1. Controller and scope
The provider identified on this page is the controller for personal data processed through the service. Missing provider identity is not replaced with invented information, and live commerce remains closed.
2. Data categories
Account and contact details, username, security records, draft content, optional image, submission and moderation state, Board coordinate and dates, comments, reactions, and support records may be processed.
Payment is closed during prelaunch. Card data is not processed by Manifesting Canvas servers.
3. Purposes and legal grounds
Data is processed to manage accounts and security, store drafts, process images safely, submit content for moderation, display approved content at selected destinations, prevent abuse, provide support, and meet legal duties.
Processing may rely on contract, legal obligation, establishment or protection of rights, and legitimate interests that do not override fundamental rights. Separate consent is requested only when required.
4. Public visibility
For an approved manifest, the username, title, intention, category, color, optional image, publication time, and community counters may be public.
First name, last name, email, account ID, payment information, and storage keys are not added to the public manifest response.
5. Images
Eligible JPG, PNG, or WebP images pass size and type checks, are decoded, safely re-encoded, and stripped of unnecessary metadata.
Retention and deletion processes apply when a draft changes, a submission ends, or all active placements are removed.
6. Providers and transfers
Limited data may be shared with contracted hosting, object-storage, email, security, and support providers as necessary. Appropriate safeguards are used for any cross-border transfer.
7. Retention
Draft, submission, moderation, public manifest, and security records are kept only as needed for their purpose and legal duties. The end of 30-day Board visibility does not mean every related record is deleted at the same moment.
8. Rights and requests
You may exercise applicable access, correction, deletion, objection, and other privacy rights through written support channels. Only the minimum information needed for identity verification is requested.