Cookie Policy

1. Introduction

This Cookie Policy explains how CanvasaaS ("we", "us", "our"), operated by Tyga.Cloud Ltd (Company No: 14643275), uses cookies and similar tracking technologies when you visit or interact with our platform at canvasaas.com.

CanvasaaS is an AI-powered strategic business analysis SaaS platform that enables startups, consultants, and investors to create and manage business strategy canvases, including Business Model Canvas, SWOT Analysis, Porter's Five Forces, Value Proposition Canvas, Lean Canvas, financial forecasts, and more. Because our platform serves multiple users and organisations -- each with their own workspace -- this policy covers cookies set across all workspaces operated through our infrastructure.

This Cookie Policy should be read alongside our Privacy Policy and Terms of Service, which provide further detail on how we collect, use, and protect your personal data. By continuing to use CanvasaaS, you acknowledge that you have read and understood this Cookie Policy.

Tyga.Cloud Ltd is registered in England and Wales. Our registered office is at Ground Floor, Unit 2 Mallard Court, Mallard Way, Crewe Business Park, Crewe, Cheshire, England, CW1 6ZQ.

2. What Are Cookies

Cookies are small text files that are stored on your device (computer, tablet, or mobile phone) when you visit a website. They are widely used to make websites function correctly, improve performance, and provide information to the website operators. Cookies allow a website to recognise your device and remember certain information about your visit, such as your preferences, login status, and workspace settings.

In addition to traditional cookies, CanvasaaS and similar web platforms may use the following related technologies:

• localStorage: A web storage mechanism that allows websites to store key-value pairs persistently in your browser. Unlike cookies, localStorage data is not sent to the server with every HTTP request. We use localStorage to store your cookie consent preference and certain non-sensitive user interface settings.
• Session Storage: Similar to localStorage, but data stored in session storage is cleared when the browser tab or window is closed. This may be used for temporary state management during your browsing session.
• Web Beacons (Clear GIFs/Pixel Tags): Tiny, invisible graphic images embedded in web pages or emails. These may be used to track whether a page has been viewed or an email has been opened, and to gather basic usage statistics.
• Tracking Pixels: Small snippets of code embedded on web pages that allow third-party services (such as analytics providers) to collect information about user interactions, including page views, referral sources, and conversion events.

Throughout this policy, when we refer to "cookies", we include all of the above technologies unless otherwise specified.

3. Types of Cookies

Session Cookies vs Persistent Cookies

Session cookies are temporary cookies that are stored on your device only for the duration of your browsing session. They are automatically deleted when you close your browser. CanvasaaS uses session cookies primarily for authentication and maintaining your login state as you navigate the platform.

Persistent cookies remain on your device for a set period of time (defined by the cookie's expiration date) or until you manually delete them. These cookies allow the website to remember your preferences and recognise you on subsequent visits. Examples include analytics cookies and your cookie consent preference stored via localStorage.

First-Party Cookies vs Third-Party Cookies

First-party cookies are set directly by CanvasaaS (i.e., the domain you are visiting). These include our session authentication cookie and functional cookies that are essential to the operation of the platform.

Third-party cookies are set by external services that we integrate with, such as payment processors (Stripe) and analytics providers (Google Analytics). These cookies are governed by the respective third party's own cookie and privacy policies.

4. Cookie Categories

Strictly Necessary Cookies

These cookies are essential for the operation of CanvasaaS. Without them, core functionality such as user authentication and security protections would not work. You cannot opt out of strictly necessary cookies, as they are required for the platform to function.

• Session Authentication: Our primary session cookie (connect.sid) maintains your authenticated session as you navigate between pages. This cookie is backed by a Redis data store on our servers, meaning the cookie itself contains only a session identifier rather than any personal data.
• Security: Session cookies help protect against cross-site request forgery (CSRF) and other security threats by verifying that requests originate from authenticated users.
• Workspace Context: Session data stored server-side (linked to your session cookie) maintains your active workspace context, ensuring that your canvases, strategies, and analyses are correctly associated with your account as you navigate the platform.
• Payment Processing: Cookies set by Stripe (our payment processor) are necessary for secure subscription payment transactions, fraud prevention, and compliance with financial regulations.

Performance and Analytics Cookies

Performance cookies collect anonymised information about how visitors use CanvasaaS, such as which pages are visited most often, how long users spend on certain pages, and whether users encounter error messages. This data helps us understand usage patterns and improve the platform experience.

• We may use Google Analytics or similar analytics services to collect aggregate, non-personally-identifiable data about site usage.
• Analytics data is used to identify trends, monitor platform health, and prioritise feature development.
• These cookies do not collect information that directly identifies you.

Functional Cookies

Functional cookies enable enhanced features and personalisation. They may remember choices you have made (such as your preferred language, theme settings, or region) to provide a more tailored experience.

• Cookie Consent Preference: We store your cookie consent acceptance in your browser's localStorage so that the consent banner is not shown on subsequent visits.
• Theme and Display Settings: If the platform offers customisable display options (such as light/dark mode), your preference may be stored locally to persist across sessions.
• Language and Locale: If applicable, your language preference may be stored to deliver content in your chosen language.

