Privacy

What this page covers

This describes shopcanvas.ai, the site you are reading.

It does not describe a storefront you build with the Shop Canvas kit. That storefront is yours: it runs on your Framer site with your Shopify store behind it, and you are responsible for its privacy notice. The snippet you paste loads the runtime file from shopcanvas.ai/runtime.js, so each shopper's browser fetches that one file from our host, Vercel, which logs the request as described under Server logs. After that the runtime talks to Shopify directly: products, carts and checkout do not pass through a Shop Canvas server. Your shoppers reach Shopify's own checkout, under Shopify's terms.

What this site collects automatically

Unless you allow analytics, nothing beyond ordinary server logs on public marketing and documentation pages. If you allow it, Google Analytics runs as described under Analytics.

An audit of the live site as it was on 13 September 2026 (the home page and docs) found the following. The home page has since become the Shop Canvas company page; the audit has not been repeated since.

• No analytics. No Google Analytics, no tag manager, no Plausible, Fathom, PostHog, Mixpanel, Segment, Hotjar or Clarity was installed on those pages.
• No tracking pixels, no advertising tags, no session recording on those pages.
• No third-party requests on the home page. Loading the home page as it was then made 41 requests, and every one went to shopcanvas.ai.

Account, sign-in and agency routes load Clerk for authentication. Clerk sets session cookies and may use browser storage so you stay signed in. Those routes also contact Clerk’s services. See Accounts below.

You can verify the public-page audit yourself in your browser's developer tools on a page that does not load Clerk. If any of it ever stops being true, this page changes first.

Analytics

Since 9 October 2026, public pages on shopcanvas.ai ask whether we may use Google Analytics 4 to see how visitors use the site. It runs only if you choose Allow:

• Before you choose, or if you choose Decline, nothing from Google loads: no script, no cookie and no request to Google.
• If you allow it, Google's tag loads from googletagmanager.com and sets Google Analytics cookies (named _ga and _ga_…). It records the pages you view, roughly where you are (country and city, from your IP address, which Google Analytics 4 does not store), your browser and device type, and how you arrived. We use it only to see which pages are read and where visitors drop off. It is not used for advertising: ad storage and ad personalisation stay switched off. Google processes this data under Google's privacy policy.
• Account, admin and sign-in pages are never tracked, whatever you chose.
• Your choice is kept in this browser. Change it at any time with Cookie settings in the footer. Choosing Decline after allowing it stops further reporting at once; to remove the cookies already set, clear this site's cookies in your browser.

When you use Ask ShopCanvas

When AI help is enabled, sending a question sends your message, recent conversation turns and a limited screen category to our support service. Inside the Framer plugin, this also includes whether a connection is saved and whether you are using sample or live products. It does not automatically include store credentials, customer records, your store domain or Framer project ID. Do not put credentials or customer information in your questions.

Choosing which documentation is relevant may happen first, at TypeSafe. That step receives your latest question only — not the earlier conversation turns, and not the screen category — together with a list of our documentation pages, each as a title, a URL and its opening lines. TypeSafe returns a relevance score per page and no generated text. If the step is switched off, or is unavailable, the service ranks by keyword matching instead and nothing is sent to TypeSafe.

Our service then forwards the question, conversation context and the selected ShopCanvas documentation to OpenRouter and the selected model provider to generate a reply. The request excludes providers that permit data collection through OpenRouter's provider routing setting; this is not a promise of zero retention. Provider processing and retention terms must be reviewed for the model used before enabling the service.

The assistant implementation keeps chat history in page memory, with no chat database or browser storage. Clear chat or reload to clear that local history. Closing the panel keeps it available while the page remains open. Our application does not log question bodies; hosting and model services have their own operational logging policies. Rate limiting uses the network address seen by the service. Loading or opening an unconfigured panel does not call OpenRouter or TypeSafe.

Server logs

The site is hosted on Vercel. Like any web host, Vercel records requests to the site — including IP address, the page requested, timestamp, and browser user-agent. These logs exist so the site can be served, kept secure and debugged. They are held by Vercel under Vercel's privacy policy.

We do not combine those logs with anything else, and we do not use them to build a profile of you.

When you book a demo

The form at /book-a-demo asks for the following information:

What happens to it. The form sends those fields, and nothing else, as an email. It goes to contact@shopcanvas.ai and to a second mailbox we control, so that an enquiry cannot be lost. The reply-to is set to the address you gave, so a reply goes to you directly. It is used to arrange and run the demo you asked for, and to answer you.

It is not added to a marketing list, sold, shared with advertisers, or used to build an advertising profile. You will not receive unrelated email because you booked a demo.

Who handles it on the way. The email is sent and received through Resend, which runs on Amazon Web Services in the US East (N. Virginia) region. If you are outside the United States, your message is processed there. Resend keeps its own copy for about 30 days as part of running the service, then discards it. See Resend's privacy policy.

