Privacy Policy

Effective October 20, 2026 · Version 2026-10-20

In short: we collect what we need to run your account and the Service, we do not sell personal data, our own website uses no tracking cookies or analytics, and the data your sites collect belongs to you.

1. Who we are

Cloud Canal Corp. ("Cloud Canal", "we"), 1218 McDowell Crescent, Milton, Ontario L9T 6R4, Canada, is responsible for the personal data described in this policy. Our Privacy Officer can be reached at [email protected].

2. What this covers

This policy covers people who visit www.cloudcanal.io, create a Cloud Canal account, or contact us.

It does not cover the visitors and users of the sites and apps our customers build. For that data the customer is in charge (the "controller") and we only process it on their instructions, under our Data Processing Agreement. If you visited a site built on Cloud Canal, that site's own privacy notice applies; contact its owner with questions or requests, and we will help them answer.

3. What we collect

  • Account details: your name, email address, password (stored only as a one-way hash), the workspaces you belong to, which version of our terms you agreed to and when, and whether you asked to receive product updates. If you sign in with Google, we receive your name and email address from Google.
  • Billing details: your plan, invoices and payment status. Card details go directly to our payment processor, Stripe; we never see or store full card numbers.
  • Accounts you connect: when you connect an account you hold elsewhere, we receive what that provider gives us to make the connection work, and store the access it grants encrypted, on our platform only:
    • Google: your Google account's email address and ID, the access you grant, and, when you use those features, your Search Console properties and search data, site verification status, and your Google Ads accounts, campaigns and their numbers (section 5);
    • X and Bluesky: your handle, display name and account ID, the access you grant (for Bluesky, the app password you create), the posts you publish through us and their numbers, and, if you turn listening on, the posts that mention or reply to you;
    • Stripe: your Stripe account's ID, business name, email address, country and currency, what Stripe says the account still needs, and your products, orders, customers, subscriptions, refunds, disputes and payouts.
  • What you build: the pages, components, settings, files and data in your apps, which you control.
  • AI conversations: the messages you exchange with the AI assistant, kept so you can return to them.
  • Technical data: IP address, browser and device details, and request records in our server logs; and the result of the bot check (Cloudflare Turnstile) when you sign up or log in.
  • Messages to us: whatever you include when you email or contact us.

4. How we use it

  • To provide the Service you signed up for: running your account, hosting your apps, billing you, and sending emails the Service needs, such as verification, password resets and billing notices. (Legal basis: our contract with you.)
  • To keep the Service secure and working: preventing abuse and fraud, debugging and planning capacity. (Legal basis: our legitimate interest in a safe, reliable service.)
  • To send product updates, only if you opted in. You can opt out at any time. (Legal basis: your consent.)
  • To meet legal obligations, such as tax records and lawful requests. (Legal basis: legal obligation.)

We do not sell or rent personal data, we do not use it for targeted advertising, and we do not use your content to train AI models.

5. Google user data

If you connect a Google account on the Connections tab, you choose to give us access to some of your Google data. This section says exactly what we do with it.

  • What we access: your email address and Google account ID (to show which account is connected); your Search Console sites and their search performance (clicks, impressions, queries, pages and positions), and the ability to add a site and submit its sitemap; the ability to verify that you own a site; and your Google Ads accounts, the campaigns you create or manage through us, and their numbers and keyword planning data.
  • How we use it: only to provide the features you use: showing your search and advertising data in the dashboard, the connector and your workflows; verifying your site and submitting its sitemap; and creating, changing and reporting on the campaigns you ask for. We act only when you, your workspace's members, your workflows or the AI tools you use ask.
  • How we store it: the access Google grants is encrypted and kept only on our platform's servers; it is never sent to your apps' servers. Search Console data is fetched when it is asked for and cached for up to six hours. Google Ads campaign settings and daily numbers are kept with the app that runs the campaign.
  • Who receives it: the people in your workspace, and an AI tool only when you or your workspace use one to work with this data, in which case the data goes to that tool as part of the request. We do not transfer it to anyone else, except where the law requires it, or to a successor if our business is sold.
  • What we never do with it: sell it; use it, or let anyone use it, for advertising, retargeting or interest-based ads; use it to determine creditworthiness or for lending; or use it to develop, improve or train AI or machine-learning models. People at Cloud Canal do not read it unless you ask us to (for example, for support), it is needed for security or to comply with the law, or it has been aggregated and anonymised for running the Service.
  • How to remove it: disconnect the account on the Connections tab. We withdraw our access at Google and delete the stored access, the account's Search Console links, and the Google Ads campaign records and numbers we kept for it. The campaigns themselves stay in your Google Ads account. You can also withdraw access in your Google account's security settings.

