Privacy Policy
CanvaScreens is operated by BuiltPOS LLC. Last updated: 3 September 2026
In short
We collect what running the product needs: your account details, your sign-in records, your locations and screens, the menu data we read from your point of sale, and what your screens report back. We do not run analytics, we do not advertise, and we do not sell anything about you.
Everything is stored in one PostgreSQL database on a server in Falkenstein, Germany. If you are a US business, that means your data is processed in the European Union. Section 5 explains exactly what that does and does not mean for you.
1. Who this policy is about
CanvaScreens sells and runs a digital signage management console for restaurants and multi-site brands. This policy covers canvascreens.com, app.canvascreens.com, api.canvascreens.com, and the player software that runs on the devices plugged into your screens.
We handle data in two different roles, and the difference matters for your rights.
- As a controller, for the people who hold CanvaScreens accounts and for visitors to our website. We decide what is collected there, and this policy is the whole story.
- As a processor, for the business data a customer puts into the console — locations, screens, menus, media, tickets. Your company decides what goes in and what comes out. We act on its instructions. If you work for one of our customers and want your data changed or removed, ask your company administrator first; we will point you back to them.
Contact for anything in this document: hello@canvascreens.com.
2. What we actually store
This is the real list, taken from the database schema rather than from a template.
Your account
Name, email address, an optional phone number, and whether the account is active. Your password is stored only as a bcrypt hash — we cannot read it and cannot tell you what it is. If you turn on two-factor authentication we store the shared secret and the step number of the last code you used, so an intercepted code cannot be replayed. If you ask for a password reset we store a single-use token and its expiry until it is used.
We also store which company, reseller or partner you belong to, the roles you have been given, and any restriction of your access to particular locations.
Sign-in sessions
Each active session records a hash of the refresh token (never the token itself), a description of the device and browser, the IP address the session was created from, when it expires, and when it was revoked. This is what powers the "sign out everywhere" button and what lets us tell you whether an account was used from somewhere unexpected.
Your business data
Company name, time zone and plan. Regions, locations, their local time zone and opening hours. Screens, their orientation, resolution and tags. Playlists, schedules, templates, emergency broadcasts, and the images and videos you upload, along with each file's size, type, dimensions and a SHA-256 checksum.
Menu data from your point of sale
When you connect Toast or Clover we read item names, categories, prices, availability, descriptions, calorie counts, and the item's identifier in your POS. That is the whole of it.
Your devices and screens
Each paired device reports a hardware identifier, an optional serial number and model, its platform, the player version it is running, the content revision it currently holds, and a last-seen timestamp. It also holds an API key we issued to it.
Devices can send screenshots of what the screen is displaying, so you can confirm from the console that a board is showing the right menu. These images are produced by the player from the content it is rendering. There is no camera, no microphone, and no audience measurement of any kind. A screenshot shows your own artwork, not the room in front of it.
The audit log
Administrative actions are recorded: who did it, who they were acting on behalf of, what was changed, the type and identifier of the thing changed, a before-and-after summary, a request identifier, the IP address, and the time. This exists so that a price change or a removed user can be traced, which is a requirement for most multi-site brands and a protection for you.
Support and billing
Support tickets keep the subject and body you wrote, plus the location or screen they relate to. Billing keeps your plan, the quantity, invoice periods and amounts, and the Stripe customer and subscription identifiers.
Enquiries from the public site
If you apply to the reseller programme we keep the company name, your name, email, optional phone number, what you wrote about your business, and our notes on the enquiry.
3. What we do not do
- No analytics or tracking scripts. There is no Google Analytics, no tag manager, no session recorder, and no advertising pixel on any CanvaScreens page.
- No selling of personal information, and no sharing of it for cross-context behavioural advertising, as those terms are used in US state privacy laws.
- No profiling and no automated decisions that produce legal or similarly significant effects.
- No use of your content, your menus or your screenshots to train machine-learning models — ours or anybody else's.
- No cameras, no facial recognition, no audience counting, no demographic estimation.
4. Why we use it
- To run the service you bought. Signing you in, showing your screens, pushing content to devices, syncing menus, taking payment. Legal basis: performance of a contract.
- To keep the service safe. Session records, IP addresses, rate limiting and the audit log exist to detect and investigate abuse. Legal basis: our legitimate interest in securing a system that other people depend on.
