Privacy Policy

1. Introduction and scope

THEME CANVAS UK LIMITED ("Theme Canvas UK", "we", "us") sets out here what personal data we process, why, on what legal ground, who else sees it, how long we keep it and what you can require us to do about it. It applies to:

• our website at https://themecanvas.uk, including documentation, support and checkout pages;
• our digital products — WordPress themes, Elementor template kits and plugins — including the licence, activation and update services they connect to;
• our custom website design, build and maintenance services;
• the mobile applications we publish on the Apple App Store and Google Play ("our apps"); and
• our email and support channels, principally team@themecanvas.uk.

It does not apply to third-party sites we link to, to the app stores, to WordPress.org, or to clients' websites once handed over and operated independently.

1.1 The documents this sits alongside

Read it with our Terms of Use (the contract for the website, products, services and apps), our Cookie Policy, the licence terms published with each product, and — where we build or maintain a site for a client — the data processing terms in that project contract, which take precedence for that processing.

1.2 Shortcuts

What a plugin sends us when it checks for updates: section 7. Who else handles your data: section 11. How long we keep things: section 13. Your rights: section 16. App account and data deletion: section 19.8.

2. Who this policy is for

We have several distinct audiences and our role differs between them. Find yourself below.

3. Who we are and how to contact us

3.1 Controller identity

"Theme Canvas UK" is a trading name of THEME CANVAS UK LIMITED. Except where this policy says we act as processor, that company is the controller.

3.2 Who is responsible

Data protection responsibility sits with the directors. A privacy question sent to team@themecanvas.uk reaches a person with authority to answer it and act on it. Post works too, at the address above.

3.3 Data Protection Officer

We have not appointed a statutory DPO, having assessed that Article 37 of the UK GDPR does not require one: we are not a public authority; our core activities do not consist of regular and systematic monitoring of people on a large scale; and we do not process special category or criminal offence data on a large scale (section 9). We keep that under review and will appoint one, and say so here, if it changes.

3.4 ICO registration

Most organisations owe an annual fee and a register entry to the ICO, a duty imposed by the Data Protection (Charges and Information) Regulations 2018. Where that duty falls on us we pay the fee, register, and keep the entry current. Printing a reference number here invites it to go stale, so we state the position instead; ask by email and the registration details will be sent for your diligence file.

3.5 Representatives

We are established in the UK, so no Article 27 UK representative is required. We have appointed no EU representative; if our offering to individuals in the EU brings us within Article 3(2) of the EU GDPR, we will appoint one and name them here.

4. Controller or processor — the role split

Almost every question about our obligations turns on which of two roles we are in, so we set them out first and label everything downstream.

4.1 What the words mean

A controller decides why and how personal data is processed, and carries the primary duties: lawful basis, privacy notice, rights requests, retention, breach reporting. A processor processes data on a controller's documented instructions and does not decide the purposes; it must follow instructions, keep data secure, use only approved sub-processors, help with rights requests, report breaches to the controller, and delete or return the data at the end.

4.2 Where we are controller

This policy is your privacy notice where you are a website visitor or correspondent; a customer or licence holder (order, invoice, licence, activation and update-check data); a support requester, for the ticket itself; a client, for the business relationship as distinct from the data on the site we build; an app user; or a supplier, business contact or job applicant.

4.3 Where we are processor

We act as processor, on our client's or customer's instructions, when we:

• design, build, migrate or maintain a website and so have access to personal data belonging to that client's own customers, members or enquirers — the WordPress users table, WooCommerce orders, form entries, comments, a mailing list held in the site;
• provide hands-on support on a live site and see whatever is on screen while diagnosing;
• take, hold or restore a backup of a client's site; or
• run a staging copy containing real data.

In each case the client is the controller, and our processing is governed by data processing terms containing the clauses Article 28(3) of the UK GDPR requires (section 8).

