Privacy Policy

Effective Date: September 28, 2026 • Last Updated: September 28, 2026

Welcome to canvagamesbanner.com ("CanvaGamesBanner", "we", "our", or "us"). We operate a free web-based social media banner and graphic creation platform accessible at https://canvagamesbanner.com. We are committed to maintaining the highest standards of user privacy, transparency, and data protection.

This Privacy Policy explains how information about you is collected, processed, and safeguarded when you visit our website, utilize our design canvases, or view programmatic advertisements served on our content pages. It also details your privacy rights under applicable data protection regulations, including the General Data Protection Regulation (GDPR), the UK Data Protection Act, the California Consumer Privacy Act (CCPA/CPRA), and Google Publisher Policies.

---

1. Privacy-by-Design & Zero Mandatory Registration

CanvaGamesBanner is architected from the ground up on principles of data minimization:

• No Account Required: We do not require users to create an account, log in, provide an email address, or create a password to access our template catalog, customize layouts, or download high-resolution graphics.
• No Payment Details Collected: All templates, size guides, and export features are 100% free. We never request, process, or store credit card numbers, billing addresses, or banking information.

2. Client-Side Canvas Processing (Zero Cloud Storage of Designs)

When you personalize a banner by typing names, job titles, companies, contact handles, or custom color palettes into our live design editor, all processing takes place entirely on your device via client-side HTML5 Canvas technology.

• Your customized text, uploaded photos, and generated graphic elements are held temporarily in your local browser’s volatile memory (RAM).
• We do not transmit, scrape, copy, store, or archive your customized designs, personal photos, or draft graphics on our web servers or any cloud database.
• The moment you refresh the page or close your browser tab, your design session is completely flushed from your local device memory.

3. Information We & Our Third-Party Partners Collect

While we do not collect personal registration data, our web infrastructure and third-party advertising partners automatically collect technical metadata necessary for network routing, security, and digital ad delivery:

Category of Data	Specific Data Points Collected	How It Is Collected
Technical & Network Identifiers	Internet Protocol (IP) address, approximate geographic location (country, region, and city level derived from IP), Internet Service Provider (ISP).	Automated HTTP request headers upon page connection.
Device & Browser Signals	Device type (mobile, tablet, desktop), browser family and version, operating system (e.g., iOS, Android, macOS, Windows), screen resolution, and preferred system language.	User-Agent strings and browser DOM environment queries.
Cookie & Advertising Identifiers	Pseudonymous alphanumeric cookie IDs, Google DoubleClick / AdX identifiers, CMP consent strings (TCF 2.2 consent string).	Stored locally in your browser through HTTP cookies and LocalStorage.
Usage & Interaction Telemetry	Referring URL, pages viewed, time spent on pages, scroll depth, click timestamps, and ad viewability metrics.	Standard web server logs and programmatic ad tags.

4. Specific Purposes of Data Collection & Processing

In compliance with international data privacy laws and programmatic ad network requirements, we and our authorized advertising partners process technical data exclusively for the following defined purposes:

1. Fraud Detection & Invalid Traffic (IVT) Prevention:
   Technical signals (IP addresses, User-Agent patterns, and request rates) are analyzed by automated security tools and Google Ad Manager to detect, filter, and block malicious bots, automated scraping scripts, click farms, and fraudulent ad impressions. This protects our infrastructure and ensures advertisers are charged only for legitimate, authentic human engagement.
2. Ad Personalization & Audience Targeting:
   Where permitted by user consent, Google and certified demand partners use cookie identifiers and browsing history across partner sites to display advertisements tailored to your interests, shopping preferences, and demographic profile.
3. Contextual Ad Serving:
   Where users opt out of personalized ads or in jurisdictions requiring opt-in consent, ads are served contextually based on the content of the page currently being viewed (e.g., displaying photography equipment ads on a YouTube channel art tutorial) without building an individualized user tracking profile.
4. Ad Measurement, Frequency Capping & Attribution:
   To monitor ad performance, track impression delivery, audit viewability standards (such as MRC/IAB viewability metrics), and enforce frequency capping—ensuring you do not repeatedly see the exact same advertisement during a single browsing session.
5. Technical Infrastructure & Security:
   To balance server loads, defend against Distributed Denial of Service (DDoS) attacks, troubleshoot technical bugs, and optimize website loading speeds across global Content Delivery Networks (CDNs).

5. Comprehensive Data Retention Schedule

We believe in strict data retention limits. Technical data is stored only for as long as strictly necessary to fulfill the operational and security purposes outlined above. Below is our formal data retention schedule:

Data Classification	Primary Purpose	Maximum Retention Period	Disposal / Purge Method
User Banner Designs & Personal Input	Client-side canvas rendering	0 Days (Zero Retention)	Flushed immediately upon closing browser tab. Never stored on server.
Web Server Access Logs (IP & User-Agent)	DDoS mitigation, server error debugging, and security auditing	Up to 90 Days	Automatically overwritten and permanently deleted on rolling 90-day cycles.
Invalid Traffic (IVT) & Bot Audit Logs	Detecting and preventing ad click fraud and scraper attacks	Up to 180 Days	Aggregated into non-identifiable statistical counts; raw IPs purged.
Third-Party Advertising Cookies (Google AdX)	Ad personalization, attribution, and frequency capping	30 Days to 13 Months	Managed directly by Google/vendors; expires automatically or cleared via browser.
CMP Consent Preference Records	Remembering your cookie choices under GDPR / ePrivacy	Up to 12 Months	Stored locally in browser cookie; consent re-prompted after 12 months.
Direct Contact Email Inquiries	Responding to support and business communications	Up to 6 Months	Archived and deleted once support inquiry is fully resolved.

