Privacy policy · canvasletter

Last updated: October 10, 2026

This policy explains what personal data canvasletter collects, why, who we share it with and the choices you have. canvasletter is run by Cypress Technologies LLC, a United States limited liability company ("we", "us"). Questions go to support@canvasletter.com, and a person reads every message.

The short version

We collect what we need to run your account and design your issues, and nothing for advertising.
Your issues, brand kits and images are yours. We don't sell them, and we don't use them to train AI models.
Anthropic, the AI provider behind canvasletter, doesn't train its models on data sent through its API.
Images you upload and pages you publish are public to anyone who has their link, because emails need to load them.
You can delete your account at any time, and you can ask us for a copy of your data.

What we collect

Information you give us

Account details: your name, email address and password (stored only as a secure hash), or your Google account's name and email if you sign in with Google. If you turn on two-factor authentication or passkeys, we store what they need to work.
Workspace content: the notes, drafts and prompts you give the AI, the issues it designs, your edits and version history, brand kits (colors, fonts, logos and the web address you ask us to read a brand from), images you upload, and pages you publish.
Billing details: when paid plans are available, Stripe handles your card. We see only the plan, the amounts and the last four digits, never the full card number.
Messages: what you send through the contact or report forms, or by email.
Waitlist: if you joined the waitlist, your email address, the email tool you said you use and how you found us.

Information collected automatically

Usage and device data: pages viewed, the browser and device type, and approximate location from your IP address. We use Vercel Analytics, which counts visits without cookies, and may add pseudonymous product analytics (PostHog, hosted in the EU) that never receives the content of your issues or your email address.
Logs and errors: our hosting and error-tracking providers record IP addresses, request details and your user ID when something breaks, so we can fix it.
Security checks: Cloudflare Turnstile checks that forms are sent by a person.
Cookies: see our cookie policy.

How we use it

To provide canvasletter: create your account, design and store your issues, render exports and hosted pages, and send the emails you ask for (verification, password resets, test sends and receipts).
To run AI features: when you ask the AI to draft or edit, we send the relevant text, your brand kit and the instruction to our AI provider and return the result to you.
To keep the service safe: prevent abuse, enforce rate limits, review reports about published pages and keep accounts secure.
To improve the product: understand which features are used and fix problems. We use aggregate and pseudonymous data for this, not the words of your issues.
To talk to you: replies to your messages, important notices about your account or these policies, and, if you joined the waitlist, news about access. We don't send marketing email without your consent.
To meet legal obligations: tax, accounting and responding to lawful requests.

Where the GDPR or UK GDPR applies, our legal bases are: performing our contract with you (running the service), our legitimate interests (security, abuse prevention and improving the product), your consent (optional cookies and marketing email, which you can withdraw at any time) and legal obligations.

AI and your content

We don't use your content to train AI models, ours or anyone else's.
Our AI provider, Anthropic, processes your content only to answer your request and doesn't train on data sent through its API under its commercial terms.
The AI designs around your words. It never sends, exports or publishes anything; only you can.

Who we share it with

We don't sell personal data or share it for advertising. We share it only with:

Service providers that help us run canvasletter, under contracts that limit them to our instructions. The current list, with what each one does and where, is on our subprocessors page.
Tools you connect: when you push an issue to your email platform (such as Kit or Mailchimp), we send that issue to the account you connected. That platform's own policy then applies.
The public, when you choose: published web pages and the images in your issues are reachable by anyone who has their link.
Legal and safety reasons: when the law requires it, or to protect people, our users or canvasletter from harm or fraud.
A business transfer: if canvasletter is sold or merged, your data moves with it under this policy, and we'll tell you first.

Where your data is stored

Our main systems are in the United States. Some providers process data elsewhere (our subprocessors page lists where). When we transfer personal data from the EU, the UK or Switzerland, we rely on the Standard Contractual Clauses or the EU–US Data Privacy Framework where the provider is certified.

How long we keep it

Account and workspace content: for as long as your account exists. Issues you delete leave our live systems.
What you give the AI: the notes, drafts and instructions you send with an AI request, and the raw answer, are kept for 30 days so we can look into problems, then deleted. The issues the AI designs stay as long as you keep them.
Images you upload but never use: deleted after 30 days if they aren't in any issue, saved version or brand kit and were never exported or published.
Brands read from a website: the result is kept for 90 days, then deleted. A brand kit you saved from it stays.
Images in sent emails: images that appeared in an issue you exported or published stay online until you delete the workspace, because emails already in inboxes still point at them.
When you delete a workspace: it stays read-only for 14 days, with its web pages offline, and the owner can cancel. After that we delete it from our live systems, at the latest 30 days after you asked, and it ages out of our backups within 37 days.
When you delete your account: we remove it from our live systems right away, and it ages out of our backups within 37 days.
Billing records: kept as long as tax and accounting law requires.
Logs: kept for up to 90 days.
Waitlist entries: until you ask us to remove them, or once the waitlist is no longer needed.

Your choices and rights

You can view and edit your account details in settings, delete your account there, delete a workspace you own from its settings, and export your issues as HTML. You can also ask us, at support@canvasletter.com, to:

give you a copy of your personal data,
correct or delete it,
restrict or object to how we use it,
move it to another service.

We'll answer within 30 days and may ask you to confirm your identity first. If you're in the EU or UK, you can also complain to your local data protection authority.

California residents: we don't sell or share personal information for cross-context behavioral advertising, and we don't use sensitive personal information beyond what's needed to run the service. You have the rights to know, delete and correct described above, and we won't treat you differently for using them.

Content about other people

Your issues may mention other people. For that content, you decide what goes in it, and we process it on your behalf to provide the service. If you use canvasletter for a business and need a data processing agreement, write to us.

Security

We encrypt data in transit and at rest, keep each workspace's data separate, store passwords only as hashes, encrypt credentials for connected email tools, and offer two-factor authentication and passkeys. No system is perfectly secure; if a breach affects your data, we'll tell you without undue delay.

Children

canvasletter isn't for children. You must be at least 16 to use it, and we don't knowingly collect data from anyone younger. If you believe a child has given us data, write to us and we'll delete it.

Changes to this policy

When we change this policy, we update the date at the top. If a change is significant, we'll tell you by email or in the app before it takes effect.

Contact

Cypress Technologies LLC · support@canvasletter.com