Privacy Policy

1. Scope and who we are

This policy applies to brixcanvas.com, the BrixCanvas dashboard, our website-building and hosting services, product communications, and support interactions. BrixCanvas is operated by ProSysTech in the Netherlands. In this policy, “BrixCanvas”, “we”, “us” and “our” refer to the service operator.

Questions or privacy requests can be submitted through our secure contact form. We may ask for information needed to verify your identity before disclosing or changing personal data.

2. Our privacy roles

BrixCanvas is the data controller for data used to operate the platform itself: accounts, subscriptions, security, support, product analytics and platform communications.

When a BrixCanvas customer collects data from visitors through a website they created—such as orders, bookings, forms, comments, memberships or newsletter sign-ups—that customer normally decides why and how the data is used. The customer is then the controller and BrixCanvas processes the data on the customer's behalf. The customer must provide its own privacy information, choose a lawful basis, honour visitor rights and configure consent where required.

Some providers, including Stripe, may act as an independent controller for parts of their service where they determine their own purposes, such as fraud prevention and legal compliance.

3. Data we process

Account and security data

• E-mail address, optional display name, language, role, plan and account status.
• A one-way password hash—not your readable password—plus sessions, verification and recovery codes, trusted-device and multi-factor security information.
• Login time, security events, rate-limit records and limited connection information used to prevent abuse and diagnose incidents.

Content and configuration

• Websites, pages, Brix, prompts, text, images, files, domains, apps, settings, revisions and private backups you create or upload.
• Information you choose to publish becomes publicly accessible on your website and may be indexed, copied or cached by third parties.

Commerce and visitor data

Depending on which apps a customer enables, BrixCanvas may host orders, names and contact details, delivery details, bookings, form responses, subscribers, marketing preferences, customer accounts, comments, reviews, RSVPs, enrolments and related operational records. We do not intentionally request special-category data; customers should not collect it unless they have a valid reason and appropriate safeguards.

Billing, support and product data

• Stripe customer, subscription, payment status and connected-account identifiers; Stripe handles payment credentials.
• Support, legal, privacy, billing, security and feedback messages, including diagnostic context you choose to attach.
• First-party product events such as page views, button use, publishing steps, app opens, client errors and web-vital measurements. Pseudonymous events use a hashed random browser identifier and do not include e-mail addresses or page content.

We obtain this data from you, your use of the service, visitors interacting with your site, Stripe, and infrastructure providers that help deliver and secure the service.

4. Why and on what legal basis

Our legitimate interests include keeping BrixCanvas secure, understanding whether the product works, preventing fraud, enforcing our terms and improving the service. We balance those interests against your rights and minimise the data used. Where processing relies on consent, you may withdraw it at any time without affecting earlier lawful processing.

5. Websites built by customers

A BrixCanvas website is controlled by the account that created it. Contact that site owner first about an order, booking, form submission, newsletter, customer account or request concerning data collected through that site. We assist the owner where needed and may act directly when the law requires it.

Customers can add third-party embeds, webhooks, custom domains, Google Analytics or Meta Pixel. Those tools may receive visitor data under the customer's settings and their own policies. Optional analytics and advertising tools should only load after the visitor's required consent. Customer templates may also request font files from Google, which can cause the visitor's browser to send connection data such as an IP address to Google.

To report phishing, scams or impersonation on a hosted website, use our dedicated website report form.

6. AI features

When you ask BrixCanvas to generate or improve content, the prompt, relevant site context and generated result are processed using Microsoft's Azure-hosted AI services. Microsoft states that prompts and outputs for these Azure services are not made available to other customers or OpenAI and are not used to train generative foundation models without permission. Inputs and outputs may be automatically screened, and flagged samples may be reviewed under Microsoft's abuse-monitoring controls.

Do not place confidential, special-category or unnecessary personal data in an AI prompt. AI output can be inaccurate or resemble other material; review it before publishing.

