Privacy Policy

1. Overview

WhimCanvas ("we", "us", "our") is operated by Blackweight Intelligence. This Privacy Policy describes how we collect, use, disclose, and safeguard your information when you use our platform at whimcanvas.com and its subdomains.

By using WhimCanvas, you consent to the data practices described in this policy. If you do not agree, please discontinue use of the service.

2. Information We Collect

2.1 Information You Provide

• Account Information: Name, email address, and profile photo when you sign up (including via Google OAuth).
• Organisation & Workspace Data: Organisation name, workspace names, and configuration settings you create.
• Content: Tasks, messages, files, calendar events, and other content you create within WhimCanvas.
• Payment Information: Billing details processed securely via our payment provider. We do not store raw card numbers.
• Communications: Messages you send to our support team.

2.2 Information Collected Automatically

• Usage Data: Pages visited, features used, actions performed, and session duration.
• Device & Browser Info: Browser type, OS, screen resolution, and IP address.
• Log Data: Server logs including timestamps, request paths, and error information.

3. How We Use Your Information

We use the information we collect to:

• Provide, operate, and improve the WhimCanvas service.
• Authenticate you and manage your account and sessions.
• Process payments and send billing-related communications.
• Send important product updates, security notices, and policy changes.
• Respond to your support requests and feedback.
• Detect, prevent, and investigate fraud, abuse, and security incidents.
• Analyse usage patterns to improve features and user experience.

We do not sell your personal data. We do not use your content to train AI models without your explicit consent.

4. Sharing of Information

We do not sell, trade, or rent your personal data. We may share your information only in the following circumstances:

• Within Your Workspace: Content you create is visible to other members of your workspace as determined by your organisation's settings.
• Service Providers: We share data with trusted sub-processors (listed below) solely to operate the service.
• Legal Requirements: We may disclose information if required by law, regulation, or legal process.
• Business Transfers: In the event of a merger or acquisition, your data may be transferred as part of that transaction. You will be notified in advance.

Key Sub-Processors

5. Data Storage & Security

Your data is stored on Neon PostgreSQL servers in Singapore and files on Cloudflare R2. We implement industry-standard security measures including:

• Encryption in transit (TLS 1.2+) for all data.
• Encryption at rest for sensitive database fields.
• Access controls and role-based permissions.
• Regular security reviews and dependency updates.

No method of transmission or storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

6. Cookies & Tracking

We use the following types of cookies:

• Essential Cookies: Required for authentication, session management, and core functionality. Cannot be disabled.
• Preference Cookies: Remember your settings such as theme preferences.
• Analytics Cookies: Help us understand how users interact with the platform (used only in aggregated, anonymised form).

You can control cookie preferences through your browser settings.

7. Third-Party Services

WhimCanvas integrates with third-party services such as Google (for OAuth login). When you use these integrations, your use of those services is also governed by their respective privacy policies:

• Google Privacy Policy

8. Your Rights

Depending on your location, you may have the following rights:

• Access: Request a copy of the personal data we hold about you.
• Rectification: Request correction of inaccurate data.
• Erasure: Request deletion of your personal data ("right to be forgotten").
• Portability: Export your data in a machine-readable format.
• Objection: Object to certain types of data processing.
• Withdrawal of Consent: Withdraw consent for optional data uses at any time.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

9. Children's Privacy

WhimCanvas is not directed to individuals under the age of 16. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will delete it promptly.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes via email or a notice within the product at least 14 days before the changes take effect. The "Last updated" date at the top reflects the most recent revision.

11. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us: