Privacy Policy

Last updated 13 September 2026

This policy explains what personal data LEGAL ENTITY NAME ("we") processes when you use Canvas, why we process it, where it is stored, and the choices available to you.

It describes the hosted Canvas service. Where your organisation operates Canvas under a separate agreement, that agreement governs and this policy is descriptive only.

Who we are

LEGAL ENTITY NAME, REGISTERED ADDRESS, is the controller for personal data described in this policy. Privacy questions can be sent to privacy@erup.ai.

Data we process

• Account data: the email address used to sign in, display name, assigned role, and account status.
• Authentication data: a password verifier (never the password itself), session identifiers, and — where single sign-on is configured — the identifiers your identity provider returns.
• Content you create: project descriptions, prompts, uploaded files, generated application code, and the documents Canvas derives from them.
• Operational records: sign-in attempts, administrative and configuration changes, and security events, retained so account activity can be reconstructed after an incident.
• Technical data: IP address, request metadata and timestamps, used for rate limiting, abuse prevention and audit records.

How we use it

• To provide Canvas: authenticate you, store your projects, generate and validate applications, and produce handoff documents.
• To keep the service secure: detect and investigate unauthorised access, enforce rate limits, and maintain audit trails.
• To operate and support the service: diagnose faults and maintain availability.
• To meet legal obligations and to establish, exercise or defend legal claims.

Where your data is stored

Canvas is hosted on Fly.io. The application, its database, its storage volumes and its code-execution sandbox all run in Fly.io's Ashburn, Virginia region in the United States.

Data is therefore processed in the United States. Canvas does not currently offer European or German data residency, and no part of this deployment is located in the European Union. If your organisation requires a specific processing location, contact us before submitting personal data.

Model providers and other recipients

Canvas generates applications and documents using large language models. The model provider is selected by your administrator, and the content you submit — including prompts, project descriptions and uploaded files — is transmitted to that provider for processing. Which provider receives your content therefore depends on how your Canvas instance is configured; your administrator can tell you which is active.

We also rely on infrastructure providers to host and operate Canvas. We do not sell personal data, and we do not use your content to train models we operate.

Generated application execution

Applications generated in Canvas run inside isolated sandbox containers on infrastructure that is not reachable from the public internet. Content placed into a generated application is processed there as part of building and previewing it.

Security

• Connections between your browser and Canvas are encrypted with HTTPS, and HTTPS is required.
• The application connects to its database over TLS 1.3 against a pinned certificate authority; unencrypted database connections are refused by the database itself.
• Storage volumes are encrypted at rest, and the database is reachable only over a private network with no public address.
• Passwords are stored only as salted scrypt verifiers. Administrative access requires an authenticated session.
• No system is perfectly secure, and we cannot guarantee absolute security.

Retention

Account and content data are retained while your account is active. Security and audit records are retained on defined schedules so that account activity remains reconstructable, then pruned automatically. Backups are retained on a rolling basis and expire in turn.

Confirm concrete retention periods with counsel before this policy is relied upon.

Your rights

Depending on where you live, you may have rights to access, correct, delete, port or restrict processing of your personal data, and to object to it. Requests can be made to privacy@erup.ai. If Canvas is provided to you through your employer, we may direct your request to them as the party that controls the account.

Cookies

Canvas sets cookies that are strictly necessary to sign you in, keep your session active, and protect against cross-site request forgery. Disabling them prevents sign-in.

Children

Canvas is a business product and is not directed to children. We do not knowingly collect personal data from children.

Changes

We will update this policy as the service changes and will revise the date shown above. Material changes affecting how we handle personal data will be communicated to account administrators.