Skip to content

A decade of Canvas, now with AI.

How it works

Legal

Privacy Policy

Effective date: March 16, 2026

Canvas Builder ("we", "us", "our") is committed to protecting your privacy. This policy explains what information we collect, how we use it, and your rights regarding your data.

Contents

1. Overview

Canvas Builder is an AI website builder. You describe a website, our AI designs and builds it, and you refine it by chatting. You can download the code, or publish the site on our hosting at a cnvs.site address or on your own domain, with optional contact forms, visitor analytics and an automated blog. The Service runs at canvasbuilder.co and is operated by SemiColonWeb.

By using the Service, you agree to the collection and use of information in accordance with this policy. We collect only the information we need to provide the Service and we never sell your personal data.

2. Information we collect

2.1 Information you provide

  • Account information: your name and email address when you register with email and password, or with Google sign-in (including Google One Tap).
  • Prompts and project content: the descriptions and chat messages you send, the brand kits you save (logo, colours, fonts) and any images you upload. These are stored so you can see your history, keep refining and download again.
  • Generated output: the pages, styles and images the AI creates for you, stored with your account.
  • Envato verification (optional): if you verify a Canvas template purchase, we store the purchase code, item, Envato username and licence type. The Envato access token is used only during verification and is not stored.
  • Canvas Template plan verification (optional): if you connect a CanvasTemplate plan, we receive its email address, plan, credit amount and claim ID.
  • Team invitations: the email address and role of anyone you invite to your team.
  • Payment information: we do not store card details. Payments are processed by Polar; we receive order confirmations, subscription status and credit amounts.
  • Support requests: what you send us by email.

2.2 Information collected automatically

  • Session data: session tokens, IP address and browser user agent, to keep you signed in and secure your account.
  • Sign-up protection: when you create an account we record the IP address, IP range, a hash of the browser user agent and the email address to detect automated or duplicate sign-ups. Some email addresses are checked by an AI model for signs of automated sign-up.
  • Activity log: coarse actions such as signing up, building, publishing and downloading, with the IP address. Before you sign in, visits to our marketing pages are tied to an anonymous ID cookie and joined to your account if you later sign up.
  • Credit transactions: records of credit purchases, grants, usage and refunds.
  • Website analytics and advertising measurement: canvasbuilder.co uses Google Analytics and the Google Ads tag (see section 7).

2.3 Information from third parties

  • Google sign-in: your name, email address and profile picture. We never receive your Google password.

3. Published sites and your visitors

When you publish a site, we process some information about the people who visit it. For that information you decide what your site collects, and we process it on your behalf to provide hosting, forms and analytics. Visitors who have questions about a site should contact its owner first.

3.1 Hosting

  • Published site files are stored on Cloudflare R2 and served through Cloudflare at name.cnvs.site.
  • For a custom domain we store the hostname, its verification and certificate status, and obtain a TLS certificate from Let's Encrypt. Requests to custom domains pass through our own servers, where standard web server logs may record the visitor's IP address and the requested URL.
  • Sites on the Free plan show a small Canvas badge linking to canvasbuilder.co.
  • Published pages load fonts from Google Fonts and shared files from assets.cnvs.site, so those services receive the visitor's IP address.
  • When you unpublish a site, its files are removed from hosting. The site record stays in your account marked as unpublished, and its analytics and form data are kept until the retention periods in section 9 end.

3.2 Visitor analytics

  • Published pages report the page path, referrer, UTM source, the visitor's country (from Cloudflare), device type (desktop, mobile or tablet) and any custom events you set up.
  • No cookies or local storage are used. To count unique visitors, a hash of the IP address and user agent with a salt that changes every day is computed; the raw IP address and user agent are not stored for analytics, and the daily hashes are deleted each night once counted.
  • We keep only daily totals. The site owner sees them in their dashboard.

3.3 Contact-form submissions

  • When a visitor submits a form on a published site, we store every field they filled in, their email address if given, the page, their country and a keyed hash of their IP address (used for spam and rate limiting, not stored in plain form). File uploads are not accepted.
  • We email the submission to the site owner, from Canvas Builder, with the visitor's address as the reply-to, and record that the email was sent. If the owner turns on auto-replies, we email a confirmation to the visitor.
  • Suspected spam is stored but not emailed. Site owners can read and delete submissions in their dashboard.

3.4 Auto-blog

On paid plans, the auto-blog reads your published pages, niche, keywords, language and brand-kit voice to plan and write posts with AI, then publishes them to your site on a schedule unless you turn on approval first.

3.5 Your responsibilities as a site owner

You are responsible for telling your visitors how their information is used, and for anything your site collects beyond the features above, including any third-party code you add through custom head or body code.

4. How we use your information

We use the information we collect to:

  • Provide the Service: authenticate your account, build and edit your sites, host published sites, deliver form submissions and analytics, and manage your credits and plan.
  • Keep your history: store past builds so you can refine or download them again.
  • Process payments: confirm purchases and subscriptions through Polar and update your balance.
  • Improve the Service: look at usage patterns to improve build quality, the interface and performance. We do not use your prompts to train AI models.
  • Security: detect fraud, abuse, automated sign-ups and violations of our Terms of Service.
  • Measure our marketing: understand visits to canvasbuilder.co and the results of our Google ads.
  • Communicate with you: send transactional emails (such as verification and password resets) and product emails such as tips, low-credit reminders and occasional updates. Every product email has an unsubscribe link.