Cloud Canal's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

6. Cookies and tracking

Our website and dashboard set no tracking cookies and run no analytics or advertising scripts. When you sign in, your session is kept in your browser's local storage, and the dashboard stores a few preferences there (such as your current workspace); these exist only to make the Service work.

Our pages load fonts from Adobe Fonts (use.typekit.net) and scripts from public content delivery networks (cdn.jsdelivr.net, cdnjs.cloudflare.com, unpkg.com). Those providers receive your IP address as part of delivering the files.

7. Who we share it with

We share personal data only with service providers who help us run the Service, under contracts that limit their use of it:

  • Amazon Web Services — servers and storage;
  • Cloudflare — network, security, bot checks and delivery;
  • Backblaze — file storage and backups;
  • Stripe — payments and invoicing, and, if you sell through Cloud Canal Payments, the connected account you sell with;
  • Postmark — sending email;
  • OpenRouter, and the AI model providers it routes to — the AI assistant;
  • Google — only if you sign in with Google or connect a Google account;
  • X and Bluesky — only if you connect an account there, to post and read for you;
  • IndexNow (Microsoft Bing and the search engines that share it) — the addresses of your site's changed pages when you deploy; no personal data.

The full list, with locations, is in Annex 3 of the Data Processing Agreement. We may also disclose data when the law requires it, to protect people's rights or safety, or to a successor if our business is sold, in which case this policy continues to apply.

8. Where it is stored

Your account and dashboard data are stored in the United States (Amazon Web Services, US East). Each app's backend, files and backups are stored in the region chosen for that app, currently in the United States or the European Union. Analytics for customers' sites is stored in the European Union (Frankfurt, Germany). Cloudflare's network handles traffic in many countries.

Cloud Canal is based in Canada. When personal data from the European Economic Area, the United Kingdom or Switzerland is transferred outside those regions, we rely on adequacy decisions (including the one for Canada) or on the European Commission's Standard Contractual Clauses and their UK and Swiss equivalents.

9. How long we keep it

  • Account details: while your account is open. After you ask us to close it, we delete them within 30 days, except what we must keep for legal reasons.
  • Billing records: as long as tax and accounting law requires (generally six years after the end of the tax year in Canada).
  • Connected accounts: until you disconnect them, or until the provider withdraws our access. Disconnecting deletes the stored access at once, and for Google also the campaign records described in section 5. The posts and orders an app made through an account stay with that app until the app is deleted.
  • Apps and their data: until you delete them. Deletion begins within minutes, and backups are removed with the app. An app suspended for non-payment is deleted 7 days after suspension.
  • AI conversations: until you delete the app they belong to.
  • Server logs: a short period, measured in days, for security and debugging.

10. Security

We protect personal data with measures appropriate to the risk, including encryption in transit, a separate server for each paid app, storage credentials limited to each app, restricted administrative access, and backups. The DPA's Annex 2 describes them. No system is perfectly secure; if a breach affects your personal data, we will tell you and the authorities as the law requires.

11. Your rights

Depending on where you live (including under the GDPR, the UK GDPR, Canada's PIPEDA and Quebec's Law 25, and US state laws such as California's CCPA), you may have the right to:

  • access the personal data we hold about you, and get a copy;
  • correct it;
  • delete it;
  • restrict or object to some uses of it;
  • receive it in a portable format;
  • withdraw consent, such as for product updates;
  • complain to a data protection authority, such as the Office of the Privacy Commissioner of Canada or your local authority.

Email [email protected] to use any of these. We answer within 30 days and may need to confirm your identity first. We will not treat you differently for using your rights. We do not sell or "share" personal data for cross-context behavioural advertising as the CCPA defines those terms.

12. Children

The Service is for people aged 18 and over. We do not knowingly collect children's personal data. If you believe a child has given us personal data, contact us and we will delete it.

13. Changes

We will update this policy when our practices change. For a material change we will tell account holders by email or in the dashboard before it takes effect. The version and date are at the top of this page.

14. Contact

Privacy Officer, Cloud Canal Corp., 1218 McDowell Crescent, Milton, Ontario L9T 6R4, Canada · [email protected]