Privacy Policy

This policy explains what data Canvlo collects, why, and how it is handled. The short version: we collect only what the product needs to work, we never sell your data, and merchants own the customer information their storefronts collect.

• Account data — your name, email, username, password (stored only as a hash), profile image, and sign-in method.
• Store data — store name, link, WhatsApp number, country, currency, language, and industry.
• Product data — product titles, descriptions, prices, variants, and images you upload.
• Order data — customer name, phone number, shipping details, and notes submitted through your storefront, collected on your behalf.
• Storefront analytics — page views on public product pages (path, country, referrer, device type), aggregated and not tied to identifiable visitors.
• Technical data — IP addresses, used for rate limiting and abuse prevention.

• To provide the Service — authentication, storefronts, order capture, and notifications.
• To communicate with you — transactional email such as order notifications, verification, and password resets.
• To keep the Service safe — rate limiting, abuse prevention, and fraud detection.
• To improve the product — understanding which features are used, in aggregate.

We do not sell your data or your customers' data. We do not use your content to advertise to anyone, and we do not email your customers — communication with them is yours, on WhatsApp.

Data is shared only with the providers needed to run the Service, under their own privacy obligations:

• Cloudflare — hosting, database (D1), and file storage (R2).
• Resend — transactional email delivery.
• Google — sign-in with Google, if you choose it.
• Stripe — subscription payments, when enabled.

We may also disclose data when required by law or to protect the rights and safety of the Service and its users.

You are the controller of the customer data your storefront collects. Handle it in line with the privacy and consumer laws that apply to you, and only use it to fulfil and follow up on orders.

We keep your data while your account is active. When you delete your account, your store, products, and order data are removed. You can request access, correction, or deletion of your data at any time via your account settings or by emailing us.

The Service runs on Cloudflare's global network, so data may be processed in countries other than yours. Cloudflare maintains certifications covering such transfers.

Canvlo is not directed at children under 13, and accounts are limited to adults. If you believe a child has created an account, contact us and we will remove it.

Data is encrypted in transit, passwords are stored as hashes, and access to production systems is restricted. No method of transmission is perfectly secure, but we work to protect your data and will notify you of any material breach.

We may update this policy as the product evolves. The date above shows the latest revision.

Privacy questions or requests? Reach us at support@canvlo.com.