We do not:

  • Sell your personal data.
  • Use your prompts to train AI models.
  • Use your data for automated decision-making that produces legal effects.

5. Service providers

We share information with these providers only as needed to run the Service:

  • Cloudflare: storage and delivery of published sites, edge processing of analytics and forms, and sending emails.
  • Polar: payments and subscriptions.
  • Google: sign-in, Google Analytics and the Google Ads tag, and Google Fonts on published sites.
  • Anthropic: the AI that builds and edits your sites and writes auto-blog posts. It receives your prompts and the content needed for each build.
  • OpenAI and MiniMax: AI image generation, prompt and writing tools, our free tools, and sign-up abuse checks.
  • Pexels and DigitalOcean Spaces: stock photography and our image library.
  • Let's Encrypt: TLS certificates for custom domains.
  • Envato and CanvasTemplate: purchase and plan verification, only if you choose to verify.

6. Data storage and security

Your account data is stored on servers hosted in the United States. Published site files are stored on Cloudflare R2 and served through Cloudflare's global network. We use these security measures:

  • Encryption in transit: all connections to Canvas Builder and to published sites use HTTPS/TLS.
  • Encryption at rest: database data is encrypted at rest by our hosting provider.
  • Authentication tokens: session tokens are cryptographically secure random values with an expiry.
  • Password hashing: passwords are hashed with scrypt; we never store plaintext passwords.
  • Access controls: database access is restricted to the application servers on the principle of least privilege.

No method of electronic storage is 100% secure. While we work to protect your data, we cannot guarantee absolute security. If a data breach affects your personal information, we will notify affected users within 72 hours of becoming aware of it.

7. Cookies and tracking

7.1 On canvasbuilder.co

  • Session cookie (better-auth.session_token): a secure, httpOnly cookie that keeps you signed in. It expires after a period without use, currently 7 days.
  • Anonymous ID (cb_aid): a secure, httpOnly cookie that links activity on our marketing pages to your account if you sign up. It lasts one year.
  • Sidebar state (sidebar_state): remembers whether the dashboard sidebar is open, for 7 days.
  • Google Analytics and Google Ads: we load Google's tags on every page. They set Google cookies to measure visits and the results of our ads, and Google processes that data under its own privacy policy. You can block these cookies in your browser or with Google's opt-out tools.

Disabling cookies in your browser will prevent you from signing in to Canvas Builder.

7.2 On published sites

Our hosting and analytics set no cookies on published sites. A site owner's own custom code may add cookies or trackers; the site owner is responsible for those.

8. Your rights

Depending on where you live, you may have the following rights regarding your personal data:

All users

  • Access: request a copy of the personal data we hold about you.
  • Correction: update or correct inaccurate information in Account settings, or ask us to.
  • Deletion: ask us to delete your account and the data linked to it, including your published sites, form submissions and analytics, by emailing support@semicolonweb.com.
  • Portability: download your sites as ZIP files at any time, or ask us for an export of your history.
  • Email choices: unsubscribe from product emails with the link in any of them.

EU / EEA and UK users (GDPR)

  • Restriction: request that we limit how we process your data.
  • Objection: object to processing based on legitimate interests.
  • Withdraw consent: where processing is based on consent, withdraw it at any time.
  • Complaints: lodge a complaint with your local data protection authority.

California users (CCPA)

  • You have the right to know what personal information is collected and how it is used.
  • You have the right to opt out of the "sale" of personal information. We do not sell personal information.
  • You have the right to non-discrimination for exercising your privacy rights.

Visitors to sites built with Canvas Builder

Please contact the owner of the site. If you cannot reach them, email us and we will help where we can.

How and when we respond

To exercise any of these rights, email support@semicolonweb.com. Our typical reply time is 5 business days. Our deadline for completing a request is 30 days, the period most privacy laws set. If a request is complex and the law allows more time, we will tell you within those 30 days.

9. Data retention

  • Account data: kept while your account is open, and deleted within 30 days of your deletion request.
  • Build history: kept until you delete the build or your account.
  • Published-site analytics: daily visitor hashes are deleted each night; daily totals are kept for 30 days, or 90 days for sites on the Pro and Studio plans.
  • Contact-form submissions: kept for 90 days, or two years for sites on the Pro and Studio plans, unless the site owner deletes them sooner.
  • Activity log: deleted after 180 days.
  • Session and sign-up protection records: kept to secure accounts and prevent abuse.
  • Credit transaction logs: kept for 7 years for financial and tax compliance, even after account deletion.
  • Server logs: web server access logs are kept for 30 days for security and debugging.

10. Children's privacy

Canvas Builder is not directed to children under the age of 13 (or 16 in the EU). We do not knowingly collect personal information from children. If you believe we have collected information from a child under these ages, contact us immediately at support@semicolonweb.com and we will delete it promptly.

11. Changes to this policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by:

  • Posting the updated policy at this URL with a new effective date
  • Sending an email to your registered address for material changes
  • Showing an in-app notification on your next login

Continued use of Canvas Builder after changes take effect constitutes acceptance of the updated policy. If you do not agree with the changes, please ask us to delete your account before the effective date.

12. Contact us

If you have questions, concerns or requests about this Privacy Policy or your personal data, contact us:

We aim to reply to privacy enquiries within 5 business days, and we complete requests within 30 days (see section 8).