How long it is kept. A demo request is kept for no longer than 24 months from the day it arrives, and is then deleted. Resend's own copy goes sooner, at around 30 days. If you would like yours deleted before either point, ask at contact@shopcanvas.ai and it will be.

Email you send us directly. Mail to contact@shopcanvas.ai is received by Resend in the same way and copied automatically to the same mailbox we control, with the same retention. It is used only to answer you.

When you book a time on Calendly

The booking calendars on /book-a-demo, on the ShopVoice page, and on the Style Swap AI page share one Calendly event, loaded in an inline frame from calendly.com. Each page asks which product you are interested in and passes that answer into the booking form. No Calendly script runs on other shopcanvas.ai pages; a frame loads only on those three pages, when it comes into view. Inside the frame, Calendly's booking page may set cookies and use local storage, as described in Calendly's privacy notice — for example to keep you signed in to Calendly or remember preferences. Those cookies are set in the frame's context (calendly.com), not as first-party shopcanvas.ai cookies.

If you book, Calendly collects your name, email address, the time you picked, your time zone, the product interest you chose on the page (or anything you change in the form), and anything you type in the optional notes field. It sends both of us a confirmation and creates the meeting with a Google Meet link. Calendly and Google hold that data under their own policies: Calendly's privacy notice and Google's privacy policy. Calendly states it keeps personal data for as long as reasonably necessary for the purposes it was collected, plus legal obligations — not on a fixed schedule we enforce on our side.

We use a booking only to hold the meeting and prepare for it. It is not added to a marketing list. We do not automatically delete Calendly bookings after 24 months (unlike demo-request email, above). Booking details stay in Calendly until they are removed there. The cancel or reschedule link in Calendly's email changes or removes the scheduled meeting; it does not by itself delete your personal data from Calendly's records. To ask us to remove invitee data from our Calendly account, write to contact@shopcanvas.ai. Calendly's help centre describes how account owners can delete invitee data from their organization.

Paying for a subscription — Stripe

Subscriptions start from the agency console and are paid through Stripe Checkout, where Stripe’s own privacy policy applies. Stripe processes the information needed for payment, receipts and tax. We receive the subscription’s status and billing details Stripe makes available to us, never your full card number. This does not change the Shopify checkout used by shoppers on a storefront you build.

The historical browsing audit above does not cover Stripe pages. The site’s legal-entity details remain unresolved below.

Accounts

Shop Canvas accounts are live. Sign in or sign up at /sign-in and /sign-up, manage your workspace at /account, and use the agency console at /admin/agency.

Accounts use Clerk. When you sign in on shopcanvas.ai or complete sign-in for the Framer plugin, Clerk sets session cookies and may use browser storage so your session can persist. Clerk processes your email address and credentials under Clerk’s privacy policy. The plugin opens shopcanvas.ai for sign-in and receives a short-lived handoff so the plugin can call Connect on your behalf; that flow uses the same Clerk session and Connect’s plugin-auth endpoints.

We use the account to tie stores, billing and agency console access to you. We do not sell account data or use it for advertising.

Linking a store with your own Shopify app

If you link a store at /account/link-store, the app credentials you enter (a Client ID and secret, or an Admin API access token) are sent to Shop Canvas’s Connect service under your signed-in session. Connect checks them with Shopify and stores the store’s Admin access encrypted; a Client ID and secret are used to obtain that access, and the secret itself is not kept. Nothing you entered is shown again. Connect uses that access to create or read the store’s public Storefront token, which is what the Framer plugin and your published site use. The Framer plugin never asks for these credentials.

Links to other services

The site links out to Shopify, Framer, and a live client store hosted at framer.website. Those are ordinary links: no request is made to them until you click. The one embedded service is the Calendly booking frame on /book-a-demo, the ShopVoice page, and the Style Swap AI page, described above. Once you follow a link, that service's own privacy policy applies, not this one.

Your rights

Write to contact@shopcanvas.ai and you can:

• ask what personal information is held about you,
• ask for it to be corrected,
• ask for it to be deleted.

Visitors who have not booked a demo, signed in or subscribed are covered by the public browsing and server-log sections above. Demo requests, account data and subscription billing records are covered by the sections above for those flows.

Depending on where you live — the EU, the UK and California among others — you may have further statutory rights. Ask and they will be honoured as far as they apply.

Changes

Any material change to what is collected, or to who processes it, will be reflected here first and the date below updated.

Last updated: 12 October 2026 for the shared Calendly demo event (including ShopVoice) and the on-page product selector; 9 October 2026 for Google Analytics with consent, the Style Swap AI booking calendar, for linking a store with your own Shopify app, the runtime file served from shopcanvas.ai, the live client store link and the Calendly embed note, and for wording the 13 September audit as a record of the site at that date; 8 October 2026; 3 October 2026 for Calendly retention, cancel/reschedule, and embed cookies; 28 September 2026 for Clerk accounts, Stripe subscription payments, forwarded email and Calendly bookings; the public browsing audit dates above are unchanged. Questions: contact@shopcanvas.ai.