Privacy Policy

1. Introduction

Welcome to CanvasaaS. This Privacy Policy explains how Tyga.Cloud Ltd (Company No: 14643275), trading as CanvasaaS ("we," "us," "our," or "CanvasaaS"), collects, uses, discloses, and safeguards your personal information when you visit our website at canvasaas.com (the "Website"), use our AI-powered strategic business analysis platform (the "Platform"), or interact with any of our related services (collectively, the "Services").

Tyga.Cloud Ltd is registered in England and Wales with its registered office at Ground Floor, Unit 2 Mallard Court, Mallard Way, Crewe Business Park, Crewe, Cheshire, England, CW1 6ZQ.

CanvasaaS is an AI-powered SaaS platform that enables startups, consultants, and investors ("Account Owners" or "Users") to create, manage, and collaborate on strategic business analysis frameworks, including Business Model Canvas, Lean Canvas, SWOT Analysis, Porter's Five Forces, Value Proposition Canvas, Financial Forecasts, and other strategy tools. Users may invite team members and collaborators ("Team Members" or "Collaborators") to view and contribute to their workspaces.

For the purposes of this Privacy Policy, the following definitions apply:

• "Personal Data" means any information relating to an identified or identifiable natural person, including but not limited to name, email address, postal address, telephone number, payment information, IP address, device identifiers, and any other information that can be used directly or indirectly to identify an individual.
• "Services" means the CanvasaaS platform, including all features, tools, APIs, AI-powered generation capabilities, and functionalities provided to Account Owners and their Collaborators, whether accessed via the Website or any other means.
• "Website" means canvasaas.com and all subdomains.
• "Account Owner" or "User" means any individual or entity that registers for a CanvasaaS account to create and manage strategic business analyses on the Platform.
• "Team Member" or "Collaborator" means any individual who is invited by an Account Owner to access, view, or contribute to a workspace hosted on the CanvasaaS platform.

By accessing or using our Services, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy. If you do not agree with this Privacy Policy, you must not access or use our Services.

2. Applicability

This Privacy Policy applies to all users of the CanvasaaS platform, including Account Owners, their Team Members, Collaborators, and casual visitors to the Website. It is important to understand the different roles that CanvasaaS plays with respect to the processing of personal data.

CanvasaaS as Data Controller

CanvasaaS acts as the data controller for personal data that we collect directly from you in connection with your use of our platform. This includes:

• Account registration information provided by Account Owners and their Team Members
• Billing and subscription data related to CanvasaaS platform subscriptions
• Usage data, analytics, and technical information collected through the platform
• Communications between you and CanvasaaS (e.g., support requests, marketing emails)
• Information collected from visitors to canvasaas.com (the main marketing website)
• Business descriptions, prompts, and other inputs submitted for AI-powered canvas and analysis generation

CanvasaaS as Data Processor

When Account Owners use CanvasaaS to create workspaces and invite Collaborators, the Account Owner is the data controller for the personal data of their Collaborators and any business data entered into the platform. In this context, CanvasaaS acts as a data processor, processing data on behalf of and under the instructions of the Account Owner. This includes:

• Collaborator names, email addresses, and role assignments within a workspace
• Business strategy data, canvas content, and analysis frameworks created within the workspace
• Financial projections, market data, and competitive analysis entered by users
• Comments, annotations, and collaborative edits made within shared workspaces
• Any other personal or business data that Collaborators provide when interacting with an Account Owner's workspace

Account Owners are responsible for ensuring that they have a lawful basis for collecting and processing the personal data of their Collaborators, and for providing their Collaborators with appropriate privacy notices. CanvasaaS provides tools and features to assist Account Owners in meeting their obligations under applicable data protection laws, but each Account Owner is ultimately responsible for their own compliance.

If you are a Collaborator and have questions about how a specific Account Owner processes your personal data, we encourage you to contact that Account Owner directly. If you wish to exercise your data protection rights with respect to data that an Account Owner controls, please direct your request to the relevant Account Owner in the first instance.

