Privacy policy

1. Who is responsible for your data

The data controller is ACCENSEO (brand: addly), 60 rue François Ier, 75008 Paris, France, registered under SIREN 929 897 072.

For any privacy question, write to support@addly.app with "Privacy" in the subject line, or send a letter to the address above. We have not appointed a data protection officer, because our processing does not require one; privacy requests are handled by the president of the company.

2. What we collect

We collect as little as we can, and only what a feature actually needs.

3. Your designs and the content you submit

This is the part people ask about most, so it comes early. When you run a feature, the app sends only the content that feature needs to our servers, processes it, returns the result, and deletes the input.

Inputs are held no longer than 24 hours, and only so a retry or a crash report can be handled; most are deleted within minutes. We do not keep a copy of your Canva designs, we do not browse them, and we do not train any model on them.

Features that run entirely in your browser never send anything at all. Each app page says which features are local and which call our servers.

4. Why we process it, and on what legal basis

Under the GDPR every processing activity needs a legal basis. Ours are these:

5. What we never do

We never sell personal data. We never rent or trade mailing lists. We run no advertising network, place no advertising cookie, and build no profile of you for marketing purposes.

We do not use your content to train artificial-intelligence models. Where an app feature relies on a model, it is called with your input, returns a result, and the provider is contractually barred from retaining or training on what we send.

6. Who else processes your data

We use a short list of subprocessors, each bound by a data processing agreement:

We publish changes to this list here. We may also disclose data to a court, an authority, an accountant or a lawyer where the law requires it, and to an acquirer if the business is ever sold — in which case you are told before anything moves.

7. Where your data lives

Your account data, your billing records, your support history and everything our apps process are stored on servers in France, inside the European Union.

Two exceptions involve a transfer outside the EU: Stripe may process payment data in the United States, and a support request answered by email may transit its sender's infrastructure. Both rest on the European Commission's standard contractual clauses together with technical safeguards.

8. How long we keep it

9. How we protect it

Everything travels over TLS. Databases are encrypted at rest and backed up daily to an encrypted store in the same region. Access to production data is limited to the people who need it, protected by multi-factor authentication, and logged.

We keep dependencies current, review code before it ships, and separate development data from production data. If a breach ever affects your rights, we notify the CNIL within 72 hours and tell you directly in plain language.

10. Your rights

Under the GDPR you may ask us to:

• give you a copy of your data, in a portable format;
• correct anything inaccurate;
• delete your data, where we have no overriding legal obligation to keep it;
• restrict or object to a processing based on our legitimate interest;
• withdraw a consent you gave, at any time, without affecting what came before;
• tell you how an automated decision was made — though we take none that affects you legally.

Write to support@addly.app and we answer within one month, free of charge. We may ask for proof of identity when a request concerns data we cannot otherwise tie to you. You can also delete your account yourself, which erases everything we are not legally bound to keep.

If our answer does not satisfy you, you may complain to the CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, or to the supervisory authority of your own country.

11. Children

Our apps are professional tools and are not directed at children. We do not knowingly collect data from anyone under 16. If you believe a child has given us data, write to us and we will delete it.

12. Cookies

This site sets no advertising or tracking cookie. The few cookies it does use are strictly necessary or remember a preference you set yourself. Our cookie policy lists each one, what it does and how long it lasts.

13. Canva's own processing

addly is independent from Canva, and Canva is a trademark of Canva Pty Ltd. When you use an app inside the Canva editor, Canva processes its own data about that session under its own privacy policy, which we neither control nor can access.

What Canva shares with us is limited to a pseudonymous user identifier, your display name and your locale — enough to recognize your plan, nothing more.

14. Changes to this policy

When our processing changes, this page changes with it, and the date at the top moves. For a change that materially affects you we email account holders before it takes effect. Earlier versions are available on request.