Privacy notice.

Last updated 21 October 2026.

1. Who is responsible

Kane Foster, a sole trader trading as Kanvas One, is the data controller for the personal data described here. The service is called Kanvas One.

Email support@kanvas.one with anything about this notice, or use the details on our contact page.

2. What we collect

If you fill in the enquiry form

Your name, your business name, your email address, which plan you are interested in, and whatever you write in the box about what you need.

If you ask for a free example

Your business name, your email address, a link to your business (your Instagram, Facebook, current website or a listing such as Trust a Trader or Checkatrade), and the web address you picked. We look at the page you give us to design yours — that is the whole reason we ask for it.

The address you pick is a note of what you wanted. Nothing is registered and nothing is reserved until you start a plan.

If you open an account

Your email address and a password, which is stored only as a hash — we cannot read it. Then, as you complete your business profile: business name, contact name, phone number, type of business, address, service area, opening hours, your services or menu, what you want the site to do, links to any site or social accounts you already have, and a logo or photo if you upload one.

While your plan runs

The change requests you send us and any files you attach to them, your plan, your billing history, your web address, and your email preferences.

If you leave a review

Your name, your business name and what you wrote, so we can publish it.

If you use the chat button

What you write, and, only if you choose to give them, your name, email address and phone number so we can reply if you leave the page. The page you were on when you started. We do not record your IP address against the conversation. Your browser keeps a random ticket for the conversation so it is still there if you come back; that is all it holds.

If you install the Kanvas One app

The app shows you the same account as the website. If you allow notifications, your phone gives us a push token — an address for that one installation, issued by Apple or Google — which we keep so we can send you a notification when something happens on your site. It is removed when you log out or the phone tells us the app is gone. The app has no advertising and no tracking.

The app asks for the camera only when you choose to scan a QR code or take a photo to send us, for your photo library only when you attach a picture, and for your calendar only when you add a booking to it (it adds that one event and reads nothing). Photos you send are stored with the request or message they belong to.

Automatically

Our hosting provider keeps short-lived server logs, which include IP addresses, for security and to keep the service running.

We count visits to this site ourselves. Each page view is sent to our own server with the page, the site or ad that sent you here, whether the screen is a phone or a desktop, and a random string your browser makes for the tab so that ten pages read by one person are not counted as ten people. Our server adds the country and town your connection comes from, worked out by our host from the connection itself. When you press a button or a link, we note the words on it and where it goes, which box of a form you tap into, which parts of the page you scroll to, and whether a form was sent, but never anything you type into it. Together these show the route a visit took through the site. No IP address is stored, it is not linked to your account or your name, the random string is gone when you close the tab, and no other company is involved. It runs unless you press Decline on the cookie pill, after which nothing is sent.

If — and only if — you press Accept, we also load the Meta pixel, which tells Meta that a visit, an enquiry or a signup followed one of our ads. Decline and that code is never loaded. Nothing about you is sent to Meta from our server. See the cookie policy for exactly what each one sets and sends.

3. Why, and our lawful basis

To answer your enquiry, or make the free example you asked for

Our legitimate interest in responding to someone who has asked us to get in touch, and in keeping a record of it. Basis: legitimate interests.

To build and run your site and app

We cannot do the work without your business details. Basis: performance of our contract with you.

To take payment and keep billing records

Basis: performance of our contract, and legal obligation for the accounting records we are required to keep.

To email you about your account

Confirmations, receipts, notices about your build, and replies to your requests. Basis: performance of our contract. These are not marketing and you cannot opt out of them while your account is open, though you can turn off the optional notifications.

To email you about offers and new features

Basis: your consent, which you give by ticking the box, and can withdraw at any time.

To publish a review you have given us

Basis: your consent, given when you submit it. Ask us and we will take it down.

To reply to a chat message

You started the conversation, and we cannot answer it without keeping it. Basis: our legitimate interest in responding to someone who has asked us something, and in keeping a record of what was said.

To count visits to this site

Knowing how many people read which pages, where they came from, and which buttons they press, is how we decide what to improve. Basis: our legitimate interest in understanding our own site, using the least data that will do it, with a Decline button that stops it.

To send you notifications in the app

Basis: performance of our contract with you, and your choice: the phone asks before any notification is sent, and you can turn them off in its settings at any time.

To measure our advertising

Knowing which ads lead to an enquiry or a sale is what stops us paying for ads that do not work. The Meta pixel in your browser: basis, your consent, given by choosing “Accept” on the cookie pill, and withdrawable at any time from the footer of any page.

To keep the service secure and prevent fraud

Basis: our legitimate interest in protecting the service and our customers.

4. Emails we send

There are two kinds, and they are handled differently.

Service email is about your account: confirming your address, receipts, plan changes, progress on your build, replies to your requests. It comes with the service.

Marketing email is about offers, new features and things we think you would find useful. We only send it if you have opted in. Every marketing email carries an unsubscribe link and a one-click unsubscribe header that your email app can use, and unsubscribing takes effect immediately. You can also change your preferences from your account page at any time.