4.4 Where the roles meet

The boundary moves during a support conversation. If you email to say "the checkout is broken", the ticket — your name, address, description — is data we control. The moment we log in and open the failing order, the customer's data in that order is data you control and we process. The ticket is retained under section 13; what we see inside your site is used only to resolve your request and is not copied out except where a diagnostic export is strictly necessary and you have asked for it.

5. The lawful bases we rely on

As controller we must identify an Article 6 basis for each purpose. We use four:

• Art. 6(1)(a) consent — used narrowly: marketing emails, our mailing list, and any non-essential cookie or analytics technology we might introduce. Withdrawable at any time.
• Art. 6(1)(b) contract — necessary to perform a contract or take pre-contract steps you asked for: order fulfilment, licence issue and validation, updates, support, custom build work.
• Art. 6(1)(c) legal obligation — accounting and VAT records, lawful requests from public authorities, our own data protection duties.
• Art. 6(1)(f) legitimate interests — never a catch-all. Every use below names the interest, and for each we have carried out a balancing test: a written assessment weighing purpose, necessity and impact on you, including whether you would reasonably expect it. Ask us for a summary of any of them; you may object under section 16.6.

We rely on neither Art. 6(1)(d) vital interests nor Art. 6(1)(e) public task.

6. Data inventory — where we are controller

Our actual inventory. Each entry names the data a product or feature handles, why we hold it, the basis we hold it on, and how long it stays.

6.1 Enquiries and correspondence

6.2 Mailing list

6.3 Orders, invoicing, payment and tax

We never see or store your full card number. Card details go directly to a PCI-DSS compliant payment provider, which returns only a transaction reference, the result and a masked card summary. As at the effective date we take no payments through this website, and we will name our payment provider in section 11 before the first direct order is taken.

VAT. Our VAT status is stated on our invoices and at checkout. Where we supply digital products to EU consumers and the EU digital-services VAT rules apply, VAT is charged at the consumer's own country rate and we must collect and keep two pieces of non-contradictory evidence of location — normally billing country and the country the IP resolves to. That country evidence is a tax record, not a tracking signal, and is not used to profile you.

6.4 Licences, licence keys and activations

A site URL is usually not personal data, but for a sole trader or personal blog a domain can identify someone, so we treat activation records as personal data throughout.

6.5 Support tickets and diagnostics

6.6 Hands-on support access to your site

Where you ask us to look at your site directly, the following applies. Personal data belonging to your users, which we may see while in there, is processed by us as processor under section 8, not as controller.

How to grant access safely: create a named account for us rather than sharing your password, give it the lowest role that will do the job, send credentials by one-time secret link, and revoke it when the ticket closes — we will remind you. We will never ask for your own password, and will not act outside the scope of your request.

6.7 Website, licence-service and security logs

This website sets no analytics or advertising cookies and runs no third-party trackers — see the Cookie Policy.

6.8 Custom build clients — the business relationship

6.9 Three smaller categories

• Free products on WordPress.org. Downloads are served by WordPress.org, not us; we do not receive the identity of anyone who downloads. If a free version offers an optional connection to us, it says so when you enable it and is off until you do.
• Suppliers and business contacts. Name, business email and phone, role, company, account references, correspondence, invoices received. Art. 6(1)(f) — administering our supplier relationships, balancing test carried out — and Art. 6(1)(c) for the accounting record. Kept for the relationship plus 6 years. Shared only with our accountant.
• Job applicants. Contact details, CV, work history, interview notes, references you nominate, right-to-work information at offer stage. Art. 6(1)(b) for pre-contract steps, Art. 6(1)(c) for right-to-work checks, and Art. 6(1)(f) for holding an unsuccessful application briefly — considering you for a future role, balancing test carried out. Kept 6 months, or 12 if you ask to stay on file.

7. Licence validation and update checks

A plugin or theme installed on your website is software that talks to us. You are entitled to know exactly what it says, so this is not buried in a general sentence about "technical data".

7.1 Why the check exists

WordPress delivers updates by periodically asking a server whether a newer version exists. For components from WordPress.org it asks WordPress.org; for a paid product distributed by us it must ask us, and we must answer two questions — is there a newer version, and is this installation entitled to it. The check is required to deliver updates. Software that never phones home cannot tell you a security fix exists, let alone install it.

7.2 Exactly what is transmitted

The check does not contain, and will not without a separate opt-in: your site's content, posts, pages or media; your users, customers or orders; your visitors' data; admin usernames or passwords; a list of your other plugins and themes; your traffic or analytics; or any advertising identifier. We do not sell or share this data and do not use it for marketing.

7.3 How often, and how to stop it

It runs on WordPress's own update schedule — typically a few times a day, and when an administrator opens the plugins or updates screen — plus once when you enter a key to activate it and once if you deactivate to move the licence.

You can stop it: deactivate the licence, remove the key, or deactivate the product. The consequence is that you will no longer receive update notifications or one-click updates for that product, including security updates, and would need to update manually from your account. The software keeps working. It also keeps working when your updates-and-support period expires — you simply stop receiving new versions until you renew.

7.4 Free versions

Free GPL versions distributed through WordPress.org are updated by WordPress.org and send no licence checks to us.

8. Data inventory — where we are processor

This covers personal data we handle on behalf of a client or customer, who is the controller. If you are a member of the public whose data sits in a site we maintain, section 22 is written for you.

8.1 What we process and why

8.2 The commitments we give

Our processor contracts contain the terms Article 28(3) requires. Stripped of the drafting, here is what we sign up to. We act on the client's written instructions and nothing else, transfers included, unless a law forces our hand, in which case we say so first wherever saying so is lawful. Everyone with access is bound to confidentiality. The safeguards at section 14 are applied. A sub-processor is brought in only with permission, is held to the same obligations, and remains our responsibility rather than becoming the client's problem. Any change of sub-processor is put in writing beforehand, leaving room to object. Rights requests, security questions, breach reporting and impact assessments all get our help. A breach reaches the client quickly. At the close of the engagement the data is returned or destroyed, whichever the client picks. And whatever is needed to demonstrate that all of this is true is made available, including to an auditor the client appoints.

8.3 How we limit what we can see

We ask for a named account with the lowest sufficient role rather than a shared administrator password; we work on staging rather than live wherever the task allows; we ask clients not to seed staging with real customer data unless it must be real; and we export a client database only where a migration or documented diagnostic requires it, deleting the export as soon as it has served its purpose.

8.4 Handover and offboarding

Handover transfers administrative ownership to the client with a plain-English document and a walkthrough recording — and, for data protection purposes, the removal of our access. We ask the client to revoke our accounts and rotate shared credentials, and we delete working copies, staging environments and exports within 30 days of handover unless maintenance continues; the same happens when maintenance later ends, and we will certify deletion in writing on request. A walkthrough recording may show real data: we record against staging or anonymised content where possible, and otherwise delete our copy once the client confirms receipt.

8.5 Rights requests received in our processor role

If you contact us about data inside a client's website we are not the right destination, but we will not leave you stranded: we will tell you promptly that we act as processor, identify the controller where permitted, and forward your request without undue delay.

9. Special category and criminal offence data

Nine categories are ring-fenced by Article 9. Race and ethnicity. Politics. Religion, or a philosophy held in its place. Trade union membership. Genetics. Biometric measurements taken in order to identify a person. Health. Sex life, and sexual orientation. Article 10 handles offending and convictions on its own footing.

As controller we do not seek, need or intentionally process either. Nothing in our sales, licensing, support or app processes asks for it, and we carry out no criminal record checks. Because we do not process it, no Article 9(2) condition and no Data Protection Act 2018 Schedule 1 condition is engaged for our controller processing.

Two routes could bring it to us anyway. You might mention something sensitive in an email — an accessibility need, a health reason for a deadline. That is data you chose to give us; we would rely on Article 9(2)(a), explicit consent, only if we genuinely needed to act on it, and otherwise we do not extract it into any system and let it age out with the correspondence. Alternatively, a site we work on may hold such data about third parties — a health charity's membership list, say. There we are processor: the client must identify their Article 9 condition and the matching Schedule 1 condition and record it in the contract before work starts, and we will ask them to.

If you have sent us something you should not have, email team@themecanvas.uk. We will find it, delete it where that does not break a record we must legally keep, and confirm what we did.

10. Children's data

Our products and services are aimed at adults — site owners, designers, developers, agencies and business buyers — and are not directed at children. We do not knowingly collect children's personal data through them.

For our apps the position is set by the age rating on each store listing. We do not build for children's categories, run no advertising and profile nobody. We do not knowingly collect personal data from a child under 13 without the consent of someone with parental responsibility; in the UK a child under 13 cannot consent to an information society service in their own right (section 9, Data Protection Act 2018).

If you are a parent or guardian and believe a child has given us data, email team@themecanvas.uk — we will delete it promptly and tell you what we deleted. Where a client's site collects children's data the client is the controller, responsible for age assurance and consent; we will raise it with them if we see it.

11. Recipients and sub-processors

We keep the number of third parties deliberately small. Each processes data under a written contract restricting them to our instructions and requiring appropriate security. We do not sell or rent personal data, and we do not share it for anyone else's marketing.

Keeping the list current. If we take on a new provider that will process personal data, we update this table and the "Last updated" date when we switch it on, not afterwards. To learn the named provider behind a category above, email team@themecanvas.uk.

Sub-processor changes in our processor role. We will not add or replace a sub-processor touching a client's data without prior written notice giving them a real opportunity to object. If a client objects on reasonable data protection grounds we will look for an alternative, and if none exists they may terminate the affected service without penalty.

Business transfers. If the business is sold or reorganised, personal data may pass to the acquirer as part of the assets, subject to them handling it under this policy or one at least as protective. We would tell affected individuals.

12. International transfers

We would rather keep data in the UK, but parts of the internet are global: a CDN serves from the nearest data centre, and the app stores are US-operated. Where data leaves the UK we put a Chapter V mechanism in place.

The mechanisms in plain terms. UK adequacy regulations: the UK government has decided certain countries, including the EEA states, offer adequate protection, so no extra safeguard is needed. The UK International Data Transfer Agreement (IDTA): a standalone contract issued by the ICO under section 119A of the Data Protection Act 2018, used where a contract is written from scratch with the recipient. The UK Addendum to the EU SCCs: a short addendum adapting the EU clauses for UK transfers, used where a provider already offers the EU SCCs in its standard addendum — the common case.

Transfer risk assessments. A contract alone is not enough. Before relying on the IDTA or the Addendum we assess the sensitivity of the data, the destination's laws on government access, whether those laws would undermine the contractual protections, and what supplementary measures — encryption, minimisation, pseudonymisation — reduce the residual risk. We record the outcome, and where an assessment cannot support a transfer we do not make it. Ask us for the summary relevant to your data.

13. Retention

We keep data no longer than we need it: while the purpose is live, while the law requires the record, or while a limitation period for a claim runs. At the end of a period, data is deleted or irreversibly anonymised.

One consequence worth stating: when we delete something at your request it goes from live systems immediately, but a copy may sit in an encrypted backup until that backup rotates out, within 30 days. Backups are used for nothing else, and if one is restored we re-apply outstanding deletions.

14. Security

Article 32 requires security appropriate to the risk. Below is what we actually do. We are happy to answer specific security questions from a customer doing due diligence.

14.1 Technical measures

• Encryption in transit. The website, the licence and update service and app traffic use HTTPS with TLS. Licence checks and update downloads have no plain-HTTP fallback.
• Encryption at rest. Data in our infrastructure and backups is encrypted at rest by the underlying platform; laptops used for client work have full-disk encryption.
• Access control and least privilege. Access is limited to those who need it for their role; administrative accounts are individual and named, never shared; multi-factor authentication is enabled on our email, hosting, code repository, app store and payment accounts; credentials live in a password manager, not in documents or chat.
• Network protection. Our site and licence service sit behind a provider supplying TLS termination, DDoS mitigation, bot management and a web application firewall, with security headers set at the edge.
• Logging. Requests and administrative actions are logged so an incident can be reconstructed; logs are short-lived and access is restricted.
• Backups. Encrypted, held separately from live systems, rotated on a 30-day cycle, and restore-tested rather than assumed.
• Secure development. Version-controlled code with a reviewed change history; dependencies kept current and monitored for published vulnerabilities. In our products we follow WordPress's security guidance — output escaping, input sanitisation, prepared statements, capability and nonce checks — and treat a security report as the highest-priority ticket. Found a vulnerability? Email team@themecanvas.uk and we will work with you on coordinated disclosure.
• Environment separation. Development and staging are kept apart from production, and we avoid real personal data in either.

14.2 Organisational measures

• Confidentiality. Everyone working on our systems or a client's — employee, contractor or freelancer — is bound by written confidentiality terms that survive the engagement.
• Minimisation by habit. No accounts and no contact form on the website; nothing in a licence check beyond section 7; a preference for looking at a problem inside a client's site over receiving a copy of their database.
• Supplier due diligence. Before a provider processes data for us we check what it will process, where, on what contract terms, with what documented security and what breach commitment. We prefer providers whose addendum already incorporates the UK Addendum or IDTA.
• Awareness and incident response. Responsibility sits with the directors, who track ICO guidance and run the process in section 15.

No system is perfectly secure. What we commit to is proportionate measures, honest disclosure when something goes wrong, and holding less data in the first place.

15. Personal data breaches

The statutory definition is wider than most people expect. Any security failure that destroys personal data, loses it, alters it, exposes it or lets the wrong person reach it qualifies, whether somebody meant it to happen or not. Being attacked is only one route in. Mislaying the sole copy counts. So does attaching the wrong file to an email.

15.1 Our process

1. Escalate. Anyone who suspects a breach tells a director immediately — no filtering step, no waiting for confirmation.
2. Contain. Revoke credentials, disable the affected access, take a component offline if needed, preserve evidence.
3. Assess. What data, whose, how much, how sensitive, whether encrypted, whether recoverable, and what could realistically happen to those affected. The 72-hour clock runs from when we become aware, so this starts immediately and runs alongside containment.
4. Notify the ICO. A breach carrying likely risk to anyone's rights and freedoms goes to the regulator promptly, and inside 72 hours of our becoming aware wherever that is achievable, as Article 33 requires. Partial information now beats complete information later, so we report in stages if we must, and lateness comes with an explanation attached.
5. Notify individuals. Where there is likely to be a high risk to your rights and freedoms we tell you directly, without undue delay and in plain language (Article 34): what happened, what data, likely consequences, what we are doing, what you can do, and how to reach us. Where direct contact would involve disproportionate effort we make a public communication instead.
6. Record and learn. Every breach is documented — facts, effects, remedial action — notifiable or not (Article 33(5)), kept six years, and followed by a change to the process rather than just the password.

15.2 Where we are processor

If a breach affects data we process for a client, the notification decision is theirs as controller. Our duty is to notify them without undue delay after becoming aware, with the information they need for their own assessment and their own 72-hour deadline: a call or email the same day, a written account as the facts firm up, and whatever help they need afterwards.

16. Your rights

Where we are controller you have the rights below. Where we are processor they are exercised against the controller — see section 8.5.

16.1 To be informed

To know what we do with your data, concisely and intelligibly. That is what this document is for; if part of it does not answer your question, tell us and we will answer it and improve the wording.

