Privacy Policy
Last updated 1 June 2026 · Masters Global Inc.
Who we are
Canvas Music (Masters Global Inc.) is the data controller for your personal data. Contact: privacy@canvasmusic.app.
Data we collect
Account details (name, email, date of birth for age verification), content you create, Voice Lab recordings (see Voice Data below), usage/analytics data, and payment metadata (card data is held only by Stripe).
How we use it
To provide and improve the service, verify age, process payments, keep the platform safe (including Family Safe protections and automated screening of prompts against a blocked-content list, including exploitative-of-minors content, before generation), and communicate essential updates. We do not train models on your content without explicit consent.
Legal bases (GDPR)
Performance of contract, your consent (e.g. voice cloning, marketing), legitimate interests (security, fraud prevention) and legal obligations.
Voice Data (biometric)
Voice Lab recordings used to create a cloned voice are biometric data under GDPR Article 9 and equivalent US state biometric laws (e.g. Illinois BIPA, Texas CUBI, Washington's biometric law) and voice-likeness statutes (e.g. Tennessee's ELVIS Act). We rely on your explicit, itemised consent (Article 9(2)(a)) — recorded with a version, timestamp and IP, and re-required whenever the consent terms change. Cloning is self-only: Canvas does not let you clone a voice that is not your own. You can view your current consent status, revoke it, and delete every cloned voice at any time from Voice Lab; revoking immediately blocks further use of that biometric data. California residents additionally have CCPA/CPRA rights over biometric information as "sensitive personal information".
Your rights
You may access, export, correct, delete, restrict or object to processing, and withdraw consent at any time. Use Account & Privacy to export your data or close your account, or email privacy@canvasmusic.app. EU/UK users may complain to their supervisory authority; California residents have CCPA/CPRA rights and we do not sell personal information.
Data inventory & retention
Account/identity data — kept while your account is active, deleted/pseudonymised on closure. Songs, lyrics & covers — kept while your account is active or until you delete them; you can export or delete individually. Voice Lab recordings & consent records — kept until you revoke consent or delete the cloned voice; the consent record itself is retained as an audit trail of when/whether you consented. Payment metadata — retained per Stripe's terms and applicable tax/financial record-keeping law (card numbers are never stored by Canvas). Family Safe / guardian data — retained while the child account is active and managed by the parent.
Account deletion
Closing your account immediately disables login and anonymises your profile (name, email, date of birth) and revokes all Voice Lab consents. This is a form of pseudonymisation, not full erasure: a small set of non-personal or legally-required records (financial transactions, DMCA/rights-complaint logs, abuse-prevention flags) are retained in de-identified form for as long as law requires, then deleted.
International transfers
Where data is processed outside your region (e.g. by our US-based AI/infrastructure providers) we rely on appropriate safeguards such as Standard Contractual Clauses. A formal Transfer Impact Assessment covering these transfers is in progress; this policy will be updated once it is complete.
Children & age verification
Canvas is not intended for children under 13. Signup requires entering a date of birth; accounts under 13 are blocked from self-signup and directed to Family Safe. Family Safe child accounts can only be created by a parent/guardian who verifies with a PIN, provides consent, and gets an activity digest and session controls (review, pause, revoke) for the child's account. No separate marketing profile or third-party data sharing occurs for child accounts.