3. Information We Collect

3.1 Information You Provide Directly

We collect personal data that you voluntarily provide to us when you register for an account, subscribe to our services, contact us, or otherwise interact with our Services. This includes:

Account Registration (Account Owners):

• Full name and display name
• Email address
• Password (stored in encrypted form)
• Company or organisation name
• Industry and business stage (e.g., idea, startup, growth, established)
• Company size and role within the organisation
• Profile images and biographical information

Billing Information (Account Owners):

• Payment card details (processed and stored securely by our payment processor, Stripe; CanvasaaS does not store full card numbers on our servers)
• Billing name and address
• Tax identification numbers where required
• Subscription plan details and usage tier

Business Analysis and Canvas Data:

• Business Model Canvas, Lean Canvas, SWOT, Porter's Five Forces, Value Proposition Canvas, and other strategy framework data
• Business plans, executive summaries, and strategic narratives
• Financial forecasts, revenue projections, and scenario analyses
• Customer profiles, persona data, and market segmentation information
• TAM/SAM/SOM calculations and market sizing data
• Product-Market Fit assessments and pivot tracking data
• Business descriptions and prompts submitted for AI-powered generation
• Exported reports and documents

Collaborator Information:

• Full name and email address
• Role and permissions within a workspace
• Comments, annotations, and edits made within shared canvases
• Activity history within shared workspaces

Communications:

• Customer support inquiries and correspondence
• Feedback, reviews, and survey responses
• Email marketing preferences and opt-in status

3.2 Information Collected Automatically

When you access or use our Services, we automatically collect certain information about your device and your use of the platform. This includes:

Log Data:

• IP address
• Browser type and version
• Operating system
• Referring URL and exit pages
• Date and time of access
• Pages viewed and actions taken on the platform
• Error logs and performance data

Cookies and Similar Technologies:

• Session cookies to maintain your login state
• Preference cookies to remember your settings and display preferences
• Analytics cookies to understand how users interact with our platform
• Security cookies to detect and prevent fraudulent activity

For detailed information about the cookies we use and how to manage your cookie preferences, please refer to our Cookie Policy.

Session Data:

• Authentication tokens and session identifiers
• Workspace context information (which workspace you are currently accessing)

Usage Analytics:

• Feature usage patterns and frequency
• Canvas creation and editing activity
• AI generation usage and prompt frequency
• Platform performance metrics
• Aggregate and anonymised usage statistics

4. How We Use Your Information

We use the personal data we collect for the following purposes:

4.1 Providing and Maintaining Our Services

• Creating and managing your CanvasaaS account
• Providing access to strategic analysis frameworks and canvas tools
• Processing AI-powered canvas generation requests by transmitting business descriptions and prompts to third-party AI providers (OpenAI); these inputs are subject to the AI provider's privacy policy and data handling practices
• Facilitating subscription billing and payment processing through Stripe
• Managing workspace collaboration and team member access
• Generating and delivering exported reports and documents
• Providing customer support and responding to enquiries
• Sending transactional emails, including subscription confirmations, account updates, and collaboration invitations

4.2 Improving and Developing Our Platform

• Analysing usage patterns to improve features, user experience, and platform performance
• Conducting internal research and development
• Testing new features and functionality
• Monitoring and enforcing usage limits and subscription tiers
• Generating aggregate, anonymised analytics and reporting

4.3 Communications

• Sending administrative communications about your account, subscription, or the Services
• Providing customer support and technical assistance
• Sending marketing communications about new features, updates, and offers (with your consent, where required)
• Facilitating collaboration notifications between Account Owners and their Team Members

4.4 Protecting Rights and Ensuring Safety

• Detecting, preventing, and addressing fraud, abuse, and security incidents
• Enforcing our Terms of Service and other policies
• Protecting the rights, property, and safety of CanvasaaS, our users, and the public
• Monitoring for and removing prohibited content or activity

4.5 Legal Compliance

• Complying with applicable laws, regulations, and legal processes
• Responding to lawful requests from public authorities, including law enforcement and government agencies
• Fulfilling tax reporting obligations
• Establishing, exercising, or defending legal claims

5. Information Sharing

We do not sell your personal data to third parties. We may share your personal data in the following circumstances:

5.1 Service Providers

We engage trusted third-party service providers to perform functions and provide services on our behalf. These service providers have access to your personal data only to the extent necessary to perform their functions and are contractually obligated to maintain the confidentiality and security of your data. Our key service providers include:

• Stripe: Payment processing and subscription billing. Stripe processes payment card information in accordance with PCI DSS standards. See Stripe's Privacy Policy.
• OpenAI: AI-powered canvas and analysis generation. When you use our AI generation features, your business descriptions and prompts are transmitted to OpenAI for processing. OpenAI processes this data in accordance with their data usage policies. See OpenAI's Privacy Policy. We do not send your personal account information (such as your name or email) to OpenAI; only the business-related content you submit for AI generation is transmitted.
• Cloud Hosting Providers: We use cloud infrastructure services to host the platform, store data, and deliver content. Data is stored on servers located in secure data centres with appropriate physical, technical, and organisational safeguards.
• Email Service Providers: We use third-party email services to send transactional and marketing communications on our behalf.
• Analytics Providers: We may use analytics tools to help us understand how users interact with our Services.