16.2 Access

Ask whether we hold anything about you and you are entitled to a yes or a no, and where the answer is yes, to a copy together with everything Article 15 lists: why we hold it, which categories, who sees it, how long it stays, what else you can demand, and where it came from if it did not come from you. Special wording is unnecessary. An ordinary email asking for your data is a valid request. A very wide request may prompt us to ask whether you can narrow it, but your answer is never a condition of ours.

16.3 Rectification

To have inaccurate data corrected and incomplete data completed. Where we have shared it we will tell the recipients unless that proves impossible or disproportionate, and will tell you who they were if you ask.

16.4 Erasure

Erasure is owed in four situations: the purpose has run out, consent was withdrawn and nothing else supports the processing, you objected and nothing outweighed the objection, or the processing should never have happened. It is not unconditional. A live contract or a record the law obliges us to keep will produce a refusal with reasons, and the everyday example is an invoice still inside its six-year window.

16.5 Restriction

You can freeze the file rather than delete it, leaving us holding the data but doing nothing further with it. Three moments call for that: while a challenge to accuracy is checked, while an objection is weighed, and where a legal claim of yours needs the material kept intact.

16.6 Objection

Where a legitimate interest is what supports the processing, your particular circumstances entitle you to challenge it at any moment. Work stops on receipt, and resumes only if our side of the scale turns out to be weightier, or the material is bound up in a legal claim. Each legitimate interest in this document is named where it is relied on, so an objection can be aimed at something specific. Marketing is different and absolute: object once and it stops for good, with no weighing exercise of any kind.

16.7 Portability

Data that came from you, that a computer rather than a person processes, and that rests on consent or on a contract, can be demanded back in a structured, widely used, machine-readable form. You may also ask us to send it straight to another organisation, provided the plumbing exists to do so. Around here that means an application account with its content, plus your licence and order history, handed over as JSON or CSV.

16.8 Withdrawing consent

Consent, wherever we depend on it, can be taken back whenever you choose, by a route no harder than the one that gave it. The unsubscribe link does it; so does a reply with the word unsubscribe in it. What was done beforehand remains lawful, since withdrawal looks forward rather than back.

16.9 Automated decisions

See section 17: we make none.

16.10 How to exercise a right, and how we verify you

Email team@themecanvas.uk or write to the registered office. Describe what you want in your own words — you need not cite an article, use the phrase "subject access request", or pay anything.

We must be reasonably sure you are who you say you are, because disclosing your data to an impersonator would itself be a breach. Usually a request from the email address already tied to your account, licence or correspondence is enough. Where the data is more sensitive, or the address does not match, we may ask for one additional proof — an order reference, a licence key. We ask for the least that will do, never for disproportionate identity documents, and we do not keep verification material after the request closes. If someone acts for you, we will ask for evidence of their authority.

16.11 How long we take

The deadline is one month, running from your request or from the moment the last piece we needed to identify you arrives, and we are not to dawdle inside it. Complexity, or several requests arriving together, permits an extension of up to two months more; you would hear about that inside the first month, with the reason. A studio this size usually replies within days.

16.12 When we may refuse or charge

Requests are free. We may charge a reasonable administrative fee, or refuse, where a request is manifestly unfounded or excessive — for example the same request repeated with no interval. That is a high bar, not a way to avoid inconvenient requests. If we refuse we will say why, and tell you about the ICO and your right to a judicial remedy, within the same month.

16.13 If you are not satisfied

Come back to us first — most complaints are misunderstandings a second exchange resolves. If that fails, section 18 explains the regulator route, and nothing here stops you taking it at any point.

17. Automated decision-making

Article 22 protects you from having something significant settled about you by a machine alone, profiling included, where the outcome carries legal weight or affects you to a comparable degree.

