Privacy Policy

Last updated: 11 November 2026

Legal review pending. This policy describes the current product practices in plain language. It is being reviewed by qualified counsel and is not a claim of certification or compliance with any particular privacy framework.

1. Who we are and what this policy covers

WeddingCanvasAI (“WeddingCanvas”, “we”, “us”) provides AI-assisted wedding decor visualization, editing, budgeting and planning tools. This policy explains how we handle personal information when you use our website, applications and paid plans. It does not cover a third party’s own website or payment page.

Privacy questions and requests: toptensteff@gmail.com. We may need to verify that a request comes from the account holder before acting on it.

2. Information we collect

  • Account and authentication data: name, email address, password credentials handled by our authentication provider, sign-in method, and account identifiers. If you use Google sign-in, Google provides basic profile information according to your Google settings.
  • Images and creative content: venue photos, reference images, prompts, editor canvases, generated images, style-match inputs and outputs, saved projects, budgets and proposals. Images can contain identifiable people or private locations, so only upload content you are entitled to use.
  • Usage and credit data: plan, subscription status, credit balance, generation type, resolution, model used, request status, timestamps, refund/correction records and feature usage.
  • Payment and billing data: transaction identifiers, purchased plan or credit pack, amount, currency, status, billing period, cancellation state and the email/name associated with the purchase. We do not receive or store full card numbers; card data is handled by our payment provider.
  • Technical and anti-abuse data: IP address, approximate region derived from it, user agent, device/browser information, rate-limit counters, security logs and error diagnostics.
  • Communications: support messages and the information you choose to include in them.

3. How we use information

We use personal information to:

  • create and secure accounts, sign you in and manage sessions;
  • provide AI generation, editing, budgeting and planning features;
  • store and display your projects, images and history;
  • reserve, grant, deduct and correct credits;
  • process purchases, renewals, cancellations and refunds;
  • prevent abuse, fraud, duplicate subscriptions and service outages;
  • provide support and respond to requests;
  • measure aggregate product usage and improve the service; and
  • comply with law, enforce our Terms and protect rights and safety.

Depending on where you live, our legal basis may be performance of our contract with you, our legitimate interests in operating and securing the service, your consent (for example, optional analytics cookies), or compliance with law. Where consent is required, you can withdraw it as described below.

4. AI processing and images

To generate or edit images, we send the images and prompts you submit to Google’s Gemini API. If you use the background-removal tool, we send that image to remove.bg. These providers process the content to return a result under their own terms and privacy practices. We do not use your uploaded images to train our own models, and we do not sell your images or use them for advertising.

Do not upload government identity documents, financial account numbers, health records, images of minors, or images of people who have not consented to this use. If a venue photo includes identifiable people, you are responsible for having the permissions needed to use it. AI outputs are visual references, not a guarantee of real-world results.

Provider-side retention and model-training settings are controlled by the provider and your account configuration. We do not enable optional provider-side interaction storage for normal production use. Review the provider’s terms before uploading sensitive content.

5. Payments and subscriptions

Purchases are processed by Dodo Payments, which acts as the merchant of record for the transaction. Dodo handles payment method data and may collect billing details and tax information under its own privacy policy. We receive transaction and subscription status so we can grant credits and manage access. Cancellation is available from your billing page; cancellation stops future renewals but does not by itself erase records we must keep for accounting, tax, fraud prevention or dispute handling.

6. Cookies and analytics

We use essential cookies and similar storage to keep you signed in and protect your session. Optional Google Analytics 4 is loaded only after you choose “Accept analytics” in the cookie banner. Vercel Analytics is configured as cookieless measurement. You can reopen Cookie settings in the footer to change your choice. See the Cookie Policy for the current categories and providers.

7. When we share information

We share information only as needed to run the service:

  • Supabase for authentication, database and private object storage;
  • Vercel for hosting, delivery and cookieless aggregate analytics;
  • Google (Gemini API) for AI image generation and style analysis;
  • remove.bg when you use background removal;
  • Dodo Payments for checkout, subscriptions, tax and payment processing;
  • Upstash for short-lived rate-limit counters;
  • professional advisers, auditors or authorities when required by law, or to protect rights and safety; and
  • a successor entity in a merger, acquisition or sale of assets, subject to appropriate safeguards.

We do not sell personal information. We do not share uploaded images with advertisers. Service providers are required to process data for the service and not for their own unrelated purposes, subject to their contractual terms.

8. International transfers

Our providers operate in multiple countries, so information may be processed outside your country. Where required, we rely on contractual safeguards or other lawful transfer mechanisms offered by the provider. Contact us if you need more information about the safeguards for a particular transfer.

9. Retention and deletion

We keep account and project data while your account is active. You can delete individual editor projects from the editor. You can export account data and submit an account-deletion request from your account page; deletion removes or anonymizes active-service data, subject to the exceptions below. Unreferenced uploads may be cleaned up after a 30-day orphan period.

We may retain limited records after deletion where needed for tax, accounting, fraud prevention, chargeback or dispute resolution, or where law requires it. Backup copies may persist for a limited period before rotation. We do not retain deleted images for model training.

10. Security

We use access controls, private storage buckets, short-lived signed image URLs, encrypted connections, server-side secret handling and rate limits. No internet service is completely secure. If you believe your account or content has been compromised, contact us promptly and change your password.

11. Your choices and rights

Depending on your location, you may have rights to access, correct, export, delete or restrict the processing of your personal information, or to object to certain processing. You can:

  • export or request deletion from your account page;
  • change optional analytics consent with Cookie settings;
  • update your profile information in the app; and
  • email us to exercise another applicable right.

We will respond within the time required by applicable law. You may also complain to your local data-protection authority. We will not discriminate against you for exercising a privacy right.

12. Children

The service is intended for adults. You must be at least 18 years old, or the age of majority where you live, to create an account. We do not knowingly collect personal information from children. If you believe a child has provided information, contact us so we can review and delete it.

13. Changes and contact

We may update this policy as the product or law changes. We will post the new date and, for material changes, provide additional notice where appropriate. Continued use after an update means the updated policy applies, but it does not override rights you have under mandatory law.

Contact: toptensteff@gmail.com. Include the email address on your account and enough detail for us to identify the request. Do not send passwords, full card numbers or government IDs by email.