Effective August 14, 2026
Privacy Notice
This notice explains how InnerCanvas handles account data, drawings, generated reports, payments, and optional product analytics.
Data we process
We process your Supabase account identifier, authentication email where required by the provider, consent records, drawing files you submit, generated observations and reports, preview-credit ledger entries, and payment status. Stripe processes payment-card details; InnerCanvas does not store complete card numbers.
Drawings and reports
Pre-login drafts stay in your browser. Submitted drawings and generated reports are sensitive private content stored in access-controlled services in the United States. Unpurchased analyses are scheduled for deletion after seven days. Purchased content remains until you delete the report or account, apart from transaction records retained where legally required.
AI processing
Your submitted drawing and the minimum analysis context are sent to the configured model provider to create visible observations and a research-informed report. We do not use customer drawings to train InnerCanvas models without a separate, explicit, revocable opt-in.
Optional analytics
PostHog is not loaded before you opt in. If you consent, we send only allowlisted business events and properties. Session Replay, autocapture, form capture, report text, drawing content, test answers, email, Stripe IDs, and report or analysis IDs are excluded. PostHog may receive the IP address associated with consented event delivery.
Your controls
Your account provides report deletion, account deletion, and a ZIP export of eligible account data, drawings, and purchased-report PDFs. Deletion removes eligible live records and objects; encrypted provider backups may remain until their normal lifecycle expires.
Contact
Privacy requests may be sent to privacy@innercanvas.app. This address must be operational before public launch.