Privacy statement

Who is responsible?

Canvasara is responsible for processing personal data in this website and app. For privacy questions, contact privacy@canvasara.com.

What data do we process?

We process account data such as name, email address, language, country, role, security settings and login or audit data. For beta access requests, we store the submitted email address.

Canvasara is designed not to store therapy and session material in the cloud. Technical data such as IP address, browser information and timestamps may be processed for security and administration.

Why do we process data?

We use data to manage accounts, enable secure login, process invitations, manage beta requests, prevent abuse and keep the app reliable.

The legal bases are performance of a contract, legitimate interests in security and administration, legal obligations where applicable and consent where specifically requested.

Sharing with others

We only share data when needed for Canvasara to work, for example with hosting, database and email providers. Appropriate agreements are made with these parties.

We do not sell personal data.

Retention

We do not keep personal data longer than needed. Account and security data is kept while the account exists or while needed for security, administration or legal obligations.

Security

Canvasara uses technical and organisational measures to protect data, including secure connections, access control, audit logs, brute-force protection and optional two-factor authentication.

Your rights

You can request access, correction, deletion, restriction or transfer of your personal data. You can also object to certain processing activities.

You also have the right to lodge a complaint with your privacy supervisory authority.