Marketing and Advertising Cookies

At present, CanvasaaS does not use marketing or advertising cookies on the core platform. We do not serve targeted advertisements or participate in ad networks. If this changes in the future, we will update this policy and seek your consent where required by law.

5. Specific Cookies We Use

The following table details the specific cookies and storage mechanisms used by CanvasaaS:

Name	Type	Category	Duration	Purpose
connect.sid	Cookie (First-party)	Strictly Necessary	Session (expires when browser closes)	User authentication and session management. Contains a unique session identifier linked to a server-side Redis store. Maintains login state and workspace context as you navigate the platform.
cookieConsent	localStorage (First-party)	Functional	Persistent (until manually cleared)	Records that you have accepted the cookie consent banner. Prevents the banner from being displayed on subsequent visits.
_ga	Cookie (Third-party)	Performance	2 years	Set by Google Analytics (if enabled). Used to distinguish unique users by assigning a randomly generated identifier. Collects anonymised data about site usage patterns.
_gid	Cookie (Third-party)	Performance	24 hours	Set by Google Analytics (if enabled). Used to distinguish users and throttle request rates. Stores and updates a unique value for each page visited.
stripe_mid	Cookie (Third-party)	Strictly Necessary	1 year	Set by Stripe for subscription payment processing. Used for fraud prevention, secure transaction handling, and compliance with payment card industry (PCI) standards.

Please note that the cookies listed above may change over time as we update our platform and integrate new services. We will keep this table up to date and notify you of any material changes.

6. Third-Party Services

CanvasaaS integrates with several third-party services that may set their own cookies on your device. We do not control the cookies placed by these third parties, and their use is governed by their respective privacy and cookie policies.

Stripe (Payment Processing)

We use Stripe to process subscription payments on the platform. Stripe sets cookies for fraud detection, secure payment processing, and regulatory compliance. Stripe operates as an independent data controller for payment-related data. For more information, see Stripe's Privacy Policy and Stripe's Cookie Policy.

Google Analytics (Usage Analytics)

We may use Google Analytics to collect aggregated, anonymised data about how visitors interact with CanvasaaS. Google Analytics uses cookies (such as _ga and _gid) to track page views, session duration, referral sources, and other usage metrics. This information helps us improve the platform. Google processes this data in accordance with Google's Privacy Policy. You can opt out of Google Analytics by installing the Google Analytics Opt-out Browser Add-on.

7. Multi-Tenant Platform Cookies

CanvasaaS is a multi-tenant platform, which means that multiple users and organisations share the same underlying infrastructure while each having their own workspace containing their canvases, strategies, and analyses. This architecture has specific implications for how cookies work:

• Session Cookie Scoping: The connect.sid session cookie is set at the platform domain level. The server-side session data (stored in Redis) is scoped per user and workspace. This means that your session context -- including your login state and active workspace -- is automatically associated with your specific account.
• Workspace Data Isolation: Your canvases, business strategies, and analytical data are stored within your server-side session and account, ensuring complete isolation from other users. Data created in one workspace is not accessible to users of another workspace.
• Cross-Workspace Sessions: If you are a member of multiple organisations or workspaces, your session maintains the context of your currently active workspace. The platform ensures that sessions are properly segregated for security purposes.
• User-Specific Preferences: Any preferences or functional cookies you set (such as theme preferences or display settings) are stored locally in your browser and apply to your use of the platform.

This user-scoped approach ensures that your data remains isolated and is only accessible within the context of your own account and workspace. No personal data from one user is shared with or accessible to another user.

8. Cookie Management

You have the right to control and manage cookies on your device. Most web browsers allow you to view, manage, delete, and block cookies through their settings. Please be aware that disabling or blocking certain cookies may affect the functionality of CanvasaaS, particularly strictly necessary cookies required for authentication and session management.

Managing Cookies in Your Browser

Below are instructions for managing cookies in the most commonly used browsers:

• Google Chrome: Go to Settings > Privacy and Security > Cookies and other site data. From here you can block third-party cookies, clear cookies on exit, or manage exceptions for specific sites. You can also view and delete individual cookies by going to Settings > Privacy and Security > Cookies and other site data > See all cookies and site data.
• Mozilla Firefox: Go to Settings > Privacy & Security > Cookies and Site Data. You can choose to block cookies, clear data, and manage exceptions. Firefox also offers Enhanced Tracking Protection, which automatically blocks known third-party tracking cookies.
• Apple Safari: Go to Preferences > Privacy. Safari allows you to block all cookies, prevent cross-site tracking, and manage stored website data. On iOS, go to Settings > Safari > Privacy & Security to manage cookie settings.
• Microsoft Edge: Go to Settings > Cookies and site permissions > Manage and delete cookies and site data. You can block third-party cookies, clear cookies when you close the browser, and manage per-site exceptions.

Clearing localStorage

Because we use localStorage to store your cookie consent preference, you may wish to clear it separately from cookies. To do this:

• Open your browser's Developer Tools (usually by pressing F12 or right-clicking the page and selecting "Inspect").
• Navigate to the "Application" tab (Chrome/Edge) or "Storage" tab (Firefox).
• Under "Local Storage", find the entry for CanvasaaS and delete the cookieConsent key, or clear all localStorage for the site.

