Privacy

Version 1 (draft, pending legal review) · effective from launch · last updated July 2026

This notice explains, in plain language, what personal data CanvasCode collects, why, and what rights you have. It is written to meet India’s Digital Personal Data Protection Act 2023 (DPDP Act) and its 2025 Rules, with additional protections we adopt voluntarily for visitors elsewhere (GDPR-grade hygiene). CanvasCode is currently in the process of legal registration in India and the United States; until entities are registered, the founder is the responsible contact for everything on this page. It stands on its own — you don’t need to read anything else for it to make sense.

What we collect, and why

Exactly these, nothing else:

• Interest forms (partners, companies & foundations, mentors): the details you type — name, organization, role, email, phone if you give it, city, and your note. Purpose: to reply to you and evaluate a possible partnership or mentorship. Mentors also share a LinkedIn URL because we verify every mentor.
• Accounts (sign-in via Clerk, our authentication provider): email, name, and sign-in metadata. Purpose: letting you save and submit applications securely.
• Applications: what you enter in the application forms. Purpose: evaluating the application you chose to make.
• Pledges: name, email, country, intended range, and your note. Purpose: telling you when giving opens. No payment details exist on this site — we take no payments.
• Contact messages: your email and message. Purpose: replying.
• Program (Studio) accounts for enrolled children — described separately below, because children’s data has stricter rules.

We collect no analytics identifiers, no advertising data, and set no third-party tracking cookies. Anonymous, cookieless page counts (Vercel Analytics) are the only measurement on this site. We never sell or rent personal data, and we run no ads.

Children’s data — the strict rules

Children under 18 use our program application (the Studio) only after their lawful guardian’s consent is recorded — collected on paper through the partner institution, with the identity of the consenting guardian documented (DPDP Act Section 9(1) and Rule 10; for children in child care institutions, the lawful guardian is determined under the Juvenile Justice Act). Then:

• Accounts carry a first name and initial only — no surname, no date of birth (an age band only), no photograph, no email required.
• No tracking, no behavioural monitoring, no targeted advertising, no profiling — prohibited by DPDP Section 9(3), and by us regardless.
• A child’s work may receive AI-drafted feedback, but a trained adult reviews and approves it before the child sees it — no automated decisions reach a child. Children’s data and work are never used to train AI models.
• Access is partner-scoped and logged: an adult sees only the children in their own program, and every adult access to a child’s record is recorded.
• Guardians may withdraw consent, review the child’s data, or ask for erasure at any time via the partner institution or directly at the contact below.

Legal bases

Under the DPDP Act we process data with your consent, given by the clear act of submitting a form, for the specified purpose stated on that form. Under GDPR (for visitors in the EU/UK) our bases are consent, steps you request prior to a possible agreement (accounts, applications), and legitimate interests (responding to messages, keeping the site secure). Children’s program data rests on the guardian’s verifiable consent plus our safeguarding obligations. Withdrawing consent is as easy as giving it — one email to the address below.

Where your data lives, and who processes it

Our processors, each bound by a data-processing agreement:

• Clerk — authentication (hosted in the United States).
• Vercel — website hosting and cookieless analytics (United States/global edge).
• MongoDB Atlas — database (region pinned; encrypted at rest).
• Resend — transactional email (United States).
• An AI provider — drafting feedback inside the Studio, under a contractual bar on training on our data.

Data crosses borders between India and the United States as part of this hosting; DPDP Section 16 permits transfers except to restricted countries, and for EU/UK visitors our processors provide standard contractual clauses. We apply the same protections wherever the data sits: encryption in transit and at rest, role-based access control, access logging, and backups.

How long we keep things

• Contact messages: up to 24 months, then deleted.
• Interest forms and pledges: until resolved plus 24 months, then deleted or anonymized.
• Applications: the evaluation period plus 36 months.
• Children’s program records: the duration of enrolment plus a defined archival period agreed with the partner and guardian — and erased earlier on guardian request. A child’s own portfolio is theirs; when they leave, they take it.

When a purpose is served or consent is withdrawn, we erase the data.

Your rights

You may ask for: a summary of your data and how it has been processed; correction, completion, or updating; erasure; and you may nominate a person to exercise these rights for you if you are unable to. To exercise any of these, email hello@canvascode.org from the address you used with us — that address is the identifier we need. EU/UK visitors additionally have GDPR rights to portability, restriction, objection, and to complain to their supervisory authority.

Grievances

Our grievance contact is the founder, reachable at hello@canvascode.org (a named Grievance Officer will be published here upon registration). We acknowledge within 48 hours and resolve within 15 days — and in every case within 30 days, well inside the DPDP Rules’ outer limit. If you are unsatisfied, you may escalate to the Data Protection Board of India after our process completes.

If something goes wrong

If a data breach affects you, we will tell you without delay, in plain language — what happened, what it means for you, and what we are doing — and notify the Data Protection Board of India within the required 72 hours.

Housekeeping

This notice is available in English; an accurate translation into an Eighth Schedule language is available on request. When we change this notice we update the date above and note material changes on the updates page. Questions about processing: hello@canvascode.org.