5.2 Account Owners and Collaborators

When you interact with a workspace on the CanvasaaS platform (e.g., accepting a collaboration invitation, editing a canvas, or adding comments), the Account Owner and other Collaborators with appropriate permissions will have access to the data you provide in connection with that workspace. This is necessary for collaborative work on shared business analyses. Account Owners control access permissions within their workspaces.

5.3 Affiliates and Related Companies

We may share your personal data with Tyga.Cloud Ltd's affiliated entities for purposes consistent with this Privacy Policy. Any such affiliates will be required to honour this Privacy Policy in their handling of your personal data.

5.4 Government and Legal Requests

We may disclose your personal data if required to do so by law, or if we believe in good faith that such disclosure is necessary to:

• Comply with a legal obligation, court order, or regulatory requirement
• Protect and defend the rights or property of Tyga.Cloud Ltd
• Prevent or investigate possible wrongdoing in connection with the Services
• Protect the personal safety of users of the Services or the public
• Protect against legal liability

5.5 Business Transfers

In the event that Tyga.Cloud Ltd or CanvasaaS is involved in a merger, acquisition, reorganisation, sale of assets, or bankruptcy, your personal data may be transferred as part of that transaction. We will notify you of any such change in ownership or control of your personal data, and any choices you may have regarding your personal data, in accordance with applicable law.

6. Children's Privacy

CanvasaaS is not directed to individuals under the age of 18. We do not knowingly collect personal data from children under the age of 18. If you are under 18, you may not create a CanvasaaS account or use our Services without the consent and supervision of a parent or legal guardian.

Account Owners are responsible for ensuring that their workspaces and collaborative activities comply with applicable laws regarding the collection of personal data from minors.

If we become aware that we have collected personal data from a child under the age of 18 without verification of parental consent, we will take steps to delete that information as promptly as possible. If you believe that we may have collected personal data from a child under 18, please contact us at dpo@tyga.cloud.

7. Your Rights and Choices

7.1 Account Management

If you are an Account Owner, you can access, update, and manage much of your personal data through your CanvasaaS dashboard settings. This includes your profile information, company details, billing information, and notification preferences. You can also delete your account by contacting our support team, which will result in the removal of your account data in accordance with our data retention practices and applicable legal obligations.

7.2 Email Communications

You can opt out of receiving marketing and promotional emails from CanvasaaS by clicking the "unsubscribe" link included in each marketing email, or by updating your communication preferences in your account settings. Please note that even if you opt out of marketing communications, we may still send you transactional emails related to your account and Services (e.g., subscription confirmations, billing notices, security alerts, and important service updates).

7.3 Cookies

You can manage your cookie preferences through your browser settings or through the cookie consent mechanism provided on our Website. Please note that disabling certain cookies may affect the functionality of the Services. For detailed information, please see our Cookie Policy.

7.4 Data Access and Portability

You have the right to request a copy of the personal data we hold about you. Account Owners can export their data, including canvases, analyses, and financial forecasts, through the platform's built-in export tools where available. For data export requests that cannot be fulfilled through self-service tools, please contact us at dpo@tyga.cloud.

7.5 Data Deletion

You have the right to request the deletion of your personal data, subject to certain exceptions required by law (e.g., data we must retain for tax, accounting, or legal compliance purposes). To request deletion, please contact us at dpo@tyga.cloud. We will process your request within 30 days, or within the timeframe required by applicable law.

8. Security and Storage

We take the security of your personal data seriously and implement industry-standard technical and organisational measures to protect it against unauthorised access, alteration, disclosure, or destruction. These measures include:

• Encryption in Transit: All data transmitted between your browser and our servers is encrypted using TLS (Transport Layer Security) / HTTPS protocols.
• Encryption at Rest: Sensitive data stored on our servers, including passwords and payment tokens, is encrypted using strong encryption algorithms. Passwords are hashed using bcrypt.
• Access Controls: We implement role-based access controls to ensure that only authorised personnel have access to personal data, and only to the extent necessary for their job functions.
• Infrastructure Security: Our platform is hosted on secure cloud infrastructure with firewalls, intrusion detection systems, and regular security patching.
• Session Security: Server-side session management with secure, HTTP-only session cookies. Sessions are stored in Redis with appropriate expiration policies.
• Workspace Isolation: The platform implements workspace-level data isolation to ensure that each Account Owner's data (and their Collaborators' data) is logically separated from other users.
• Payment Security: Payment card data is processed and stored by Stripe in compliance with PCI DSS Level 1 standards. CanvasaaS does not store full payment card numbers on its own servers.
• AI Data Handling: Business descriptions and prompts submitted for AI generation are transmitted securely to our AI providers and are not used to train their models. We do not retain AI-generated outputs beyond what is saved within your workspace.
• Regular Reviews: We conduct periodic reviews of our security practices and update our measures as appropriate in response to evolving threats.