We make no such decisions. We do not profile customers or score individuals, and use no automated processing to decide whether to sell to you, what to charge you, how to resolve a support request, or anything else with a legal or similar effect. The nearest things to automation are the licence check in section 7 — a mechanical contractual check on a key, not an assessment of you — and the automated security decisions our hosting provider makes about individual requests, which may present a challenge page. Neither has a legal or similarly significant effect within Article 22, and in both cases a human can review: if a licence check or a challenge locks you out, email us and a person will sort it out.

If we ever introduce processing within Article 22 we will say so here first, explain the logic and the consequences, and implement the Article 22(3) safeguards — at minimum human intervention, the ability to express your view, and the ability to contest the decision.

18. Complaining to the ICO

Raising it with us first is welcome, at team@themecanvas.uk, and often quicker. Nothing obliges you to. The regulator's door is open to you directly, at whatever moment you choose, and Articles 78 and 79 of the UK GDPR additionally guarantee you a route through the courts.

19. Mobile applications

This section covers the apps published by THEME CANVAS UK LIMITED on the Apple App Store and Google Play. The rest of this policy — rights, security, transfers, breaches, retention — applies to app data as much as to anything else.

19.1 Which apps, and where the app-specific detail lives

It covers every app whose developer name is THEME CANVAS UK LIMITED. Individual apps use subsets of what follows — an app without accounts collects no account data — and the app-specific statement is the privacy information on its store listing: Apple's Privacy Nutrition Label and Google Play's Data Safety section. We commit that those declarations accurately reflect this policy — data collected, purpose, sharing, encryption in transit and deletion availability — and that we update them together with it. If a store disclosure and this policy appear to disagree, tell us: that is a bug in our documentation and we will fix and republish both.

19.2 What our apps process

19.3 Permissions

We ask for the fewest permissions that will do the job, at the moment they are needed and with an explanation, rather than a wall of prompts at first launch. Every permission below is optional.

Our apps do not request precise or background location, contacts, calendars, microphone, health or motion data. If a future app needs one, it will ask at the point of use, explain why, and work without it wherever possible.

Revoking on iOS: Settings → scroll to the app → toggle the permission off; notifications also at Settings → Notifications → the app. Photo access can be set to Limited rather than All Photos, and the selection changed at any time. Revoking on Android: Settings → Apps → the app → Permissions → Don't allow; or review across all apps at Settings → Privacy → Permission manager, which also offers to remove permissions from apps you have not opened for a few months.

19.4 On-device storage versus our servers

Our default is that content lives on your device. An app with no accounts and no sync keeps everything locally and we never see it — deleting the app deletes the data with it, so export anything you want to keep first. Where you turn sync on, content is also stored on our servers so it can reach your other devices, encrypted in transit and at rest, and accessed by us only where you ask for support.

19.5 Identifiers, advertising and tracking

Where an app must tell one installation from another — to attach a crash report to the right session, or restore a purchase — it uses a per-install identifier generated locally, specific to that install, reset if you delete and reinstall, and shared with nobody.

We do not use advertising identifiers. We do not read the iOS IDFA or the Android Advertising ID, include advertising SDKs, show adverts, sell or share data with data brokers, or build cross-app or cross-site profiles.

19.6 iOS App Tracking Transparency

Apple's ATT framework requires a prompt before an app links user or device data with data from other companies' apps or websites for advertising or data-broker purposes. Our apps do not do that, so no ATT prompt appears. If that changed, we would show the prompt and obtain permission before any such tracking began, and update this policy and the App Store label first.

19.7 In-app purchases and subscriptions

Where an app sells anything, Apple or Google is the merchant: you pay them, they take your payment details, and we never see your card number. We receive a validated receipt or purchase token confirming that a purchase exists, for which product, and whether a subscription is current, plus aggregate sales reporting that does not identify buyers. Subscriptions renew automatically until cancelled in your store account's subscription settings — not with us, and not by deleting the app; see our Terms of Use. Apple's and Google's privacy policies govern the payment data they hold.

