Legal · GDPR
Privacy Policy
This policy explains what personal data we process when you visit our website or use the Decision Canvas application, why we do so, on what legal basis, and which rights you have under the EU General Data Protection Regulation (GDPR). We apply the GDPR to everyone who uses Decision Canvas, wherever they are.
01Who is responsible (controller)
The controller within the meaning of Art. 4 (7) GDPR is:
- Controller
- Smart Canvas Tech OPC Limited
- Address
- Bangalore, India
- Represented by
- S. Mitra
- Privacy contact
- [email protected]
We are not legally required to appoint a data protection officer (Art. 37 GDPR). Please send any privacy question or request to the contact above.
Our representative in the EU (Art. 27 GDPR)
As we are established outside the EU, we have designated a representative in the European Union. You can contact them instead of, or in addition to, us on any data protection matter:
- EU representative
- Coming Soon..
- Address
- Germany
- [email protected]
02Summary
- No tracking. This website uses no analytics, advertising or tracking cookies and no third-party social media plugins. You will therefore not see a cookie banner.
- No third-party fonts or CDNs. Fonts and scripts are served from our own server; your IP address is not passed to Google or other font providers.
- Your content stays yours. Documents and other content you upload to a workspace are processed only to provide the service to you. We do not use them to train AI models.
- You are in control. You can access, export, correct or delete your data at any time — see Your rights.
03Visiting this website
Server log files
Every time you open a page, your browser automatically transmits information that our hosting provider stores in server log files:
- IP address of the requesting device
- date and time of the request, the page or file requested, and the amount of data transferred
- HTTP status code, referrer URL, browser type and version, operating system
We need this data to deliver the website, ensure its stability and security, and detect and fend off attacks. Legal basis: Art. 6 (1) (f) GDPR — our legitimate interest in a secure, working website. Log files are deleted after 14 days at the latest, unless further retention is necessary to investigate a specific security incident.
Local storage (theme preference)
If you use the “Dark mode / Light mode” switch, your choice is saved in your browser's local storage under the key dc-theme. It never leaves your device and is not used to identify you. Storing it is strictly necessary to provide the function you explicitly requested (Art. 5 (3) ePrivacy Directive 2002/58/EC and its national implementations, e.g. § 25 (2) no. 2 TDDDG in Germany); no consent is required. You can remove it at any time by clearing your browser's site data.
Hosting
The website is hosted by an external hosting provider who processes the data above on our behalf under a data processing agreement pursuant to Art. 28 GDPR.
04Contact and beta invitations
If you email us, call us, or request an invitation to the beta, we process the data you give us — typically your name, email address, company, and the content of your message — to handle your request and, for invitations, to manage your participation in the beta programme.
Legal basis: Art. 6 (1) (b) GDPR where your request relates to a contract or steps prior to one; otherwise Art. 6 (1) (f) GDPR — our legitimate interest in answering enquiries. We delete the data once your request is fully handled, unless statutory retention obligations apply. Beta registration data is deleted when the beta ends or earlier on request.
Contact via WhatsApp
Our website offers a WhatsApp button. It is a plain link: no WhatsApp or Meta code is loaded on our pages, and no data is transferred while you browse. Only when you type a question and choose “Continue in WhatsApp” does your browser open WhatsApp (wa.me) with your question pre-filled; the message is sent only when you press send in WhatsApp.
If you contact us this way, WhatsApp is provided by WhatsApp Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland (part of Meta), which processes your phone number, profile name, message content and metadata under its own privacy policy; data may be transferred to Meta Platforms Inc. in the USA under the EU-U.S. Data Privacy Framework. We receive your phone number, profile name and messages and use them only to answer your request. Legal basis: Art. 6 (1) (b) or (f) GDPR as above. We delete the chat once your request is handled, unless it led to a contract. If you prefer not to use WhatsApp, please email us instead.
05Using the Decision Canvas application
Account data
To create and run your account we process your name, business email address, organisation, role in the workspace, password (stored only as a salted hash), multi-factor authentication settings and your account preferences. Legal basis: Art. 6 (1) (b) GDPR — performance of the contract.
Workspace content
Content that you or your team put into a workspace — uploaded documents, cards, notes, tasks, chat prompts and answers, contacts and scheduled messages — may contain personal data. We process this content solely to provide the service.
Sending messages
When a card is sent now or on a schedule, we transmit the message and the recipient's contact details (e.g. Slack channel or user, phone number, email address) to the messaging channel you selected — Slack, WhatsApp, SMS or email — and record it in the workspace outbox (recipient, channel, time, status, content). Legal basis: Art. 6 (1) (b) GDPR towards our customer; for recipients, Art. 6 (1) (f) GDPR — the workspace owner's legitimate interest in communicating its decisions. Workspace owners are responsible for having a lawful basis to contact their recipients.
Connectors and your own AI key
If you connect an external service (for example a Google Sheet via an MCP connector) or enter your own AI provider key, we exchange data with that service on your instruction. Processing by that provider under your own account is governed by your agreement with them.
Usage and security logs
To operate the service securely we log sign-ins, IP addresses, device and browser information, and actions such as creating, sharing or deleting items. We use this to prevent abuse, investigate incidents, enforce usage limits and fix errors. Legal basis: Art. 6 (1) (f) GDPR — our legitimate interest in a secure and reliable service.
Billing (paid plans)
Once paid plans are available, we process billing contact, company and VAT details, plan and invoice history. Payment card data is handled directly by our payment service provider; we do not store full card numbers. Legal basis: Art. 6 (1) (b) and (c) GDPR.