- To support you. Answering tickets, reproducing a fault, checking what a screen was showing when it went wrong. Legal basis: performance of a contract.
- To meet legal obligations. Keeping invoice and tax records for as long as the law requires.
5. Where your data is stored, and what that means
All CanvaScreens data lives in a single PostgreSQL database on one server rented from Hetzner Online GmbH in Falkenstein, Germany. Uploaded media, device screenshots and the daily database backups sit on that same server. There is no copy in the United States.
Most of our customers are US restaurants, so we will say the consequence plainly rather than bury it: your data leaves the United States as soon as you use the product. US law does not restrict sending your own business data abroad, and the European Union has stricter privacy rules than any US state, so in practice this raises your protection rather than lowering it. But it is a real fact about the service and you should know it before you sign up.
Some of our subprocessors are US companies, so data does travel back across the Atlantic for specific purposes — billing goes to Stripe, menu requests go to Toast or Clover. Where those transfers involve personal data leaving the EEA, they are made under the European Commission's Standard Contractual Clauses or an equivalent mechanism in that provider's own terms.
If you are a customer who needs a signed Data Processing Agreement with the Standard Contractual Clauses attached, email us and we will send one.
7. How long we keep it
- Account and business data: for as long as your account is open.
- After you close your account: we delete your data within 30 days of the account being closed, other than what we must keep for tax and accounting.
- Sessions: removed when they expire or are revoked.
- Audit events: kept for at least 12 months, because their whole purpose is to answer a question asked long after the event.
- Device screenshots: kept only as long as they are useful for checking a screen, and superseded images are removed. You can delete them from the console.
- Invoices and billing records: kept for as long as tax law requires.
- Backups: daily database backups age out on a rolling window, so deleted data can persist in a backup for a short period after it has gone from the live database.
8. How it is protected
- Passwords are stored as bcrypt hashes; session tokens as hashes.
- Stored third-party credentials, including your POS keys and our Stripe keys, are encrypted with AES-256-GCM before they touch the database, with a fresh nonce for every write. A stolen database dump does not hand anyone a working credential.
- All traffic is served over TLS, with certificates issued automatically by Let's Encrypt.
- The database and the application ports are bound to localhost. The firewall accepts only SSH, HTTP and HTTPS.
- Every query is scoped to your tenant, roles limit what each user can do, two-factor authentication is available, and administrative actions are written to the audit log.
No system is perfectly secure, and we will not pretend otherwise. If you believe you have found a vulnerability, email hello@canvascreens.com and we will respond. We will not pursue anyone who reports a genuine issue in good faith and gives us a reasonable chance to fix it.
9. If something goes wrong
If personal data is exposed, we will tell affected customers without undue delay and describe what happened, what data was involved, and what we are doing about it. Where the GDPR applies we will notify the relevant supervisory authority within 72 hours of becoming aware.
10. Your rights
Everyone
You can ask us for a copy of the personal data we hold about you, ask us to correct it, or ask us to delete it. Account holders can do most of this in the console without asking. We will answer within 30 days, or 45 days for requests under US state privacy laws, and we will not charge you or treat you differently for asking.
If you are in California, Virginia, Colorado, Connecticut or a state with a similar law
You have the right to know what we collect and why, to get a portable copy, to correct it, to delete it, and to opt out of sale, sharing or targeted advertising. We do not sell personal information, we do not share it for cross-context behavioural advertising, and we do not use it for targeted advertising, so there is nothing for you to opt out of. You may use an authorised agent. If we refuse a request, reply to our decision and we will review the refusal within 45 days.
If you are in the EEA or the UK
You additionally have the right to object to processing based on legitimate interests, to ask us to restrict processing, and to receive your data in a portable format. You can complain to your local supervisory authority. Because our processing happens in Germany, the Saxon Data Protection Commissioner is the relevant authority for our hosting.
To exercise any of these, email hello@canvascreens.com. We may need to confirm who you are before we act, particularly for deletion.
11. Children
CanvaScreens is a business tool. It is not directed to children, and we do not knowingly create accounts for anyone under 16. If we learn that we have, we will delete the account.
13. Changes to this policy
When we change this policy we update the date at the top and publish the new version here. If a change materially affects how we handle your data, we will email account administrators at least 30 days before it takes effect.