Alternatively, most browsers allow you to clear all site data (including cookies, localStorage, and session storage) through their standard "Clear browsing data" function.

Opting Out of Analytics

If you wish to opt out of Google Analytics tracking specifically, you can install the Google Analytics Opt-out Browser Add-on, which prevents Google Analytics JavaScript from sharing information about visit activity with Google Analytics.

9. GDPR and Legal Compliance

Legal Basis for Using Cookies

Under the UK General Data Protection Regulation (UK GDPR) and the Privacy and Electronic Communications Regulations 2003 (PECR), we rely on the following legal bases for our use of cookies:

• Strictly Necessary Cookies: These are exempt from the consent requirement under PECR Regulation 6(4), as they are essential for the provision of the service you have requested (e.g., authentication, session management, payment processing).
• Performance, Functional, and Other Cookies: For cookies that are not strictly necessary, we rely on your consent. When you first visit CanvasaaS, a cookie consent banner is displayed. By clicking "Accept", you consent to the use of non-essential cookies as described in this policy. Your consent preference is stored in localStorage so that the banner is not shown again.

Your Rights Under GDPR

Under the UK GDPR and EU GDPR (where applicable), you have the following rights in relation to any personal data collected through cookies:

• Right of Access: You may request a copy of the personal data we hold about you, including data collected via cookies.
• Right to Rectification: You may request that we correct any inaccurate personal data.
• Right to Erasure: You may request the deletion of your personal data, subject to certain legal exceptions.
• Right to Restrict Processing: You may request that we restrict the processing of your personal data in certain circumstances.
• Right to Data Portability: Where processing is based on consent or contract, you may request your data in a structured, commonly used, machine-readable format.
• Right to Object: You may object to the processing of your personal data, particularly for direct marketing or profiling purposes.
• Right to Withdraw Consent: Where we rely on consent for non-essential cookies, you may withdraw your consent at any time by clearing your cookies and localStorage, after which the consent banner will be shown again.

To exercise any of these rights, please contact us using the details in the Contact Us section below.

CCPA Compliance (California Residents)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA). CanvasaaS does not sell personal information collected through cookies. You have the right to know what personal information is collected about you, to request deletion of your personal information, and to be free from discrimination for exercising your CCPA rights. For more details, please refer to our Privacy Policy.

10. Mobile Devices

When you access CanvasaaS from a mobile device (smartphone or tablet), we use the same cookies and similar technologies described in this policy. Mobile browsers support cookies, localStorage, and session storage in the same way as desktop browsers.

Additionally, mobile devices may use the following related technologies:

• Device Identifiers: Mobile operating systems may assign unique identifiers to your device. CanvasaaS does not directly use device identifiers, but third-party services (such as analytics providers) may collect them in accordance with their own policies.
• App Cache and Web Storage: If you access CanvasaaS through a mobile browser, the browser's web storage mechanisms (localStorage, session storage) function identically to desktop browsers. Data stored in these mechanisms persists until you clear your browser data.
• Progressive Web App (PWA) Data: If CanvasaaS offers a progressive web app experience in the future, additional storage mechanisms (such as the Cache API and IndexedDB) may be used to enable offline functionality. Any such usage will be reflected in an updated version of this policy.

To manage cookies and site data on your mobile device, access your mobile browser's settings. The steps vary by browser and operating system, but generally you can find cookie management options under Privacy or Security settings within the browser's configuration menu.

11. Updates to This Policy

We may update this Cookie Policy from time to time to reflect changes in our use of cookies, changes in the law, or updates to our platform and third-party integrations. When we make changes to this policy:

• The "Effective Date" at the top of this page will be updated to reflect the date of the most recent revision.
• For material changes (such as the introduction of new cookie categories or significant changes to third-party integrations), we will provide prominent notice on our website, such as a banner or notification on the homepage.
• If the changes require renewed consent under applicable law (e.g., the introduction of marketing cookies), we will reset the cookie consent mechanism so that you are prompted to review and accept the updated policy.
• Account owners who manage workspaces on CanvasaaS will be notified via email or dashboard notification of any material changes that may affect their compliance obligations.

We encourage you to review this policy periodically to stay informed about how we use cookies. Your continued use of CanvasaaS after any changes to this policy constitutes your acceptance of the updated terms.

12. Contact Us

If you have any questions, concerns, or requests regarding this Cookie Policy, our use of cookies, or your rights under data protection law, please contact us:

• Data Protection Officer: dpo@tyga.cloud
• Company: Tyga.Cloud Ltd (Company No: 14643275)
• Registered Address: Ground Floor, Unit 2 Mallard Court, Mallard Way, Crewe Business Park, Crewe, Cheshire, England, CW1 6ZQ

We aim to respond to all legitimate requests within one month. If your request is particularly complex or you have made multiple requests, we may need up to three months to respond, in which case we will notify you and keep you updated on progress.

If you are unsatisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's data protection supervisory authority. You can contact the ICO at ico.org.uk or by calling 0303 123 1113.