We use Resend to deliver email. They process the message and your address on our behalf and do not use it for anything else.

5. Who we share it with

We do not sell your personal data, and we do not share it with anyone for their own marketing. We use the following providers to run the service. All but the last act only on our instructions; the last receives only what is described below, and decides for itself what it does with what it receives:

• Vercel — hosting for this site and its server functions. Sees requests to the site, including IP addresses in short-term logs.
• Supabase — the database that holds your account, profile, requests, chat conversations, visit counts and uploaded files, and the system that signs you in.
• Stripe — payments and subscriptions. Your card details go to Stripe directly from their own checkout page and never reach our servers. Stripe is a data controller in its own right for fraud prevention; see stripe.com/privacy.
• Resend — sending the emails described above, including a chat reply sent on to your email address when you have left one.
• Expo, and Apple or Google — only if you install the app and allow notifications. Expo relays each notification to Apple’s or Google’s push service, which delivers it to your phone. They see the push token and the words of the notification, nothing else.
• Meta (Facebook and Instagram), only in your browser and only if you accept cookies: the Meta pixel receives that a page was viewed, an enquiry submitted, an account created or a plan started, along with your IP address and the identifier in the cookie it sets. Our server sends Meta nothing about you. Meta decides for itself what it does with this, so it is a controller in its own right rather than a processor acting on our instructions. See facebook.com/privacy/policy.

When you use the web address finder, we send only the name you are checking to the relevant domain registry (Nominet for .uk addresses, the appropriate registry otherwise). No personal data is sent with it.

We will also disclose data where we are legally required to, or where it is necessary to establish or defend a legal claim. If the business is ever sold or transferred, customer records would transfer with it, and we would tell you first.

6. Where your data is held

Some of the providers above process data outside the United Kingdom. Where they do, the transfer is covered by the UK’s approved safeguards — an adequacy decision for the destination country, or the UK International Data Transfer Addendum to the standard contractual clauses. You can ask us for details of the safeguards in place for any particular provider.

7. How long we keep it

• Enquiries and free-example requests that do not become accounts — 24 months from your last contact with us, then deleted.
• Account and profile data, and your site build — for as long as your plan is active, then 6 months after it ends, kept so you can restart where you left off or have your data exported. After that it is permanently deleted.
• Change requests and uploaded files — the same period as your account.
• Billing and accounting records — six years from the end of the relevant financial year, because HMRC requires it. This applies even if you ask us to delete everything else.
• Reviews — until you ask us to remove them.
• Chat conversations — 24 months from the last message, then deleted. Ask sooner and we delete them sooner.
• Visit counts — 13 months, so one year can be compared with the last, then deleted. They contain no name, account or IP address in the first place.
• Push tokens — until you log out of the app, or the phone reports the app is no longer installed.
• Marketing preferences — we keep a record that you unsubscribed indefinitely, so that we do not email you again by mistake.
• Your cookie choice — kept in your own browser, not on our servers, until you clear it or change it.

8. How we protect it

The site is served over HTTPS. Passwords are hashed, never stored in a readable form. Database rows are locked to the account that owns them, so one customer cannot read another’s data even if something else goes wrong. Card details never touch our systems. Access to customer data is limited to the people who need it to do the work.

No system is perfectly secure. If a breach happens that is likely to put your rights at risk, we will tell the ICO within 72 hours and tell you without undue delay.

9. Your rights

Under UK data protection law you can ask us to:

• give you a copy of the personal data we hold about you;
• correct anything that is wrong;
• delete it, where we do not have to keep it;
• restrict what we do with it while a dispute is sorted out;
• send it to you or another provider in a portable format;
• stop processing it where we rely on legitimate interests;
• stop sending you marketing, which you can do yourself at any time.

Where we rely on your consent, you can withdraw it at any time. That does not affect anything we did before you withdrew it.

Deleting your account. In the Kanvas One app, open Account and tap Delete my account. It cancels any plan and removes your login, your site’s records, requests and chats for good. Billing records stay with Stripe, as the law requires us to keep them. Without the app, email support@kanvas.one from the address on your account and we will do it for you.

Email support@kanvas.one and we will respond within one month. There is no charge. We may ask you to confirm who you are before we hand over data.

10. Data your own site collects

If the site we build for you collects personal data about your customers — a contact form, a booking, a mailing list, a chat, a missed-call text — then you are the controller of that data and we act as your processor. That includes the visitor count and the chat button we put on your site, which work exactly as described above for this one, and the calls and texts to a business number we run for you. You need your own privacy notice for it, and we will help you put one in place. This notice covers our relationship with you, not your relationship with your customers.

11. Children

This is a service for businesses. It is not directed at children and we do not knowingly collect data about anyone under 18. If you think we have, tell us and we will delete it.

12. Complaints

If you are unhappy with how we have handled your data, please tell us first at support@kanvas.one so we can put it right.

You also have the right to complain to the Information Commissioner’s Office, the UK’s data protection regulator, at ico.org.uk/make-a-complaint or on 0303 123 1113.