you enter, and Stripe may use them to prevent fraud.

•  Printful prints and ships physical orders from facilities in the United States, the United Kingdom, Canada or Australia. It receives your name, shipping address, email address and the print file.

•  Resend delivers our emails. It receives your email address and the message.

•  Meta (Facebook, Instagram), TikTok and OpenAI (ads in ChatGPT), for ad measurement, as described below.

•  Microsoft Clarity records how visitors use our pages (clicks, scrolling and mouse movement, as session recordings and heatmaps) so we can find and fix confusing parts of the site. Your photos, your portraits, the email and address fields and the edits you type are hidden from these recordings. Clarity sets its own cookies (such as _clck and _clsk) and receives your IP address, browser type and the pages you visit. Global Privacy Control turns it off. Microsoft's Privacy Statement (https://privacy.microsoft.com/privacystatement) applies.

These providers may process data in the United States and other countries. We share only what each needs to do its job.

Cookies and ad measurement

One essential cookie keeps your portraits private to your browser. It is needed for the site to work.

When we run ads, we use the Meta Pixel, the TikTok Pixel and the OpenAI Measurement Pixel (for ads in ChatGPT), and send the same events from our server (Meta Conversions API, TikTok Events API, OpenAI Conversions API). They tell Meta, TikTok and OpenAI when someone who saw an ad visits a page, gives an email, starts a checkout or buys, so we can see which ads work and show them to people likely to be interested. These tools set their own cookies (such as _fbp, _fbc, _ttp, __oppref and __obref) and may receive your IP address, browser type, the pages you visit, order values, the ad campaign that brought you, and your email address in hashed (scrambled) form; for an order we ship, also your name (hashed the same way), city, state, ZIP code and country. Meta, TikTok and OpenAI use this under their own privacy policies.

Under some US state laws (for example California's), this can count as "sharing" personal information for targeted advertising. You can opt out: turn on Global Privacy Control in your browser (we honor it: the pixels don't load and we send no server events for your orders), block third-party cookies, or email us. We don't knowingly sell or share personal information of anyone under 16.

Our own site analytics

We also count how people use the site ourselves, so we can see which steps work and which don't: pages viewed, the steps of making a portrait (who it's for, the style you pick, how many photos you add), which products, sizes and plans you look at, portraits made, checkouts, purchases, cancellations and refunds. Your browser keeps a random id for this (in its local storage). We store these events in Google Cloud (BigQuery, United States) for up to 400 days, linked to your CanvasOfYou visit by a scrambled id. We never store your IP address, browser details, email, photos, portraits or anything you type, and we don't share this data with Meta, TikTok or anyone else. Global Privacy Control turns it off too, and you can ask us to delete it by email.

Photos of children

Portraits of children can only be made by an adult who is the child's parent or legal guardian, and who confirms this before uploading. We use these photos only to make the portrait you asked for. The site isn't meant for children to use themselves, and we don't knowingly collect personal information from children.

How long we keep it

•  Uploaded photos are deleted automatically 30 days after upload.

•  Portraits you haven't bought stay available so you can come back to them, until you delete them (see below).

•  Portraits you've bought, and order records, are kept so you can download what you bought, so we can honor our 14-day money-back guarantee and reprint damaged or lost orders, and for as long as tax and accounting law requires.

•  Email addresses on file are kept until you ask us to delete them.

Delete your photos

On your portrait page, choose "Delete my photos". This immediately deletes every photo you uploaded and every portrait you haven't bought, and removes your email address from that session. For portraits you've paid for, we keep the finished artwork and order record only as long as needed to deliver, support and account for the order; email support@canvasofyou.com and we'll delete what we're allowed to once that's done.

Your rights

Depending on where you live (for example California and other US states, Canada, Australia, or the UK and EU), you can ask to access, correct or delete your personal information, ask what we hold about you and who we share it with, or opt out of targeted advertising. Email support@canvasofyou.com and we'll respond within 30 days. We won't treat you differently for using these rights. If you're unhappy with our answer, you can complain to your local privacy regulator.

Security

Your photos and portraits are stored privately. Only a watermarked preview is shown before purchase, and only the browser that made a portrait (or the private link we email you) can open it. Full-resolution files are only available after purchase.

Changes

If we change this policy we'll update the date above, and for significant changes we'll tell you on the site or by email before they apply.

Contact

support@canvasofyou.com. App Agentic Ltd, company number 16428873, England and Wales.