When you use Brixie, we send the instruction and the minimum relevant site context—such as the active page, Brix types, selected Brix and theme—to produce advice, a plan or a requested draft. Brixie chat messages are currently kept in the open browser session and are not stored as a separate conversation history in your account. Generated changes that you apply become part of your site and its normal revision history.

A reference screenshot is sent temporarily to the same Azure-hosted AI service for visual analysis and is not added to your BrixCanvas media library or stored as a Brixie conversation attachment. The returned high-level analysis remains in the open browser session unless you apply generated changes to your site.

The universal Ask Brixie panel may send the current BrixCanvas screen category, path, your question and up to six recent messages from the open panel. If you are authorized for a site-management screen, we may add only a minimal summary such as the site name, draft or published status and installed App names. We do not provide Brixie with passwords, API keys, payment secrets, arbitrary database access, filesystem access, terminal access or another customer's site content.

Safety checks can classify a request as seeking credentials, internal instructions, executable scripts, malware, exploits or a rules bypass. We use the classification to refuse the request and enforce fair-use limits. Free-form chat content is not added to product analytics; operational records may contain the event type, user or rate-limit identifier, timing and technical outcome without storing the requested website copy as an analytics property.

7. Payments

For website subscriptions and separate domain registration, transfer or renewal orders, we process the billing identity, address, tax identifiers where provided, quoted amounts, currency, consent timestamps and Stripe payment and invoice references. Stripe Tax uses billing details and verified tax identifiers to determine the applicable tax treatment. Providing the required billing and holder information is necessary to fulfil an order; without it we cannot complete the purchase. We use payment and tax records to perform the contract, prevent fraud and meet accounting obligations, not to train Brixie.

Stripe processes BrixCanvas subscriptions and, where a customer enables commerce, can process payments for that customer through Stripe Connect. Payment details are entered into Stripe's payment flow. BrixCanvas receives operational records such as customer or account identifiers, status, amount, currency and timestamps, but not the full card number or card security code.

Stripe describes its own controller and processor roles in its privacy documentation. A BrixCanvas merchant remains responsible for giving shoppers the information required for its own sale.

8. Service providers and sharing

Domain searches send the requested name and extension to Openprovider to check availability and prices. When you order, necessary holder data is sent to Openprovider and the responsible registry for registration, verification, renewal or an authorised transfer. Depending on registry rules and applicable law, registration data may be disclosed through registration-data services or to authorised parties; we do not promise universal WHOIS privacy. Registries and registrars may act as independent controllers for their legal functions and set their own mandatory retention periods.

We share only what is reasonably needed with:

• Microsoft Azure for application hosting, databases, file storage, e-mail delivery, AI generation, monitoring and security.
• Stripe for subscriptions, payments, invoicing, connected merchant accounts and fraud prevention.
• Openprovider and the applicable domain registry when you order a domain: holder name, contact and address details, registry-required declarations and any necessary transfer authorization. These parties may require identity verification and process registration records under their own legal obligations. We encrypt temporary transfer codes and holder details in the order, remove that temporary payload after confirmed submission or cancellation, and retain necessary payment and order history for accounting and support. Review orders may require longer retention until resolved.
• Providers selected by a customer, such as external embeds, analytics, advertising, webhook destinations, domain/DNS providers and connected services.
• Professional advisers, authorities or transaction parties where reasonably necessary to obtain advice, comply with law, protect users, investigate abuse, or complete a legitimate restructuring or sale with suitable safeguards.

We do not sell personal data and do not share it for third-party behavioural advertising on the BrixCanvas platform itself.

Links to external domain providers open their own websites. We do not send your account or billing details through these links. If you buy a domain there, you provide your information directly to that provider under its privacy policy. Searches made inside BrixCanvas still use Openprovider as described above.

9. International transfers

Choosing a country-code domain may require sending holder information to its registry outside the EEA. Azure AI deployments and provider support or abuse monitoring may also involve processing outside the primary EU hosting region. We do not promise that every AI request or domain transaction stays in the Netherlands or EU. Contact us for the relevant provider and transfer safeguards before submitting sensitive or regulated information.