While we strive to use commercially acceptable means to protect your personal data, no method of transmission over the Internet or method of electronic storage is 100% secure. We cannot guarantee the absolute security of your data. In the event of a data breach that affects your personal data, we will notify you and the relevant supervisory authority as required by applicable law.

9. International Data Transfers

Tyga.Cloud Ltd is based in the United Kingdom. Our servers and service providers may be located in various countries around the world. When you use our Services, your personal data may be transferred to and processed in countries other than your country of residence, including countries that may not provide the same level of data protection as your home country.

Where we transfer personal data outside the United Kingdom or the European Economic Area (EEA), we ensure that appropriate safeguards are in place to protect your data in accordance with applicable data protection laws. These safeguards may include:

• Standard Contractual Clauses (SCCs): We use the European Commission's Standard Contractual Clauses and the UK International Data Transfer Agreement (IDTA) or UK Addendum to the EU SCCs, as applicable, when transferring personal data to service providers or other recipients outside the UK/EEA.
• Adequacy Decisions: Where the European Commission or the UK Secretary of State has determined that a country provides an adequate level of data protection, we may rely on such adequacy decisions.
• Supplementary Measures: Where necessary, we implement additional technical and organisational measures to ensure that transferred data is protected to a standard essentially equivalent to that provided within the UK/EEA.

Our third-party service providers, including Stripe and OpenAI, maintain their own data transfer mechanisms and safeguards. We encourage you to review their respective privacy policies for further information.

For more information about the safeguards we have in place for international data transfers, please contact us at dpo@tyga.cloud.

10. EU and UK GDPR Rights

If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, you have certain rights under the General Data Protection Regulation (GDPR) and the UK GDPR, as applicable.

10.1 Legal Basis for Processing

We process your personal data on the following legal bases:

• Performance of a Contract: Processing is necessary for the performance of a contract to which you are a party (e.g., providing the CanvasaaS platform services, managing your subscription, facilitating workspace collaboration).
• Legitimate Interests: Processing is necessary for our legitimate interests or the legitimate interests of a third party, provided that such interests are not overridden by your rights and freedoms. Our legitimate interests include operating and improving our platform, preventing fraud, and ensuring security.
• Consent: Where we rely on your consent as the legal basis for processing (e.g., for marketing communications or non-essential cookies), you have the right to withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing that occurred before the withdrawal.
• Legal Obligation: Processing is necessary for compliance with a legal obligation to which we are subject (e.g., tax reporting, responding to lawful government requests).

10.2 Your GDPR Rights

Subject to applicable law, you have the following rights with respect to your personal data:

• Right of Access: You have the right to request a copy of the personal data we hold about you, along with information about how we process it.
• Right to Rectification: You have the right to request the correction of inaccurate or incomplete personal data we hold about you.
• Right to Erasure ("Right to Be Forgotten"): You have the right to request the deletion of your personal data in certain circumstances, such as when the data is no longer necessary for the purposes for which it was collected, or when you withdraw your consent.
• Right to Restriction of Processing: You have the right to request that we restrict the processing of your personal data in certain circumstances, such as when you contest the accuracy of the data or when you object to processing based on legitimate interests.
• Right to Data Portability: You have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to transmit that data to another controller, where technically feasible.
• Right to Object: You have the right to object to the processing of your personal data based on our legitimate interests or for direct marketing purposes. Where you object to processing for direct marketing, we will cease processing your data for that purpose immediately.
• Right Not to Be Subject to Automated Decision-Making: You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. CanvasaaS does not currently engage in solely automated decision-making that has legal or similarly significant effects on individuals.
• Right to Withdraw Consent: Where processing is based on your consent, you have the right to withdraw your consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.
• Right to Lodge a Complaint: You have the right to lodge a complaint with a supervisory authority. In the United Kingdom, the relevant supervisory authority is the Information Commissioner's Office (ICO) at ico.org.uk.

10.3 Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law. Our general data retention practices are as follows:

• Active Accounts: We retain account data for as long as your account remains active and for a reasonable period thereafter to allow for reactivation or to fulfil any outstanding obligations.
• Transaction Records: We retain transaction and subscription data for a minimum of 6 years from the date of the transaction to comply with tax, accounting, and legal reporting requirements under UK law (including HMRC requirements).
• Marketing Data: We retain marketing consent records and email preferences for as long as you remain subscribed. Upon unsubscribing, we retain a suppression record to ensure we do not contact you again.
• Log Data: Server logs and technical data are typically retained for up to 12 months for security, debugging, and analytical purposes, after which they are deleted or anonymised.
• Deleted Accounts: When an Account Owner deletes their account, we will delete or anonymise their personal data and the data within their workspaces within 90 days, except where retention is required for legal compliance.

