Magic Canvas

Privacy Policy

Effective · August 11, 2026

Personal data processed

We process the email address, account identifier, and public profile supplied through Google sign-in; order, payment, and credit records; service, error, and security logs; and support requests. To prevent repeated abuse of the free offer, we process irreversible HMAC identifiers derived with a server secret from the Google provider identifier and connection IP, without storing those source values in the abuse tables. When you use generation or editing, we process the images and prompts you submit. Polar processes payment-method details such as card numbers; Magic Canvas does not store them directly.

Purposes and legal bases

We use data to perform our contract by authenticating users, providing generation and editing, verifying payments, delivering credits, handling refunds, and supporting customers. Where required, abuse prevention, security, and reliability improvements rely on a permitted legitimate interest or consent. Optional consent is kept separate from core service access.

Images and prompts

Submitted images and prompts are transmitted for the requested generation, editing, and safety screening. General generation history is saved per account in the browser in use and can be removed with browser data. Official Instagram and Threads marketing uses only public gallery results created by the operator account. Public gallery results from other users are not automatically reused for marketing. Public results are removed when unpublished or when the account is deleted. Server-side Canvas recovery results are configured to expire after up to seven days. Any provider-side retention follows the provider’s business/API data policy and legal obligations.

Retention and deletion

We delete data when its purpose is complete. Raw growth and quality events are retained for up to 90 days, and identifying account-deletion operations data for up to 30 days. The HMAC account identifier used to prevent free-offer abuse is retained for up to one year after account deletion, and the HMAC network identifier used for daily limits for up to two days. Where Korean e-commerce law applies, contract, withdrawal, payment, and supply records may be retained for five years; consumer complaint records for three years; and advertising records for six months.

Processors and international transfers

Necessary data may be transmitted repeatedly over encrypted connections when you use the service. Supabase (Singapore project region) handles authentication, database, and storage; OpenAI (United States) handles image generation and safety; Google (United States) handles sign-in and optional analytics; Polar (United States) handles orders, payments, and refunds; and Vercel (United States and global infrastructure) handles web hosting and operational logs. Each processes data for the purpose and period described above or in its published policy, and disclosed subprocessors may add locations. You may avoid the transfer by not using the relevant feature or by deleting your account, but core functionality may then be unavailable.

Advertising and cookies

When Google AdSense serves advertising, third parties including Google may place or read cookies, web beacons, IP addresses, or other identifiers. Google and its partners may use prior visits to this site or other sites to serve ads. You can manage or opt out of personalized advertising in Google Ads Settings. Personalized ads in the EEA, the UK, or Switzerland require the necessary consent through a separate message from a Google-certified consent management platform.

Your rights

Request access, correction, deletion, restriction, or withdrawal of consent through account deletion or by contacting wjdrkdqls12@gmail.com. We verify the requester and respond without undue delay as required by law.

Security

We use encrypted transport, least-privilege access, separation of server secrets, database row-level security, payment-webhook signature verification, and operational logging.

Privacy contact

Responsible team: Magic Canvas Operations · Contact: wjdrkdqls12@gmail.com

Policy changes

We announce the effective date and changes in the service. Material changes adverse to users are generally announced at least 30 days in advance.

Advertising privacy resources

How Google uses data on partner sites Google Ads Settings

Operator & customer support

Legal business name: 코에이아이에스
Representative: 정강빈
Business registration: 522-24-01937
Business address: 경기도 광주시 탄벌길 19-6
Telephone: 010-3777-8058
Support email: wjdrkdqls12@gmail.com