Service emails
We send emails that are necessary for the service (e.g. invitations, security alerts, scheduled-send failures, changes to terms). We only send product news or marketing with your consent (Art. 6 (1) (a) GDPR) or, for existing customers, about similar services within the limits of Art. 13 (2) ePrivacy Directive — you can unsubscribe at any time via the link in every such email.
06AI processing
Decision Canvas uses large language models to draft cards from your documents, answer questions and carry out instructions on the board. To do this:
- uploaded documents are split into passages and indexed within your workspace so the relevant passages can be found and cited;
- the passages relevant to a request, together with your prompt, are sent to an AI model provider, which returns the generated text;
- we use the content of your workspace only to provide the service to you — we do not use it to train or improve AI models, and we do not sell it;
- if you supply your own AI provider key, requests run under your account with that provider.
No automated decisions. AI output is a suggestion. Cards are only accepted, scheduled or sent by people in your team; we do not make decisions with legal or similarly significant effect on you based solely on automated processing (Art. 22 GDPR). Please check AI-generated content before relying on it.
07Recipients of personal data
We only share personal data where necessary for the purposes above. Service providers act as processors under Art. 28 GDPR, bound by our instructions and a data processing agreement.
| Category of recipient | Purpose | Role |
|---|---|---|
| Hosting and cloud infrastructure providers | Running the website, application, database and file storage | Processor |
| AI model providers | Generating drafts, answers and summaries from your prompts and documents | Processor |
| Email delivery and SMS providers | Sending service emails, invitations and scheduled messages | Processor |
| Messaging platforms (Slack, WhatsApp) | Delivering messages to the channel you select | Independent controller under their own terms |
| Payment service provider (paid plans) | Processing payments | Independent controller / processor |
| Tax advisers, auditors, authorities, courts | Statutory obligations and legal claims | Independent controller |
A current list of our sub-processors is available on request. Within a workspace, content is visible to the members the workspace owner has granted access to. In the event of a merger or sale of our business, data may be transferred to the acquirer under this policy; we will inform you beforehand.
08Transfers outside the EU/EEA
We are based in India, so personal data of users in the EU/EEA is processed in India. Some of our service providers may also process data in other countries, in particular the United States.
- India: there is no EU adequacy decision for India. Where we process data of EU customers as their processor, the transfer is covered by the EU Standard Contractual Clauses (Art. 46 (2) (c) GDPR) included in our data processing agreement. Where we are the controller (e.g. account data, website visits), we collect the data directly from you in order to provide the service you requested (Art. 3 (2) GDPR), and we apply the same protections described in this policy.
- Other countries: we only use providers in a country for which the European Commission has issued an adequacy decision (Art. 45 GDPR) — for the USA, companies certified under the EU-U.S. Data Privacy Framework — or with whom the EU Standard Contractual Clauses are in place, supplemented by additional measures where necessary.
You can request a copy of the relevant safeguards at the contact address in section 1.
09How long we keep data
| Data | Retention |
|---|---|
| Website server logs | Max. 14 days, unless needed to investigate a security incident |
| Contact enquiries, beta registrations | Until the request is handled or the beta ends; earlier on request |
| Account data | For the life of the account; deleted within 30 days after account closure |
| Workspace content and outbox | Until deleted by you or the workspace owner; removed from backups within a further 30 days |
| Application security logs | Up to 90 days |
| Invoices and accounting records | 8 years, as required by Indian company and tax law (Section 128 Companies Act 2013), or longer where local law requires |
10Your rights
You have the following rights regarding your personal data. To exercise them, email [email protected] or our EU representative (section 1); we will respond within one month. Many actions — editing your profile, exporting or deleting content, closing your account — are also available directly in the application.
Confirmation of whether we process your data, and a copy of it.
Correction of inaccurate or incomplete data.
Deletion of your data, unless we must keep it by law.
Limiting processing, e.g. while accuracy is disputed.
Your data in a structured, machine-readable format.
At any time, with effect for the future.
Right to lodge a complaint
You have the right to complain to a data protection supervisory authority (Art. 77 GDPR), in particular in the EU member state of your residence, workplace or the place of the alleged infringement. As we have no establishment in the EU, you can turn to the authority in your own country. A list of all EU data protection authorities is published by the European Data Protection Board:
11Right to object (Art. 21 GDPR)
Where we process your data on the basis of legitimate interests (Art. 6 (1) (f) GDPR), you have the right to object at any time, on grounds relating to your particular situation. We will then stop processing unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. Where we process data for direct marketing, you may object at any time without giving reasons, and we will stop. Send your objection to [email protected].
12Security
We protect your data with technical and organisational measures appropriate to the risk (Art. 32 GDPR), including TLS encryption of all connections, encryption of stored data, invite-only workspaces with role-based access, multi-factor sign-in, and restricted, logged staff access. No method of transmission or storage is completely secure, but we work continuously to keep these measures up to date.
13Other information
Obligation to provide data
You are not legally obliged to provide personal data. Without the account data described in section 5, however, we cannot provide the application to you.
Children
Decision Canvas is a business service and is not directed at anyone under 16. We do not knowingly collect data from children; if you believe a child has provided us with data, please contact us and we will delete it.
Links to other websites
Our pages contain links to websites of other providers. This policy does not apply to them; please read their privacy policies.
Changes to this policy
We update this policy when our services or the law change. The date at the top shows the latest version. If a change materially affects how we process account holders' data, we will notify you by email or in the application before it takes effect.