Our primary application and storage resources are configured in Azure regions in the European Union. Some providers or their approved subprocessors may process data outside the European Economic Area, and customer-selected integrations may do the same. Where required, transfers rely on an adequacy decision, the European Commission's Standard Contractual Clauses, or another lawful transfer mechanism, together with supplementary safeguards where appropriate.

We suggest EUR or USD using your approximate country, looked up from your IP address locally on our server, with your browser's regional language preference as a fallback. We do not send your IP address to a geolocation provider, request GPS access or store a location history for this purpose. We remember the suggested currency in the first-party brix_currency cookie for your browser session, or for up to one year after you select a currency yourself. You can change currency independently of language. Existing purchases retain their agreed currency. Country suggestions do not determine your tax treatment.

IP Geolocation by DB-IP · CC BY 4.0

10. Cookies and similar storage

BrixCanvas uses essential cookies or local storage for login sessions, security, trusted devices, language, consent choices and basic product operation. Our first-party product measurement does not use advertising cookies and does not store your IP address, e-mail address or site content in product events.

Customer-created websites can have their own cookies and integrations. The site owner is responsible for a suitable cookie notice and consent controls. Where BrixCanvas supplies a consent control, it is a configuration aid—not a substitute for the owner checking its legal obligations.

11. Retention

• Accounts and sites: kept while the account is active. Account deletion removes active sites, site media and private backups, subject to short technical processing time and legal exceptions.
• Free sites: sites associated with 90 days of account inactivity may be cleaned up after warning.
• Backups and revisions: weekly private backups rotate after eight snapshots; post revisions are normally retained for up to 90 days.
• Product events: pseudonymous browser events are normally retained for 90 days and events associated with an authenticated account for 13 months.
• Operational records: webhook deliveries are normally retained for 30 days; expired sessions and codes are cleaned up automatically. Security and audit records may be kept longer where needed to protect the service or establish legal claims.
• Contact messages: normally retained for up to 24 months, or longer when needed for an unresolved legal, security, billing or fraud matter.
• Withdrawal notices: your name, email, purchase reference, declaration and receipt timestamp are delivered to our support inbox and to your email as proof of receipt. We use them to handle your request and legal obligations. Ordinary correspondence follows the contact-message period; necessary refund, accounting or dispute evidence follows its applicable legal retention period. The form does not automatically cancel a domain or authorize a refund.
• Payment and tax records: necessary Dutch accounting records are generally retained for seven years. Records subject to a ten-year rule, such as applicable OSS records, are kept for that period. Deleting an account does not erase legally retained invoices, payment evidence or registry records. Access to retained records is restricted to their accounting, legal, fraud-prevention or dispute purpose.

Data may be anonymised instead of deleted where it can no longer identify an individual.

12. Security

We use measures designed for the nature of the service, including TLS in transit, encryption provided by Azure at rest, password hashing, access controls, rate limits, secure session handling, backups, dependency scanning, audit records and abuse detection. No internet service is risk-free. Keep your login secure, enable available account protections and contact us promptly if you suspect misuse.

13. Your rights

Depending on the circumstances, the GDPR gives you rights to access, correct, delete, restrict or receive your personal data; object to processing based on legitimate interests; withdraw consent; and complain to a supervisory authority. You also have the right not to be subject to a solely automated decision that produces legal or similarly significant effects where the GDPR applies.

You can download an account export, update profile details and delete your account from Account settings. For anything else, use the privacy request form. We normally respond within one month, may ask you to verify your identity, and may extend the period for a complex request as permitted by law.

You can complain to the Autoriteit Persoonsgegevens in the Netherlands or, where applicable, your local EEA supervisory authority.

14. Children

BrixCanvas accounts are intended for people aged 16 or older. A younger person may use the service only with valid permission and supervision from a parent or legal guardian. Customer-created sites that are directed at children remain the customer's responsibility, including age-appropriate information and consent requirements.

15. Changes and contact

We update this policy when BrixCanvas, our providers or the law changes. The update date above identifies the published version. If a change materially affects how we use account data, we will provide a reasonable notice in the dashboard, by service message or by e-mail.