Omni by Canvs: Privacy Policy Effective date: [12 Oct '26]

1. Who is responsible, and what this covers. Canvs Creative Solutions Private Limited ("Canvs", "we"), D-0714, Maple Leaf Co op Hsg Soc Ltd, Building No-15, Tungwa Village, Powai, Mumbai, Maharashtra 400072, India, is the controller (data fiduciary) of your personal data. This policy covers Omni by Canvs: the Omni page at canvs.in/omni and its waitlist and demo forms, the Omni app at omni.canvs.in, the sign-in and account pages you use to reach Omni, the Figma plugin, and the emails Omni sends. It covers how Omni uses your Canvs account; the shared account itself is described in the Canvs Privacy Policy at canvs.in/privacy, and the rest of canvs.in is covered by that policy. For Omni, this policy applies and prevails over the Canvs website policy where they differ. Contact: privacy@canvs.in. Grievance Officer: Rovin Cutinho, CPO, grievance@canvs.in.

2. What we collect.

We do not collect payment details for Omni today. [If you add paid plans: say who processes payments.] The Omni app itself uses no analytics or advertising trackers. Our website uses analytics and a LinkedIn measurement tag (see section 11 and the Cookies notice).

3. Why we use it and our legal basis.

4. Emails to people who are not users. If a user adds your email address to a project, we send you one email saying so, with the user's name and the project name. We use your address only for that. You can reply to it, or write to support@canvs.in, and we will remove you and stop contacting you. We do not add you to any list.

5. Who we share it with. We do not sell your personal data. We use these providers to run Omni and our website (the full list, with purpose and location, is on the Subprocessors page): Amazon Web Services (sign-in, hosting, email), Supabase (database), Google (sign-in with Google; Google Analytics and Tag Manager on the website), Sentry (error monitoring), ApiFlash (screenshots of web addresses you provide), Google Gemini (only the name of a font you upload, to suggest alternatives), LinkedIn (measurement tag, with consent), Framer (website hosting and analytics), Cal.com (demo booking), Mailchimp (launch-waitlist emails).

Your own use of AI tools is yours. When you export DESIGN.md or tokens and give them to an AI coding tool, you are sharing a file you downloaded; Omni does not send your projects to those tools. People you share a project with can see that project and your name and email as a member. We may disclose data if the law or a valid legal request requires it, or to protect rights and safety.

6. Where your data is. Our main infrastructure and our database are in India (AWS and Supabase, Mumbai). Sentry processes error reports, and Mailchimp sends our launch emails, in the United States. Google (sign-in, and font suggestions through Gemini) and ApiFlash process data on their own infrastructure. Where data leaves your country we rely on [the provider's standard contractual clauses / other safeguards].

7. How long we keep it. Account and content: until you delete them or ask us to. After deletion, backups expire within 90 days. Error reports: [CONFIRM: 90 days]. Notification logs: [CONFIRM period]. Records we must keep by law are kept for as long as the law requires.

8. Your rights. Depending on where you live you can ask to access, correct, delete or export your data, object to or restrict some uses, withdraw consent, and complain to a regulator. To exercise a right, use the Data requests page or email privacy@canvs.in; we respond within 30 days (up to 90 days for a complex request where the law allows, and we will tell you why). You can also delete projects yourself in Omni.

9. Security. Data is encrypted in transit; access to production is limited; sign-in is handled by an established provider; we review changes before release. No system is perfectly secure; if a breach affects you, we will tell you and the authorities as the law requires. See the Security page.

10. Children. Omni and our website are not for anyone under 18. We do not knowingly collect personal data from children. If you think a child has an account or has sent us details, tell us and we will delete them. (This replaces the "under 13" wording in the current policy, which does not match India's rule that a child is under 18.)

11. Cookies and local storage.

The Omni app (omni.canvs.in). No advertising or analytics cookies, so no consent is needed for what it stores:

The Omni page (canvs.in/omni). The page is built on Framer and currently uses:

You can block or delete these cookies in your browser settings, opt out of Google Analytics with Google's browser add-on (tools.google.com/dlpage/gaoptout), and manage LinkedIn's use of your data in your LinkedIn settings (linkedin.com/psettings/guest-controls). Blocking them does not affect your use of the page or the app. (The same banner and tags run on the rest of canvs.in; see canvs.in/cookies. Keep this table identical to the one there.)

12. Changes. If we change this policy materially we will tell you by email or in Omni before it takes effect. The date at the top shows the latest version.

13. Contact and complaints. privacy@canvs.in. If you want to delete only your Omni data, or your whole Canvs account (which also signs you out of other Canvs products), say which in your request. Grievance Officer: Rovin Cutinho, CPO, grievance@canvs.in, D-0714, Maple Leaf Co op Hsg Soc Ltd, Building No-15, Tungwa Village, Powai, Mumbai, Maharashtra 400072, India. If you are in the EU or UK you can complain to your data protection authority; in India, to the Data Protection Board once it is operating.