19.8 Account and data deletion

Both stores require a straightforward deletion route, and so do we. Where an app offers accounts:

• In the app: Settings → Account → Delete account. You are asked to confirm, told what will be removed, and offered an export first.
• By email: team@themecanvas.uk with the subject "Account deletion request", from the address linked to the account. If you have lost access to that address, say so and we will find another proportionate way to verify you.

We complete deletion within 30 days of a verified request, normally much sooner. It removes your account record, synced content, display name, email address and account-linked support history. Backups holding a copy rotate out within a further 30 days (section 13).

What survives, and why: the accounting record of any purchase, because tax law requires six years and we cannot lawfully delete it; a suppression record if you had opted out of marketing; and the minimum needed to establish, exercise or defend a legal claim. These are kept apart and used for nothing else.

Deleting your account does not cancel a store subscription — cancel that in your Apple or Google account settings first, or billing continues.

20. Marketing communications

Our marketing is modest by design: an occasional email to people who asked to hear from us, sent with consent under Article 6(1)(a) and PECR regulation 22. Where you have bought from us, PECR's "soft opt-in" would allow email about our own similar products provided we gave a simple refusal route at the point of purchase and in every message; if we rely on it we will say so at collection, and the opt-out will be one click.

To stop: use the unsubscribe link, reply "unsubscribe", or email team@themecanvas.uk. We act immediately and permanently, without asking why, and keep your address on a suppression list solely so we cannot re-add you.

Service messages are different and cannot be unsubscribed from while you have a live relationship with us: receipts, licence keys, security advisories about a product you have installed, notice that your updates period is ending, or a change to these terms. They are not marketing and we keep them minimal.

21. Cookies and similar technologies

The Cookie Policy is the full account. Briefly: nothing here counts you and nothing here advertises to you, and no third-party tag runs on these pages. What may appear is a pair of strictly-necessary security values, written by the provider that shields the site against automated abuse. Because nothing non-essential is set, no consent banner is required and we would rather not show one that does nothing. If we introduce a non-essential technology, we will obtain consent before it is set and update both policies at the same time.

22. If your data reached us via a client

This is for members of the public who have never dealt with us. If you filled in a form, bought something or created an account on a website we built or maintain for a client:

• The website's owner is the controller. They decided what to collect and why, and their privacy notice — the one on the site you used — governs it, not this one.
• We are the processor. We act on their instructions, use nothing for our own purposes, market to nobody, and sell or share nothing.
• Exercise your rights with them. Their notice will say how. If you cannot find it, or have heard nothing back, write to team@themecanvas.uk: we will tell you we are the processor, pass your request to the controller without undue delay, and identify them where we are permitted to.
• If something has gone wrong and you believe data on a site we maintain has been exposed, tell us. We will notify the client immediately under section 15.2.

23. Changes to this policy

• The "Last updated" date and version number at the top change at the same time as the text, never afterwards.
• Minor changes — clarified wording, a corrected link, added detail that does not alter what we do — are published with an updated date.
• Material changes — a new category of data, purpose, lawful basis, sub-processor handling your data, or retention period — are notified before they take effect: prominently on this page, by email to customers and licence holders where we hold an address, and in-app or in release notes for app users.
• Anything that turns on your consent is put to you as a question. Continued use of the site is never treated as the answer.
• We keep previous versions and will send you one on request.

Version history. Version 1.0 — 31 July 2026, first publication. Version 2.0 — 5 August 2026, substantial expansion: the controller/processor role split, the full data inventory with lawful bases and balancing tests, the licence and update-check disclosure, recipients and transfer mechanisms, detailed retention, the breach process, and expanded rights and mobile application sections.

24. How to contact us

If you write by post about a data protection matter, please include an email or return address and tell us how you would prefer us to reply. If an accessibility requirement makes email difficult, say so and we will find a format that works for you.