Privacy Policy

01 / Who we are and what this covers

Canvas Marketplace Inc. is the controller of personal information collected through the Service. This Policy applies to everyone who visits the site or holds an account, whether as a brand, a creator or an administrator. It does not cover the practices of TikTok, Instagram, Stripe or any other third party, even where we link to them.

02 / Personal information we collect

03 / Where it comes from

Directly from you when you register, complete your profile, apply to or run a campaign, report views or set up payouts; automatically from your browser and our infrastructure when you use the Service; from Stripe and Cloudflare as described above; and from other users of the marketplace.

04 / How we use it

• To run the marketplace: create and secure your account, match creators to campaigns, run warm-ups, concept approvals and post reviews, compute earnings from verified views, hold and allocate campaign funds, and send payouts.
• To verify and prevent fraud: check view reports and screenshots, detect inflated metrics, duplicate accounts and abuse, and keep an audit trail of every money-moving action.
• To communicate with you: email verification, password resets, campaign events (offers, approvals, rejections, funding alerts, payout notices) and support. These are service messages, not marketing. If we ever send marketing email, it will carry an unsubscribe link.
• To secure the Service: rate limiting, session management, two-factor authentication and incident investigation.
• To comply with law and enforce our terms: respond to lawful requests, meet tax and accounting obligations, resolve disputes, and enforce the Terms of Service and Creator Agreement.
• To improve the Service: using aggregated or de-identified statistics such as applications per campaign or average views per post. We do not use your personal information to train artificial-intelligence models.

We do not use personal information for targeted advertising, and we do not make automated decisions about you that have legal or similarly significant effects without human review; view reports above our automatic threshold are always checked by a person.

05 / How we share it

• Other users on your campaign. A brand sees the display name, registered handles, post links, view reports and screenshots of the creators contracted to its campaigns, and the rights files it has purchased. A creator sees the brand’s company name, app and brief. Neither side sees the other’s email address, payout details or IP address.
• Service providers that process data on our behalf under contract: Cloudflare (hosting, database, file storage, cache, bot protection and email routing), Stripe (payments, identity verification and payouts) and Resend (transactional email delivery). Each may access only what it needs to provide its service.
• Payment providers you choose. If you are paid by PayPal or Wise, we send them your handle and the amount.
• Professional advisers such as lawyers, accountants and insurers, under confidentiality.
• Authorities and others when we believe in good faith that disclosure is required by law or necessary to protect the rights, safety or property of Canvas, our users or the public, including reporting suspected fraud to platforms and payment providers.
• Business transfers. In a merger, acquisition, financing, reorganisation or sale of assets, personal information may be disclosed to the counterparty and its advisers and transferred to a successor, who will be bound by this Policy.

We do not sell personal information, and we do not share it with advertisers or data brokers.

06 / Cookies and tracking

The Service sets only strictly necessary cookies: a session cookie that keeps you signed in, a short-lived cookie used during two-factor sign-in, and security cookies set by Cloudflare. Stripe’s own pages set Stripe’s cookies when you pay or onboard there. We use no analytics, advertising, social-media or session-replay technologies and no tracking pixels in our emails. Details and controls are in the Cookie Notice.

07 / How long we keep it

Where the law requires a longer period, or a dispute or investigation is open, we keep the relevant data until it ends.

08 / Your choices

• Access, correction and portability. You can view and update your profile and payout details in the Service. To get a copy of your data in a machine-readable format, email hello@canvasugcmp.com from the address on your account.
• Deletion. Email hello@canvasugcmp.com to close your account. We delete or anonymise what Section 7 allows and keep only the financial and audit records it describes.
• Email. Service messages are part of running your account and cannot be switched off while it is open. Any marketing email will carry an unsubscribe link.
• Cookies. You can block or delete cookies in your browser, but you will not be able to sign in without the session cookie.
• Do Not Track and Global Privacy Control. Because we do not sell or share personal information for advertising, there is nothing for these signals to switch off. We treat a Global Privacy Control signal as a valid opt-out request where the law gives it that effect.
• Stripe. Information you gave Stripe is controlled by Stripe; use the Stripe dashboard link in the Service or contact Stripe directly.

09 / Security

We use technical and organisational safeguards designed for a platform that moves money: TLS everywhere, salted password hashing, two-factor authentication required for administrators, per-request content-security policies, rate limiting, append-only financial and audit records enforced at the database level, private file storage with short-lived signed links, and least-privilege payment keys. No system is perfectly secure, and we cannot guarantee the security of your information. If we learn of a breach affecting you we will notify you as the law requires.

10 / International transfers

We are based in the United States and use Cloudflare’s global network, so your information may be processed in the United States and in other countries where our providers operate. Those countries may not offer the same protections as yours. Where we transfer personal information from the United Kingdom, the European Economic Area or Switzerland, we rely on our providers’ standard contractual clauses or equivalent safeguards.

11 / Children

The Service is for adults. We do not knowingly collect personal information from anyone under 18, and creators must not feature minors in content without lawful consent. If you believe a minor has given us personal information, contact us and we will delete it.

12 / Changes

We may update this Policy. Material changes will be announced by email or a prominent notice on the Service before they take effect. The version and effective date appear at the top of this page. Using the Service after the effective date means the updated Policy applies.

13 / US state privacy rights

Residents of California, Colorado, Connecticut, Virginia, Texas, Oregon, Montana, Utah and other states with comprehensive privacy laws (“State Privacy Laws”) may have the rights below, to the extent the relevant law applies to us. We honour these requests for all users regardless of state.

• Know and access: the categories and specific pieces of personal information we hold, its sources, purposes and recipients.
• Correct inaccurate personal information.
• Delete personal information, subject to the exceptions in Section 7.
• Portability: receive a copy in a portable format.
• Opt out of sale, sharing for targeted advertising, and profiling with legal or similarly significant effects. We do none of these.
• Limit use of sensitive personal information. We collect none within the meaning of these laws; payout and identity data go to Stripe.
• Non-discrimination for exercising any right.
• Appeal a decision we make on your request by replying to our response; we will answer within 45 days.

14 / Contact

Privacy questions, rights requests and complaints go to:

• Email: hello@canvasugcmp.com