Privacy Policy

1. Introduction & Data Controller

This Privacy Policy explains how RawCanvas (“RawCanvas”, “we”, “us”, or “our”), operating at https://rawcanvas.ai, collects, uses, stores, and protects your personal information when you visit our website, sign in to our web studio, generate vector icons, or purchase subscription plans and credit packs.

2. Information We Collect

• Account & Authentication Data: When you register an account or sign in (via email/password or Continue with Google OAuth), we collect your email address, display name, encrypted password hash (for email accounts), and optional Google profile avatar URL.
• Prompts, Reference Uploads & Generated Assets: We store the text prompts, optional style reference images, and resulting vector icon sets (SVG, PNG, PDF, EPS, WebP, ICO, JSX) you create so you can inspect, recolor, and download them from your studio workspace and Library.
• Credit Ledger & Order Metadata: We maintain a record of your Fast Credit balance, subscription plan tier (FREE, BASIC, PRO, or MAX), credit consumption, automatic failure refunds, and Paddle transaction/subscription identifiers.
• Technical & Essential Session Data: We use essential browser localStorage keys and standard server request logs (IP address, browser user-agent, and timestamps) strictly to maintain your signed-in session, remember your UI theme preferences, and protect the service against abuse.

3. Payment Processing & Merchant of Record (Paddle.com)

All paid subscriptions and Extra Credit Pack orders on RawCanvas are processed by our Merchant of Record, Paddle.com (Paddle.com Market Limited / Paddle.com Inc.).

We do not collect, process, or store your full credit card number, CVV, or bank account credentials on our servers. When you complete a checkout, your payment details are transmitted directly to Paddle over encrypted connections (`HTTPS/TLS`). Paddle shares only your order confirmation, billing email, country/tax status, and subscription lifecycle events with us via cryptographically signed webhooks so we can provision your credits. For details on how Paddle handles buyer data, please see Paddle's Privacy Policy.

4. How We Use Your Information & Legal Bases

We process your information strictly for the following purposes:

• Service Delivery (Contractual Necessity): To authenticate your session, generate and store your vector icon sets, and maintain your credit wallet and subscription entitlements.
• Transactional Communications: To send 6-digit email verification codes, password-reset codes, and billing/account notifications you request. We do not send unsolicited third-party promotional spam.
• Reliability, Security & Fraud Prevention (Legitimate Interests): To detect technical failures (and automatically refund credits when a job fails) and prevent unauthorized access or automated abuse.
• Legal & Tax Compliance: To comply with applicable accounting, tax, and regulatory obligations alongside our Merchant of Record, Paddle.com.

5. Google User Data & OAuth 2.0 Limited Use Compliance

RawCanvas's use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We only request the basic openid, email, and profile OAuth scopes required to sign you in and display your account identity.
• We never sell, rent, or share your Google user data with third-party advertisers or data brokers.
• We do not use your Google user data for targeted advertising or creditworthiness scoring.

6. Data Sharing & Subprocessors

We do not sell your personal information. We share data only with trusted infrastructure subprocessors necessary to operate RawCanvas:

• Paddle.com: Merchant of Record for checkout, subscription management, tax compliance, and refund processing.
• Cloudflare (R2 & Edge Network) & Vercel: Secure cloud hosting, content delivery, and encrypted object storage for generated icon assets.
• Google Cloud / Identity Services: Optional OAuth 2.0 sign-in and AI inference processing.

7. Cookies & Local Storage

RawCanvas uses strictly necessary browser storage (localStorage) to keep you signed in, preserve your guest trial ID, and store your dark/light theme preference. When you open the payment checkout overlay, our Merchant of Record (Paddle.com) may set essential checkout and fraud-prevention cookies required to process your transaction securely.

8. Data Retention, Deletion & Your Privacy Rights (GDPR / CCPA)

You can delete any of your generated icon sets directly from your Assets at any time. Depending on your location (including the EEA, UK, Switzerland, and California), you have the right to access, correct, export, object to processing of, or request permanent deletion of your personal data and account.

To exercise any of these rights or request complete account deletion, email us at support@rawcanvas.ai. We process all verified deletion requests within 30 days (subject only to mandatory tax and invoice records retained by Paddle under applicable law).

9. Contact Us

For privacy inquiries, data subject requests, or account deletion requests, please contact RawCanvas at support@rawcanvas.ai.