Privacy Policy

Canvas BD is an online art-supplies retailer based in Dhaka, Bangladesh, operating at 90 New Super Market, North D Block, Dhaka-1205. When this policy refers to “we”, “us”, or “our”, it means Canvas BD.

We collect information you provide directly when you:

• Create an account (name, email, phone number, password handled by Firebase Authentication).
• Sign in with a third-party provider — Google or Facebook (see Section 3 below for what each provider shares).
• Place an order (delivery address, contact number, items purchased).
• Make a payment (handled by our payment partners — we do not store full card numbers on our servers).
• Contact customer support, leave a product review, or submit a question.
• Subscribe to our newsletter.

We also collect basic technical information automatically — IP address, device type, pages viewed — to help us keep the site secure and improve the shopping experience.

If you choose Continue with Google or Continue with Facebook on the login page, the provider shares a small set of profile data with us so we can create or recognise your Canvas BD account. We never see your password — authentication happens entirely between you and the provider.

What we receive from Google

• Your Google account ID (a stable identifier — not your password).
• Your name and email address.
• Your profile photo URL (if set on your Google account).

What we receive from Facebook

• Your Facebook user ID (a stable identifier).
• Your name and (when granted) email address.
• Your profile photo URL.

We use this data only to:

• Sign you in and keep you signed in.
• Pre-fill your Canvas BD profile so you don't have to re-type your name and email.
• Match you to an existing account when the same email is on both Google and Facebook (so you don't end up with two duplicate Canvas BD accounts).

We do not request access to your Google or Facebook friends, contacts, posts, photos, or other private data — only the basic profile fields listed above. We do not post anything to your social account on your behalf.

How to disconnect

• Google: visit Google Account → Security → Third-party connections → remove Canvas BD.
• Facebook: visit Facebook → Settings → Apps and Websites → remove Canvas BD.

Removing the connection at the provider stops new profile data from reaching us. It does not by itself delete your Canvas BD account or the order history attached to it — see Account & Data Deletion for that.

• To process orders, deliveries, returns, and refunds.
• To communicate with you about your orders, account, and customer service requests.
• To send promotional updates if you have opted in (you can unsubscribe anytime).
• To generate personalised product recommendations (aggregated signals only — see Section 5).
• To detect, investigate, and prevent fraud and abuse.
• To comply with legal obligations.

Canvas BD shows product recommendations tailored to your shopping history. To generate them we send a third-party AI service (Google's Gemini API) aggregate signals only — purchase counts, category preferences, lifetime spend bracket. We strip personally identifiable fields (name, phone, email, address) before the request leaves our servers, so the model never sees who you are.

If you would rather not have your shopping history used this way, contact us at privacy@canvasdhaka.com and we will exclude your account from recommendation generation.

We share your information only with the parties needed to operate our service:

• Courier partners (Pathao, Steadfast, Sundarban) for delivery — receive name, phone, address.
• Payment gateways (SSLCommerz, bKash) to process transactions — receive amount + order reference only; never your stored card details.
• Authentication providers (Firebase, Google, Facebook) for sign-in — receive only the credentials you supplied via their own consent screens.
• Infrastructure providers (AWS for storage + email, Google Cloud for AI inference) — receive the data needed to perform the specific task.
• Government authorities when required by law.

We do not sell your personal information to third parties.

We use cookies and similar storage to keep you logged in, remember items in your cart, and understand which pages and products are popular. You can clear cookies in your browser at any time, though some features (like staying signed in) won't work without them.

We use HTTPS in transit, hashed passwords (handled by Firebase), and access controls on our backend systems. No system is perfectly secure, but we work to protect your data and will notify you if we ever experience a breach affecting your information.

You can:

• View and edit your profile and addresses from My Account.
• Delete your Canvas BD account at any time — see Account & Data Deletion for instructions.
• Disconnect a linked Google or Facebook account from the provider's own settings (see Section 3).
• Unsubscribe from marketing emails using the link in any newsletter.
• Request a copy of the personal data we hold about you by emailing privacy@canvasdhaka.com.

Canvas BD is intended for adults. We do not knowingly collect information from children under 13. If you believe a child has given us information, please contact us and we will remove it.

We may update this policy from time to time. When we do, we'll change the “Last updated” date at the top of the page. Material changes will also be communicated by email or a notice on the site.

Questions about this policy? Reach us via the Contact page or email privacy@canvasdhaka.com.