10.4 Automated Decision-Making and Profiling

CanvasaaS does not use your personal data for automated decision-making or profiling that produces legal effects or similarly significantly affects you. We may use automated systems for fraud detection and prevention purposes, but any such systems are subject to human review and do not make final decisions affecting your legal rights.

To exercise any of your GDPR rights, please contact our Data Protection Officer at dpo@tyga.cloud. We will respond to your request within one month. In certain circumstances, we may extend this period by an additional two months, in which case we will inform you of the extension and the reasons for the delay.

11. California CCPA Disclosures

If you are a California resident, the California Consumer Privacy Act of 2018 (CCPA), as amended by the California Privacy Rights Act (CPRA), provides you with specific rights regarding your personal information. This section supplements the rest of this Privacy Policy and applies solely to California residents.

11.1 Categories of Personal Information Collected

In the preceding 12 months, we have collected the following categories of personal information as defined by the CCPA:

• Identifiers: Name, email address, IP address, account username, postal address, unique personal identifiers.
• Commercial Information: Records of subscriptions purchased, usage history, and service consumption patterns.
• Financial Information: Payment card details (processed by Stripe), billing address, transaction history.
• Internet or Network Activity: Browsing history on our platform, search history, interactions with our Website and Services, log data.
• Geolocation Data: Approximate location derived from IP address.
• Professional or Employment-Related Information: Company name, job title, industry, business stage, and other professional details provided by Account Owners.
• Inferences: Inferences drawn from the above categories to create a profile about you, such as preferences and usage patterns (used solely for improving platform functionality).

11.2 No Sale of Personal Information

CanvasaaS does not sell and has not sold the personal information of its users in the preceding 12 months. We do not sell personal information as defined by the CCPA. We also do not "share" personal information for cross-context behavioural advertising purposes as defined by the CPRA.

11.3 Your California Privacy Rights

As a California resident, you have the following rights under the CCPA/CPRA:

• Right to Know: You have the right to request that we disclose the categories and specific pieces of personal information we have collected about you, the categories of sources from which we collected it, our business or commercial purpose for collecting it, the categories of third parties with whom we share it, and, if applicable, the categories of personal information sold or disclosed for a business purpose.
• Right to Delete: You have the right to request the deletion of your personal information, subject to certain exceptions provided by law.
• Right to Correct: You have the right to request the correction of inaccurate personal information that we maintain about you.
• Right to Opt-Out of Sale or Sharing: As noted above, we do not sell or share your personal information. However, if we were to do so in the future, you would have the right to opt out.
• Right to Limit Use of Sensitive Personal Information: You have the right to limit the use and disclosure of your sensitive personal information, if applicable.
• Right to Non-Discrimination: You have the right not to receive discriminatory treatment by us for the exercise of your CCPA/CPRA rights.

To exercise any of these rights, please contact us at dpo@tyga.cloud or write to us at the address provided in Section 13. We will verify your identity before processing your request and will respond within 45 days as required by the CCPA.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. When we make changes, we will revise the "Effective Date" at the top of this page.

For material changes that significantly affect how we process your personal data, we will provide additional notice, such as:

• Displaying a prominent notice on our Website or within the CanvasaaS dashboard
• Sending an email notification to registered Account Owners
• Requiring acknowledgement of the updated policy upon your next login

We encourage you to review this Privacy Policy periodically to stay informed about how we are protecting your information. Your continued use of the Services after the effective date of any updated Privacy Policy constitutes your acceptance of the changes. If you do not agree with the updated Privacy Policy, you should discontinue your use of the Services and contact us to close your account.

13. Contact Us

If you have any questions, concerns, or complaints about this Privacy Policy or our data processing practices, or if you wish to exercise any of your rights described in this policy, please contact us:

Data Protection Officer
Email: dpo@tyga.cloud

Tyga.Cloud Ltd
Company No: 14643275
Ground Floor, Unit 2 Mallard Court
Mallard Way, Crewe Business Park
Crewe, Cheshire, England
CW1 6ZQ

We aim to respond to all enquiries within 30 days. If you are not satisfied with our response, you have the right to lodge a complaint with the relevant supervisory authority. In the United Kingdom, this is the Information Commissioner's Office (ICO), which can be contacted at ico.org.uk or by telephone at 0303 123 1113.