Privacy Policy

Version 2.0 · August 2026

1. Who is responsible

Grand Canvas Ltd, 85 Great Portland Street, 1st Floor, London W1W 7LT, United Kingdom (company no. 15033744) is the controller for personal data processed on grandcanvas.com (the "Platform").

For orders delivered in the United States, the seller is Grand Canvas, LLC (a Virginia limited liability company, principal office 6306 Gravel Ave Unit B, Alexandria, VA 22310, USA), which is the controller of the data processed to perform those orders; this policy applies to that processing too.

Privacy contact: privacy@grandcanvas.com.

2. What we collect and why

Ordering and your account. Name, email, delivery and billing address, phone number, order details (including your wall dimensions), order history, communications with support. Purpose: concluding and performing your contract, delivery, invoicing, taxes, support and complaint handling. Legal basis: performance of a contract (Art. 6(1)(b) GDPR); legal obligations (Art. 6(1)(c)) for tax and accounting records.

Payments. Processed by Stripe. We receive confirmation, the payment method type and the last digits of your card — never your full card number. Legal basis: contract performance; fraud prevention as our and Stripe's legitimate interest (Art. 6(1)(f)).

Room Visualizer photos. If you upload a photo of your room, we process it to render previews of designs on your wall. Photos uploaded without an account are deleted after 90 days; photos saved to your account are kept until you delete them. They are never used for marketing or to train AI models. Upload only photos you have the right to use and avoid photos showing other people. Legal basis: contract performance / steps prior to a contract (Art. 6(1)(b)).

AI-assisted features. Some features (for example design search or image preparation) are processed by Anthropic as our processor. Inputs are used to provide the feature, not to train models. Legal basis: contract performance; legitimate interest in providing the feature.

Artist studios. If you open an artist studio: portfolio and profile data, uploaded designs, royalty accounting and payout details, tax information where legally required. Legal basis: performance of the Artist Terms; legal obligations.

Newsletter. Sent via Klaviyo, only with your consent (double opt-in), which you can withdraw at any time with one click in every email. Open and click measurement is part of the service. Legal basis: consent (Art. 6(1)(a)).

Transactional email. Order and account emails are sent via Resend. Legal basis: contract performance.

Advertising and measurement. Only with your consent via the cookie banner, we use Meta, Google and TikTok tools, including server-side conversion events. No advertising event is transmitted for a visitor who has declined marketing cookies. Legal basis: consent (Art. 6(1)(a); § 25 TDDDG / PECR for storage and access on your device). Withdraw any time via "Cookie settings" in the footer.

Logs, security and error monitoring. IP address, timestamps, device and browser data in server logs (Hetzner), CDN and security screening (Cloudflare) and error monitoring (Sentry). Legal basis: legitimate interest in operating the Platform securely (Art. 6(1)(f)); § 25(2) TDDDG for strictly necessary access.

Reviews and public content. If you post reviews or public content, it is visible to others; details in the Website Terms of Use. Legal basis: contract performance; legitimate interest.

We do not process special categories of data, we do not profile you in a way that produces legal effects, and we make no purely automated decisions about you. The Platform is not directed at children under 16.

3. Who receives data

Processors bound by data-processing agreements: Stripe (payments), Hetzner (hosting, Germany/Finland), Cloudflare (CDN/DNS/security), Resend (transactional email), Klaviyo (newsletter), Sentry (error monitoring), Anthropic (AI features), DPD and other carriers (delivery — independent controllers for their transport operations). Advertising partners (Meta, Google, TikTok) act as described in our Cookie Policy — for campaign measurement we and the platform may act as joint controllers; the essence of that arrangement is available on request.

We share data with public authorities only where legally required. If Grand Canvas undergoes a corporate transaction, data may transfer to the successor under this policy. If a local Grand Canvas licensee becomes the seller for your country in the future, it will be named at checkout and will process order data as described there.

4. International transfers

We operate from the United Kingdom; the EU Commission's adequacy decision covers transfers EU→UK, and UK adequacy regulations cover UK→EU. Where processors process data in the United States (Stripe, Cloudflare, Sentry, Klaviyo, Anthropic), transfers rest on the EU–US Data Privacy Framework and its UK Extension where the provider is certified, and otherwise on Standard Contractual Clauses / the UK International Data Transfer Agreement with supplementary measures. Copies of the relevant safeguards are available via privacy@grandcanvas.com.

5. How long we keep data

Order, invoice and accounting records: the statutory retention periods that apply to us — in the UK six years; in Germany generally eight years for accounting documents and invoices (ten years where the pre-2025 rules still govern older records). Account data: until you delete your account, then removal or anonymisation within 90 days except where retention is legally required. Visualizer photos: see §2. Newsletter data: until you withdraw consent. Logs: up to 90 days unless needed for a security investigation. Artist royalty accounting: statutory commercial retention periods.

6. Your rights

You have the right of access, rectification, erasure, restriction, data portability, and objection (including to any processing based on legitimate interest, and to direct marketing at any time), and the right to withdraw consent without affecting past processing — exercise them via privacy@grandcanvas.com or your account settings. You also have the right to complain to a supervisory authority: in the UK the ICO (ico.org.uk); in the EU the authority of your residence.

7. United States residents

Grand Canvas, LLC does not sell personal information and does not share it for cross-context behavioural advertising within the meaning of the California Consumer Privacy Act, and has not done so. Grand Canvas, LLC is below the CCPA's applicability thresholds; we nonetheless honour access and deletion requests from US residents via privacy@grandcanvas.com and do not discriminate against anyone who exercises privacy rights.

8. Cookies

See the separate Cookie Policy for categories, providers, purposes and how to change your choices at any time via "Cookie settings" in the footer.

9. Changes

We will post any change to this policy here with a new version date; for material changes we will notify account holders by email.