6. Programmatic Advertising, Google AdX & Certified Partner Networks

To fund the free operation of CanvaGamesBanner without charging subscription fees, we display digital advertisements across our editorial and template catalog pages. We partner with Google Ad Manager and authorized Google Certified Publishing Partners (Multiple Customer Management / MCM Partners) to access the Google Ad Exchange (AdX) and programmatic demand sources (Header Bidding / Open Bidding).

These third-party advertising technologies operate under Google’s strict publisher policies:

• DoubleClick Cookies: Google uses cookies (such as DoubleClick cookies) to serve ads on our site based on prior visits to our site and other websites across the web.
• Authorized Demand Partners: Third-party ad networks and demand-side platforms (DSPs) bidding through Google AdX may also place and read cookies or employ web beacons to collect non-personally identifiable technical information during ad auctions.
• Google Privacy Policy: To learn more about how Google handles data in advertising products, visit the Google Advertising Privacy & Terms Page.

7. Cookie Management & Opt-Out Mechanisms

You have full autonomy over how cookies and advertising identifiers are utilized on your device. You can exercise your choices through the following mechanisms:

• Google Ad Personalization Controls: You can manage or disable personalized advertising served by Google by visiting the Google Ads Settings Dashboard.
• Industry-Wide Opt-Out Tools: You can opt out of interest-based advertising from participating ad networks via:
  • United States: Digital Advertising Alliance (DAA) at aboutads.info
  • Europe: European Interactive Digital Advertising Alliance (EDAA) at youronlinechoices.eu
  • Network Advertising Initiative: NAI Opt-Out Tool at networkadvertising.org/choices
• Browser-Level Cookie Settings: Most modern browsers (Chrome, Safari, Firefox, Edge) allow you to block third-party cookies, clear existing cookies, or browse in private/incognito mode. Note that disabling cookies may affect certain site display preferences.

8. European Economic Area (EEA) & UK User Rights (GDPR)

If you reside within the European Economic Area (EEA), the United Kingdom, or Switzerland, your personal data is protected under the General Data Protection Regulation (GDPR) and UK GDPR.

Lawful Bases for Processing:

• Legitimate Interests: We process server logs, basic IP data, and security telemetry under Article 6(1)(f) GDPR to safeguard our platform against DDoS attacks, bot networks, and ad fraud.
• Consent: In jurisdictions where required by the ePrivacy Directive and GDPR, non-essential cookies and personalized advertising are processed exclusively upon obtaining your affirmative, freely given consent via our Consent Management Platform (CMP).

Your GDPR Rights:

• Right of Access: Request confirmation of whether your data is processed and obtain a copy.
• Right of Rectification: Request correction of inaccurate personal data.
• Right to Erasure ("Right to be Forgotten"): Request deletion of your personal data where retention is no longer legally justified.
• Right to Object & Restrict Processing: Object to processing based on legitimate interests or request restrictions on data handling.
• Right to Withdraw Consent: You may revoke advertising consent at any time without penalty.
• Right to Lodge a Complaint: You have the right to file a complaint with your national Data Protection Authority (DPA).

9. California Consumer Privacy Act (CCPA / CPRA) Disclosures

Under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CPRA), California residents enjoy specific privacy rights:

• Non-Sale of Personal Information: CanvaGamesBanner does not sell personal information for monetary compensation.
• Sharing for Cross-Context Behavioral Advertising: We may share pseudonymous device identifiers and browsing metadata with programmatic ad networks to deliver tailored ads. California residents have the right to opt out of such sharing via our opt-out links or by enabling Global Privacy Control (GPC) signals in their web browser.
• Right to Know & Delete: You have the right to request disclosure of categories of data collected and request deletion of personal information.
• Non-Discrimination: We will never discriminate against, penalize, or degrade the service quality for any user exercising their privacy rights.

10. Children's Online Privacy Protection (COPPA Compliance)

CanvaGamesBanner is intended for general audiences, professionals, and students. We do not knowingly collect, request, or solicit personal data from children under the age of 13 (or under 16 in certain European jurisdictions). If we become aware that personal information from a minor has been collected without verified parental consent, we will promptly purge that information from our records.

11. International Data Transfers

Our website servers and Content Delivery Network nodes are located in the United States and globally distributed data centers. If you access CanvaGamesBanner from outside the United States, your technical connection metadata may be transferred across international borders. We ensure that our infrastructure providers and third-party vendors adhere to Standard Contractual Clauses (SCCs) approved by the European Commission.

12. Updates to This Privacy Policy

We may update this Privacy Policy periodically to reflect enhancements in our application features, operational infrastructure, or amendments to advertising industry regulations. Whenever modifications are published, we will revise the "Last Updated" date at the top of this document. We encourage users to review this page periodically.

13. Data Controller & Contact Information

If you have questions, feedback, or requests regarding this Privacy Policy or wish to exercise any of your data protection rights, please contact our privacy compliance team: