How we handle your photos and data

tschancreative, Dominic Tschan, Schützenhausstrasse 12, 5622 Waltenschwil, Switzerland, operates CanvasBurst and is responsible for your data. Questions and requests: dominic@canvasburst.com.

• Your photo, your dedication text and your choices (such as the lettering): to create your preview and revisions.
• The previews and artworks created from your photo: to show them to you and to print your order.
• Your e-mail address, which you give us before we start: we send you the link to your artwork, because it takes a few minutes and because the copy in your browser is gone after 24 hours. While we keep your preview we may also send up to 2 short reminders about it. Every one of these e-mails has an unsubscribe link, and after you unsubscribe we send no more reminders to that address.
• Checking our work: we can view your photo, previews and revisions in our password-protected admin area to answer your questions, prepare your order and check the quality of our artworks. We do not use them for anything else without your permission.
• Your answer, if you give one: on the page with your artwork we ask, in one click, why you are not ordering today. Your answer and the optional comment tell us what to improve. They are stored with your preview and deleted with it, and we never use them to contact you.
• How long you waited: while your artwork is being painted we note when the painting started, whether the page stayed open until it was ready or after how many seconds you left, and whether you later opened your artwork from our e-mail. These notes contain no personal details, use no cookies, stay with us and are deleted with your preview.
• Your confirmations: that you may use your photo, and whether you allowed us to feature your finished artwork, each with the date and the wording you agreed to, so we can prove and respect your choices.
• Order details from checkout: name, e-mail address, phone number, shipping address, the items you ordered and the amounts paid. We use them to produce and deliver your order, to send you order e-mails, for customer service and to keep the records the law requires. Card details are handled by Stripe; we never see your full card number.
• Technical data such as IP address, browser type and time of access in the logs of our hosting provider: to run the website securely.
• Codes for the daily limit of free previews: codes calculated from your IP address and browser type that cannot be turned back into them. We use them only to limit free previews to 2 per day and device and to prevent misuse.
• Ad measurement, only if you accept cookies: the Meta Pixel records which of our pages you visit and whether you create a preview, start checkout or order, together with cookie IDs, browser type and IP address. If you order, we also send Meta the order value and your e-mail address, phone number, name and shipping address in hashed form (turned into a code that can be matched but not read back). Meta uses this to show our ads to people who may like them and to tell us which ads lead to orders.

• We do not sell or rent your personal information.
• Without your permission, we do not use your photos or artworks for advertising or any purpose other than your order.
• We do not scan faces to identify people, and we do not create face measurements or face templates.
• We only show your finished artwork on our website or social media if you allowed it when you created your preview. We never show your original photo or your name, and you can withdraw your permission at any time.

We work with service providers who process data on our behalf and only for the purposes described here:

• website hosting (United States),
• file storage and database (United States or European Union),
• image processing that paints your artwork from your photo (United States),
• payment processing by Stripe (United States and European Union),
• e-mail delivery (United States),
• our print and shipping partner, who produces and ships your canvas, and the carrier who delivers it.

Some of these providers are located outside Switzerland. Where the law requires it, we rely on the Swiss-U.S. Data Privacy Framework for certified providers or on standard contractual clauses. We may also disclose information if the law requires us to.

If you accept cookies, we also work with Meta Platforms (Facebook and Instagram; Ireland and the United States) to measure our ads. Meta uses this information partly for its own purposes, as described in Meta's privacy policy.

• Without an order, your photo, previews, revisions, dedication and the e-mail address you gave for the preview are deleted 30 days after your last change (a new preview, a revision or a started checkout).
• With an order, we keep your photo and the artwork for 12 months, so we can handle quality claims and reprints. Then we delete them, together with your e-mail address, your phone number and your dedication.
• The order record (order number, date, items, amounts, name and shipping address) is part of our accounting records. Swiss law requires us to keep it for 10 years after the end of the year of your order; then we delete it.
• If you allowed us to feature your artwork, we may keep a copy of the finished artwork for that purpose until you withdraw your permission.
• The copy in your own browser is removed when you visit our website again after 24 hours. You can also remove it at any time by clearing your browser's site data.
• Your cookie choice is stored in your browser for 12 months; then we ask again.
• The codes for the daily limit of free previews are deleted after 2 days.

We do not use analytics cookies. With your consent, we use the Meta Pixel to measure our ads on Facebook and Instagram. It sets cookies (_fbp, and _fbc when you arrive from an ad) and sends the information described above to Meta, which can recognize you across other websites and apps. If you decline, the pixel is not loaded and we send nothing to Meta. You can change your choice at any time with “Cookie settings” at the bottom of every page.

If your browser sends a Global Privacy Control or Do Not Track signal, we treat it as a decline, unless you accept yourself. Your browser also stores your photo and preview locally for 24 hours so you can see your preview; this data does not leave your device except when you create a preview or order. The checkout on Stripe's pages is subject to Stripe's privacy policy.

Our service is for adults. Parents and legal guardians may upload photos of their children to create a family artwork; we use these photos only for that purpose, as described above.

Your data is transmitted encrypted, your files are kept in private storage with restricted access, and previews are shown with a watermark. No system is completely secure, but we work to protect your information.

Wherever you live, you can ask us to tell you what personal information we hold about you, to correct it, or to delete it, and you can withdraw any permission you gave us. Write to dominic@canvasburst.com; we answer within 30 days. Records we must keep by law are kept until their period ends. If you think we handle your data unlawfully, you can also contact the Swiss Federal Data Protection and Information Commissioner (FDPIC).

We send you e-mails about your preview (the link to your artwork and up to 2 reminders while we keep it) and about your order, such as the confirmation and shipping updates. Every e-mail about a preview has an unsubscribe link; messages about an order you placed are part of that order. We do not send any other marketing e-mails unless you have signed up for them.

When we change this policy, we publish the new version on this page with a new date. If a change significantly affects how we use data we already hold, we will tell you before it applies.

dominic@canvasburst.com · Legal notice