Privacy Policy

Last updated: 21 May 2025

1. Who we are

This Privacy Policy describes how THE CANVAS APP INC (RUC 155693360-2-2020 DV10), located at Parque Industrial Costa del Este, Calle Primera, Ciudad de Panamá, Panamá (“THE CANVAS APP”, “we”, “our”, “us”) collects, uses, and discloses information about you when you use our website, mobile applications, and related services (collectively, the “Services”).

2. Information we collect

2.1 Information you provide to us

• Account information (name, email address, password, phone number)
• Profile details and preferences you add to the Services
• Payment information processed via our PCI‑compliant partner Stripe
• Content you post (e.g., ride listings, messages, support requests)

2.2 Information collected automatically

• Log files (IP address, browser type, pages visited, timestamp)
• Device identifiers and operating system information
• Usage data captured with cookies and similar technologies (see “Cookies & tracking” below)

3. How we use your information

We use the information we collect to:

• Provide, maintain, and improve the Services
• Facilitate payments and prevent fraud
• Personalize your experience and show relevant content
• Communicate with you about your account, rides, and updates
• Comply with legal obligations and enforce our Terms of Service

4. Legal bases for processing (EEA/UK users)

Where GDPR applies, our processing is based on:

• Contract – to provide the Services you request
• Legitimate interests – e.g., to keep the Services secure
• Consent – for optional analytics and marketing cookies
• Legal obligation – when we must retain data for tax or accounting

5. Sharing your information

We share information only when necessary:

• With payment processors (e.g., Stripe) to handle transactions
• With service providers who help us run the Services under confidentiality agreements
• If required by law or to protect rights, property, or safety
• In connection with a merger, acquisition, or sale of assets

6. International data transfers

Our servers are located in the European Union and the United States. If you reside outside these regions, your information may be transferred and processed in jurisdictions that may not provide the same level of data protection as your home country. Where required, we rely on Standard Contractual Clauses or equivalent safeguards.

7. Data retention

We retain personal data only for as long as necessary to fulfil the purposes outlined in this Policy, unless a longer retention period is required or permitted by law.

8. Your rights

Depending on your location, you may have rights to access, correct, delete, restrict, or object to the processing of your personal data, as well as the right to data portability. You can exercise these rights at any time by contacting us (see Section 12).

9. Security

We use administrative, technical, and physical safeguards to protect personal data. However, no Internet transmission or storage system is guaranteed to be 100% secure.

10. Children

The Services are not directed to children under 16. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

11. Changes to this Privacy Policy

We may modify this Policy from time to time. We will post the updated version with a new “Last updated” date. Continued use of the Services after the changes become effective constitutes acceptance.

12. Contact us

If you have questions about this Policy or your personal data, please contact our data protection representative: